Apache Struts CVE-2026-104711 Enables Remote Code Execution via Legacy RESTful Mapper
Apache Struts has released fixes for four vulnerabilities, including one that allows unauthenticated remote code execution when the legacy RESTful mapper is enabled.
The flaw, identified as CVE-2026-104711, is an OGNL injection that depends on the application using the deprecated RESTful mapper. Applications running the default mapper, restful2, or the official Struts REST plugin are not affected. In version 7.x the issue only manifests when the OGNL allow-list is disabled.
When the legacy mapper is active, it extracts action names and parameters straight from the URL. Attackers can therefore supply a malicious OGNL expression that is evaluated by the framework, leading to arbitrary code execution.
Affected versions include 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Patches are available in 6.12.0 and 7.4.0 and later releases.
The three additional vulnerabilities do not result in code execution. Two affect availability: one causes small requests to generate disproportionately large responses, consuming CPU and bandwidth, while the other exhausts memory by accepting unbounded request bodies. The memory-exhaustion issue received an “important” severity rating and now enforces a default limit of 2,097,152 characters.
The fourth flaw is subtler and does not require malicious input. Shared message formatters can interfere between concurrent requests, potentially leaking data or producing rendering errors under normal traffic.
Related articles
October 'In Trend VM' Report: Exploited Windows ALPC and Check Point VPN Vulnerabilities
Positive Technologies has released its October edition of the 'In Trend VM' digest, highlighting two actively exploited vulnerabilities. The first is CVE-2026-85880, a local privilege escalation flaw in the Windows ALPC mechanism that was used as a zero-day in targeted attacks by multiple APT clusters. The second is CVE-2026-85102, a critical remote code execution vulnerability in Check Point Security Gateway and Spark Firewall products that affects VPN negotiation. Both issues have been added to CISA's KEV catalog, with public proof-of-concept code already available for the Check Point flaw. The report details attack chains, affected versions, and recommended patches or workarounds.
Windows PHP Updated to Patch Critical Brotli Vulnerability CVE-2026-111497
The PHP development team has released updated Windows builds of PHP that bundle a patched version of the Brotli compression library. The update addresses CVE-2026-111497, a critical out-of-bounds write flaw in Google's Brotli decoder that can lead to remote code execution, information disclosure, or denial of service. The vulnerability carries a CVSS v4.0 base score of 9.2 and is rated Critical. It affects PHP environments where the cURL extension has automatic decompression of HTTP responses enabled, allowing Brotli decoding to occur. Although cURL automatic decompression is disabled by default, applications or HTTP client libraries may enable it. The fix updates the bundled Brotli component to version 1.2.1 in the releases PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 published on October 26.
AI-Driven Software Boom Fuels Record Surge in Critical Vulnerabilities in 2026
The National Vulnerability Database recorded more than 72,000 CVEs between January and September 2026, compared with 48,244 for the entire previous year. The increase stems directly from the massive growth in code volume produced with AI coding assistants that allow features once requiring two weeks to be completed in a single afternoon. Much of this newly generated code reaches production without thorough human security review because models optimize for functionality rather than adversarial misuse. Common flaws such as missing authorization checks, exposed API keys in repositories, and insecure direct object references appear repeatedly in freshly deployed applications. Criminal groups have adopted the same AI tools to scan and test targets at scale, widening the gap between attacker speed and defender verification processes. Organizations that skip structured adversarial testing leave these issues to be discovered by threat actors, resulting in data exposure and operational disruption far costlier than pre-release remediation.
Apple Releases iOS 27.2 and iPadOS 27.2, Patching 163 Vulnerabilities Including Exploited Flaws in Older Versions
Apple has issued security updates for iOS and iPadOS, addressing a wide range of vulnerabilities across current and legacy operating systems. The iOS 27.2 and iPadOS 27.2 releases fix 163 CVEs affecting WebKit, the kernel, and image processing components. Older branches received targeted patches, with iOS 26.7.2 resolving 134 issues and iOS 18.7.11 addressing three vulnerabilities that include an actively exploited flaw. Specific fixes cover remote code execution risks in WebKit and ImageIO, plus sandbox bypasses. The updates were published on October 26, 2026, and apply to both iPhone and iPad devices. Apple also published detailed security content advisories for each branch.