Apache Tomcat

In recent months, cybersecurity researchers have observed a surge in attacks targeting exposed Java Debug Wire Protocol (JDWP) interfaces. Threat actors are leveraging these unsecured endpoints to gain remote code execution capabilities, ultimately deploying cryptocurrency mining malware—most notably, customized versions of XMRig—on compromised systems.

Here's a deep dive into two recent high-profile security flaws—Tomcat’s Partial PUT attack and Camel’s Header Hijack—explaining their mechanisms, risks, and real-world exploitation scenarios.

Researchers from Wiz have uncovered a sophisticated cryptomining campaign, dubbed Soco404, that targets cloud environments by exploiting various vulnerabilities and misconfigurations. The attackers employ a unique method of embedding malicious payloads within fake 404 error pages hosted on Google Sites, demonstrating alarming ingenuity in cloud threat tactics.

On June 5, 2025, GreyNoise observed a significant and coordinated surge in brute-force and login attempts targeting Apache Tomcat Manager interfaces exposed to the internet. This activity marked a sharp deviation from typical background noise, with two GreyNoise tags—Tomcat Manager Brute Force Attempt and Tomcat Manager Login Attempt—registering volumes well above their usual baselines.