Experts Urge Rapid Patching of ‘Struts’ Bug

Summary: The Apache Software Foundation released updates on Aug. 22 to fix a critical vulnerability in Apache Struts, a Web application platform used by an estimated 65 percent of Fortune 100 companies, and exploit code has since been posted online. Attackers can exploit a vulnerable site with nothing more than a Web browser by sending the right request, after which the server runs any command of the attacker's choosing; users of Struts 2.3 should upgrade to 2.3.35 and users of Struts 2.5 to 2.5.17.
What's compelling: In the 2017 Equifax breach, attackers found vulnerable servers three days after Apache released a patch for a similar Struts flaw, and that entry point exposed personal data on 147 million Americans - the same platform, the same public exposure, and exploit code already circulating.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026