May 30, 2019

Worms deliver cryptomining malware to web servers

An automated attack, targeting poorly-protected Apache Tomcat servers, turns enterprise hardware into a high-end cryptominer

SophosLabs Uncut

April 04, 2019

Apache needs a patchy! Carpe Diem, update now

A flaw in one of the world’s most popular web servers could give an attacker a way to gain full control of Unix-based systems.

Naked Security

October 22, 2018

Popular website plugin harboured a serious 0-day for years

The flaw in the popular file uploader allows an attacker to upload files and run their own command line shell on any affected server.

Naked Security

August 21, 2018

Serious Security: How to stop dodgy HTTP headers clogging your website

It's been dubbed ReDos, for Regular Expression Denial of Service - where a few rogue HTTP requests could clog your whole site.

Naked Security

September 20, 2017

The Apache “Optionsbleed” security hole explained [VIDEO]

If you're looking for a non-techie, plain English, verbal explanation of the Apache "Optionsbleed" security bug, watch this!

Naked Security

September 19, 2017

Apache “Optionsbleed” vulnerability – what you need to know

Remember Heartbleed, where servers could be tricked into letting other people's data slip? "Optionsbleed" is an Apache bug that's similar.

Naked Security

September 06, 2017

Apache Struts “serialisation” vulnerability – what you need to know

A bug in Apache Struts, a popular software toolkit for building web services, could let crooks take control of your server.

Naked Security

March 17, 2017

If Friday’s an 0-day, what about the weekend? [Chet Chat Podcast 260]

Enjoy the latest episode of our regular security podcast with Sophos experts Chester Wisniewski and Paul Ducklin

Naked Security

March 14, 2017

How a serious Apache vulnerability struts its stuff

Officially it's CVE-2017-5638, but in practice it's "the bug in Apache Struts you really should have patched by now". Here's why...

Naked Security