Do Son Critical RCE and XSS vulnerabilities hit Apache ActiveMQ (CVE-2026-41044, 40466). Authenticated attackers can hijack the JVM. Update to 5.19.6 or 6.2.5 now.
JVM
OpenTelemetry patches a critical 9.3 RCE flaw (CVE-2026-33701) in its Java agent. Unfiltered RMI deserialization allows full system takeover. Update to 2.26.1.
A Critical flaw (CVE-2025-11919) in Wolfram Cloud allows RCE and privilege escalation. Attackers exploit a race condition in the shared /tmp/ directory to inject code into other tenants' JVMs.