Loading story…
Internet scanning activity is probing Java Spring Boot applications for exposed Actuator heap dump endpoints that can return a heapdump.hprof file containing the live memory state of an application. Reported requests targeted paths such as /admin-api/actuator/heapdump, indicating attackers are also checking customized management base paths rather than only the default /actuator/heapdump location.
The probes used HTTP Basic authentication with the default credential pair admin:admin, raising the risk that poorly secured management interfaces could disclose sensitive data directly from memory. If accessible, the heap dump may expose API keys, database passwords, and other secrets, prompting recommendations to restrict Actuator access, replace default credentials, and protect management endpoints with stronger authentication and Spring Security.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
SANS Internet Storm Center reported observed probing of a Spring Boot Actuator heap dump endpoint, including a request to "/admin-api/actuator/heapdump" using the default HTTP Basic credentials "admin:admin". The report warned that accessible heapdump.hprof files can expose in-memory secrets such as API keys and database passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spring disclosed and national cyber agencies amplified six vulnerabilities in **Spring Tools** that affect developer environments for the Spring Java ecosystem, including **Spring Tools for Eclipse 5.2.0 and earlier** and **Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier**. The most serious issues include **`CVE-2026-47858`**, which can expose Spring Boot applications started with live information mode to **JMX-based remote code execution**, and **`CVE-2026-47873`**, where the Boot Dashboard Docker integration publishes unauthenticated **JDWP** and **JMX** ports on **`0.0.0.0`** instead of limiting access to loopback, potentially exposing container control interfaces to the network. A third high-severity flaw, **`CVE-2026-47882`**, weakens Spring Boot DevTools remote restart authentication by generating the shared secret with a non-cryptographic pseudo-random number generator. Advisories also cited additional issues involving **plaintext logging of proxy credentials**, **cleartext storage of remote secrets**, and a **cross-site scripting** vulnerability. Italy's ACN and the Canadian Centre for Cyber Security said updates are available or pending through Spring security bulletins, with fixed versions identified as **Spring Tools for Eclipse 5.3.0** and **Spring Tools for VSCode, Cursor, and Theia 2.3.0**, and urged organizations to upgrade affected tooling.
Jul 30, 2026
Broadcom published a large set of Spring security advisories affecting Spring Framework and related projects, with Sonatype tracking **91 CVEs** and identifying **209,569 affected software components** at the time of publication. The disclosures span multiple vulnerability classes, including insecure deserialization, untrusted code execution under certain conditions, sensitive information exposure, SSRF, path traversal, denial of service, and improper authorization, creating a significant downstream remediation burden for organizations that embed vulnerable Spring components indirectly through other software. Among the most serious issues, **`CVE-2026-59285`** in **Spring for GraphQL** was highlighted as a critical unsafe deserialization flaw that can lead to remote code execution in specific scenarios, while **`CVE-2026-59318`** in **Spring AI** was described as a prompt-injection-related tool-calling boundary bypass that could enable privilege escalation. Spring’s security advisory portal published the vendor notices, and defenders were urged to inventory Spring versions across their environments, determine real exposure and exploitability, and move affected systems to fixed releases as quickly as possible.
Aug 28, 2026
Attackers began exploiting the Spring Framework remote code execution flaw **Spring4Shell** (`CVE-2022-22965`) to plant JSP web shells on vulnerable Apache Tomcat servers and deliver cryptocurrency miners. Trend Micro reported attempts that wrote a web shell named `zbc0fb.jsp` into the Tomcat web root, then used it to run operating-system-specific payloads on both Windows and Linux systems. The activity followed Spring's disclosure of the RCE issue and its guidance to upgrade to fixed releases, including **Spring Framework 5.3.18** and **5.2.20** or later. On Windows targets, the observed chain used hidden PowerShell execution to fetch `ldr.ps1` in memory, which then downloaded a miner from `194.145.227.21`. The miner was designed to disable the firewall, kill competing miner processes and services bound to common mining ports, launch the payload, and establish persistence through a scheduled task named **BrowserUpdate** and a Windows Run key. The intrusion pattern mirrors earlier enterprise-server exploitation seen in incidents such as **WebLogic RCE leading to XMRig**, underscoring how rapidly newly disclosed Java server flaws are weaponized for opportunistic cryptomining.
Aug 26, 2026