Do Son Apache Tomcat discloses 10 vulnerabilities including encryption bypasses and Kubernetes token leaks. Upgrade now to secure your Java-based web applications.
web server
A new large-scale SEO poisoning campaign, "Operation Rewrite," uses the BadIIS module to hijack web servers, manipulate search results, and redirect users to scams.
CERT/CC warns of critical flaws in the Hiawatha web server. The vulnerabilities could allow attackers to bypass authentication and hijack sessions.
Apache Tomcat has released updates for two serious flaws: a session fixation vulnerability and a "MadeYouReset" DoS vulnerability affecting multiple versions.
A critical RCE (CVE-2025-34300, CVSS 10.0) in Lighthouse Studio's Perl CGI scripts allows unauthenticated attackers to execute arbitrary code on web servers hosting surveys.
Apache HTTP Server 2.4.64 patches 8 vulnerabilities, including HTTP Response Splitting, SSRF, DoS, and TLS desync attacks. Upgrade immediately!
Apache Tomcat 9.0.107 patches three critical DoS flaws (CVE-2025-52434, CVE-2025-52520, CVE-2025-53506) that can disrupt web services via HTTP/2, file uploads, and excessive streams.
Apache Tomcat patched four vulnerabilities affecting versions 9.0, 10.1, and 11.0, ranging from DoS to privilege bypass. Update immediately
GreyNoise reports a massive brute-force campaign targeting Apache Tomcat Manager interfaces, with hundreds of malicious IPs attempting to compromise services.
A low-severity flaw in Apache Tomcat (CVE-2025-46701) allows security constraint bypass via crafted URLs on case-insensitive file systems. Update now!
A high-severity flaw (CVE-2025-47947) in ModSecurity's Apache module allows DoS via JSON. PoC exists, no workaround, and a patch is expected soon.
A sophisticated campaign deployed malicious IIS modules on South Korean web servers, enabling traffic control and backdoor access. Suspected Chinese actor.