VulnHub

Armatura LLC's Armatura One software has several critical vulnerabilities that could allow attackers to gain unauthorized access to sensitive systems. Versions prior to 4.7.2 and 4.6.1 for the USA release are affected by issues including the ability to execute arbitrary code and access hard-coded credentials. Specifically, a deserialization flaw in the software's embedded Apache ActiveMQ component is a major concern, as it can allow unauthenticated attackers to execute code with high privileges. Additionally, hard-coded cryptographic keys and passwords could lead to further exploitation if attackers gain access to the installation package. Users are strongly advised to upgrade to the latest versions to mitigate these risks.

A recent analysis by Sophos has revealed a malware strain that targets F5 BIG-IP Access Policy Manager appliances. This malware is particularly stealthy, as it injects a PHP web shell into the memory of the appliance rather than writing it to disk, making it invisible to traditional file-based security scans. The malware activates when Apache loads specific PHP scripts associated with the appliances, allowing attackers to maintain control without leaving obvious traces. This incident raises concerns for organizations using these appliances, as it highlights the need for enhanced monitoring of memory and runtime behavior in addition to standard disk checks. Companies should review their security measures to protect against this type of attack.

A cybercrime group known as Gambling Goblin has been targeting Brazilian government and educational websites by installing malicious Apache modules on their servers. This operation, which Check Point Research has been tracking since mid-2025, redirects users from these sites to pages promoting online gambling and sports betting. The attackers are likely Chinese-speaking, and their activities raise concerns about the security of public web infrastructure in Brazil. This incident not only affects the integrity of government and educational institutions but also poses risks to users who may unknowingly interact with these compromised sites. The situation highlights the ongoing challenges in cybersecurity for public entities and the need for robust security measures.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that these issues are actively being targeted by attackers. The vulnerabilities include a critical flaw in IBM's Langflow, an issue in Apache Tomcat, and a flaw in N-able N-central. These vulnerabilities could allow unauthorized access or remote code execution, putting various organizations at risk. Companies using these platforms should take immediate action to address these vulnerabilities to avoid potential breaches and data loss. Being listed in CISA's catalog emphasizes the urgency for affected users to implement the necessary security measures.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about vulnerabilities in Langflow, N-central, and Apache Tomcat that could be exploited for remote code execution and authentication bypass. These flaws allow attackers to run malicious code on affected systems, posing a significant risk to organizations using these platforms. The vulnerabilities are being actively exploited, which means that companies need to act quickly to protect their systems. Users of Langflow, N-central, and Tomcat should ensure they are running the latest versions and apply any available patches as soon as possible to mitigate these risks. This situation underscores the ongoing need for vigilance in cybersecurity practices, especially with widely used software.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, signaling active exploitation. The vulnerabilities include a code injection issue in IBM Langflow (CVE-2026-9198), an authentication bypass in N-able N-central (CVE-2026-18556), and a lack of encryption for sensitive data in Apache Tomcat (CVE-2026-34486). These vulnerabilities are significant threats to federal agencies and other organizations, as they can allow attackers to gain control over affected systems. CISA's Binding Operational Directive 26-04 emphasizes the need for rapid remediation of these high-risk vulnerabilities, urging federal agencies to act promptly. While the directive specifically targets federal agencies, CISA encourages all organizations to prioritize addressing these vulnerabilities to enhance their security posture.

A newly discovered vulnerability, CVE-2026-20230, affects Cisco's Unified Communications Manager (Unified CM) and is currently being exploited in the wild. This issue is a server-side request forgery (SSRF) flaw that allows attackers to drop webshells and execute code remotely on the affected servers. According to threat intelligence firm Defused, automated attacks have been observed using the Tor network to deploy these webshells. The exploitation process involves abusing the WebDialer SSRF to install a malicious Apache Axis service, which then facilitates the execution of further malicious payloads. Organizations using Cisco Unified CM should be aware of this security threat and take steps to mitigate potential risks.

Researchers have identified a software supply chain attack that has compromised several npm packages linked to the @antv ecosystem. The attack stems from a compromised maintainer account for the npm package 'atool.' Notably, this includes 'echarts-for-react,' a popular React wrapper for Apache ECharts, which has around 1.1 million weekly downloads. This incident is part of a broader campaign known as Mini Shai-Hulud and raises concerns about the security of widely used development tools. Developers and organizations using these packages should check their dependencies for any malicious changes and take appropriate actions to secure their software supply chains.

Apache has addressed a serious vulnerability in its HTTP/2 implementation, identified as CVE-2026-23918, which has a CVSS score of 8.8. This vulnerability is a double-free error that could allow attackers to execute arbitrary code remotely. Any systems using the affected version of Apache's HTTP server could be at risk, which includes a wide range of web applications and services relying on this technology. It's crucial for organizations using Apache to apply the latest updates to prevent potential exploitation of this flaw. Users are advised to check their current versions and ensure they are running the patched releases to mitigate this risk effectively.

Apache has released updates to address multiple vulnerabilities in its HTTP Server, including a serious flaw identified as CVE-2026-23918. This vulnerability, which has a CVSS score of 8.8, is a double-free error in the handling of HTTP/2 requests. If exploited, it could allow attackers to execute arbitrary code on affected systems. Organizations using Apache HTTP Server, particularly those enabling HTTP/2, should prioritize updating their software to mitigate this risk. The nature of the flaw makes it critical for system administrators to be proactive in applying the latest patches to safeguard against potential attacks.

Recent updates to Apache MINA and the Apache HTTP Server have addressed several high-severity vulnerabilities, with the most critical flaw allowing remote attackers to execute arbitrary code. This vulnerability poses a significant risk to users of these software platforms, as it could lead to unauthorized access and control over affected systems. Organizations that rely on Apache MINA and the HTTP Server need to prioritize applying these patches to safeguard their infrastructure. The updates are essential not only for protecting sensitive data but also for ensuring the overall integrity of services running on these platforms. Users should stay vigilant and ensure their installations are up to date to mitigate potential risks.

A severe vulnerability in Apache ActiveMQ, identified as CVE-2026-34197, has put over 6,400 servers at risk of exploitation. This widely used open-source message broker is utilized globally, with 6,476 instances exposed to the internet. Attackers could potentially execute code remotely, which could lead to significant security breaches. Organizations using ActiveMQ should take immediate action to assess their systems and implement protective measures. The urgency of this situation highlights the need for timely updates and monitoring of server configurations to prevent unauthorized access.

A remote code execution vulnerability, identified as CVE-2026-34197, was discovered in Apache ActiveMQ in early April. This vulnerability allows attackers to execute arbitrary code on affected systems, posing a significant risk to organizations using this messaging platform. As of now, it has been actively exploited in the wild, which raises concerns for users who have not yet applied necessary security measures. Companies that rely on Apache ActiveMQ should prioritize updating their systems to mitigate the risk of this vulnerability. The situation underscores the need for ongoing vigilance in maintaining software security to protect sensitive data and infrastructure from potential breaches.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a significant vulnerability in Apache ActiveMQ that is currently being exploited by attackers. This flaw, which had remained undetected for 13 years, was patched earlier this month. ActiveMQ, widely used for messaging in enterprise applications, is at risk, meaning organizations that rely on this software could be compromised if they haven't applied the recent update. The urgency of the situation is underscored by the fact that attackers are actively leveraging this vulnerability, making it crucial for users to take immediate action to secure their systems. Companies using ActiveMQ should prioritize updating to the latest version to protect against potential intrusions.