Featured Article
New Design, New Features: Maven Central Improvements for Developers
Department of Homeland Security Cybersecurity: Top 10 Vulnerabilities Still Being Exploited
3 minute read time
DHS CISA lists Apache Struts as a top vulnerability. Yet, evidence shows it is still being downloaded - on average, by 10,000 organizations a month.
Read More...
Deja Vu All Over Again - Another New Apache Struts Vulnerability (CVE-2018-11776)
2 minute read time
Another remote code execution vulnerability in Apache’s Struts2 Framework was disclosed on August 22, 2018. Everything you need to know and how to find out if you're affected.
Read More...
Remote code execution vulnerability (CVE-2017-8046) in Pivotal's Spring Framework
2 minute read time
A remote code execution vulnerability (CVE-2017-8046) in Pivotal's very popular Spring Framework was disclosed last week, although the original vulnerability dates back 7 months to late 2017.
Read More...
Struts2 Breach at Equifax was 100% Preventable. Here's how.
25 second read time
The breach at Equifax is a siren call for organizations to approach the problem of managing open source software by using automated technology.
Read More...
Security Processes at the Apache Software Foundation (video and podcast)
1 minute read time
In our continuing series on the Struts2 vulnerability announcement and the breach at Equifax, we spoke with Mark Thomas, Director, Apache Software Foundation
Read More...
![08298b6[1].jpg](https://blog.sonatype.com/hubfs/blog-image-uploads/08298b6%5B1%5D.jpg)
Struts2 Vulnerabilities: Who Is Responsible? (Video and Podcast)
1 minute read time
With the acknowledgement by Equifax this morning, we talk about who is responsible for this, the creators of the open source solutions or people who use them.
Read More...
Remediation at Scale: Lessons from PayPal for the Equifax Security Team
2 minute read time
PayPal Lessons for the Equifax Security Team regarding the Struts2 related breach.
Read More...
Bracing for Impact in More Ways than One -- Apache Struts2 (S2-053)
5 minute read time
How one Sonatype Engineer responded to the Apache Struts2 announcement... while dealing with a hurricane bearing down on him.
Read More...
Sonatype Statement: Struts2 and Equifax Breach
2 minute read time
Organizations like Equifax who leverage open source are responsible for practicing hygiene in a timely manner when fixes for vulnerabilities are available.
Read More...