At a glance.
- Exploit code published for critical Apache Tomcat flaw.
- Microsoft describes a new RAT.
- Western Alliance Bank discloses breach tied to Cleo attacks.
Exploit code published for critical Apache Tomcat flaw.
An exploit has been published for a critical remote code execution vulnerability (CVE-2025-24813) in Apache Tomcat that was patched last Monday, the Register reports. Researchers at Wallarm observed exploitation in the wild beginning last Wednesday, several days before the exploit was released. The researchers note that the attack is "dead simple to execute and requires no authentication."
The exploit, which was published by a user on a Chinese forum, allows attackers to take over vulnerable Tomcat servers with just one PUT API request. Wallarm explains, "The attacker starts by sending a PUT request to upload a malicious session file to the server. The payload is a base64-encoded ysoserial gadget chain, designed to trigger remote code execution when deserialized. This request writes a file inside Tomcat’s session storage directory. Because Tomcat automatically saves session data in files, the malicious payload is now stored on disk, waiting to be deserialized....Once the session file is uploaded, the attacker triggers deserialization by sending a simple GET request with the JSESSIONID pointing to the malicious session. Tomcat, seeing this session ID, retrieves the stored file, deserializes it, and executes the embedded Java code, granting full remote access to the attacker."