pwn.watch: Apache incident updates

[critical] PHP2Shell: critical unauthenticated RCE in PHP core

Thu, 22 Oct 2026 19:09:59 GMT

Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.

Status: live · Patch: partial · Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35

Latest updates:

2026-10-22: Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. (source)
2026-10-22: Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky. (source)
2026-10-22: AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port). (source)

CVEs: CVE-2026-109618, CVE-2026-109619

[high] Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Tue, 04 Aug 2026 00:00:00 GMT

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-04: CISA added CVE-2026-34486 to the KEV catalog (due 2026-08-07).

CVEs: CVE-2026-34486

[high] Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability

Thu, 16 Apr 2026 00:00:00 GMT

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-16: CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30).

CVEs: CVE-2026-34197

[critical] Apache HTTP Server: HTTP Server Improper Escaping of Output Vulnerability

Thu, 01 May 2025 00:00:00 GMT

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Added to CISA KEV on 2025-05-01.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-05-01: CISA added CVE-2024-38475 to the KEV catalog (due 2025-05-22).

CVEs: CVE-2024-38475

[critical] Apache Tomcat: Tomcat Path Equivalence Vulnerability

Tue, 01 Apr 2025 00:00:00 GMT

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. Added to CISA KEV on 2025-04-01.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-01: CISA added CVE-2025-24813 to the KEV catalog (due 2025-04-22).

CVEs: CVE-2025-24813

[critical] Apache OFBiz: OFBiz Forced Browsing Vulnerability

Tue, 04 Feb 2025 00:00:00 GMT

Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. Added to CISA KEV on 2025-02-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-04: CISA added CVE-2024-45195 to the KEV catalog (due 2025-02-25).

CVEs: CVE-2024-45195

[critical] Apache HugeGraph-Server Improper Access Control

Wed, 18 Sep 2024 00:00:00 GMT

Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-18: CISA added CVE-2024-27348 to the KEV catalog (federal deadline 2024-10-09) (source)
2024-04-22: CVE-2024-27348 published (source)

CVEs: CVE-2024-27348

[high] Apache OFBiz Incorrect Authorization

Tue, 27 Aug 2024 00:00:00 GMT

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Added to the CISA KEV catalog on 2024-08-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-27: CISA added CVE-2024-38856 to the KEV catalog (federal deadline 2024-09-17) (source)
2024-08-05: CVE-2024-38856 published (source)

CVEs: CVE-2024-38856

[critical] Apache OFBiz Path Traversal

Wed, 07 Aug 2024 00:00:00 GMT

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-07: CISA added CVE-2024-32113 to the KEV catalog (federal deadline 2024-08-28) (source)
2024-05-08: CVE-2024-32113 published (source)

CVEs: CVE-2024-32113

[critical] Apache Flink Improper Access Control

Thu, 23 May 2024 00:00:00 GMT

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Added to the CISA KEV catalog on 2024-05-23. CVE-2020-17519 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-23: CISA added CVE-2020-17519 to the KEV catalog (federal deadline 2024-06-13) (source)

CVEs: CVE-2020-17519

[high] Apache Superset Insecure Default Initialization of Resource

Mon, 08 Jan 2024 00:00:00 GMT

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-08: CISA added CVE-2023-27524 to the KEV catalog (federal deadline 2024-01-29) (source)

CVEs: CVE-2023-27524

[critical] Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)

Thu, 02 Nov 2023 00:00:00 GMT

A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.

Status: closed · Patch: patched · Fixed in: 5.15.16, 5.16.7, 5.17.6, 5.18.3

Latest updates:

2023-11-02: CISA adds CVE-2023-46604 to the KEV catalog
2023-11-01: Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware (source)
2023-10-27: Apache publishes the CVE-2023-46604 announcement; fixed releases already out (source)

CVEs: CVE-2023-46604

[critical] Apache RocketMQ: Command Execution (CVE-2023-33246)

Wed, 06 Sep 2023 00:00:00 GMT

Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. Added to CISA KEV on 2023-09-06.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-06: CISA added CVE-2023-33246 to the KEV catalog (due 2023-09-27).

CVEs: CVE-2023-33246

[high] Apache Spark: Command Injection (CVE-2022-33891)

Tue, 07 Mar 2023 00:00:00 GMT

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. Added to CISA KEV on 2023-03-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-03-07: CISA added CVE-2022-33891 to the KEV catalog (due 2023-03-28).

CVEs: CVE-2022-33891