Loading story…
Hewlett-Packard released security bulletins HPSBUX03102 and HPSBUX03150 for multiple vulnerabilities in the HP-UX Apache Web Server Suite, affecting bundled Apache HTTP Server, Tomcat Servlet Engine, and PHP components. Impacted systems could be vulnerable to remote code execution, denial of service, HTTP request smuggling, access-control bypass, man-in-the-middle attacks, and unauthorized file or data access; the most severe cited issue, PHP CVE-2014-3515, carries a CVSS v2 score of 7.5 and permits remote arbitrary code execution.
For HP-UX B.11.31, HP advised upgrading Web Server Suite to version 4.02 or later, including Apache 2.2.15.20, Tomcat 6.0.39.02, and PHP 5.4.11.04. For HP-UX B.11.23 systems using Web Server Suite 3.29 or earlier, Tomcat 5.5.36.01 or earlier, or PHP 5.2.17.03 or earlier, HP recommended Web Server Suite 3.30 or later, with Apache 2.2.15.21, Tomcat 5.5.36.02, and PHP 5.2.17.04.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Hewlett-Packard published security bulletin HPSBUX03150 (SSRT101681 rev.1) for vulnerabilities affecting HP-UX B.11.23 Apache Web Server Suite, Tomcat, and PHP components. HP recommended upgrading to HP-UX Web Server Suite v3.30 or later to address denial-of-service, request-smuggling, man-in-the-middle, and data-modification risks.
HP released security bulletin HPSBUX03102 (SSRT101681 rev.1) for vulnerabilities in the HP-UX Apache Web Server Suite, Tomcat, and PHP on HP-UX B.11.31. It directed affected customers to upgrade to Web Server Suite v4.02 or later, addressing issues including remote code execution, denial of service, request smuggling, and file access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
marc.info
Open sourcemarc.info
Open sourcesoftware.hp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HP released security bulletin **HPSBUX03337** (`SSRT102066 rev.1`) for HP-UX B.11.31 systems running the HP-UX Apache Web Server Suite, Apache Web Server, Tomcat Servlet Engine, or PHP. The 14 addressed CVEs could enable remote denial of service, man-in-the-middle attacks, remote data modification, and local data modification, with CVSS v2 base scores ranging from 4.3 to 7.5. HP directed customers to upgrade to **HP-UX Web Server Suite v4.05 or later**, which updates the bundled Apache, Tomcat, and PHP components to remediated versions. One tracked issue, `CVE-2013-5704`, affects Apache HTTP Server 2.2.22's `mod_headers` module and allows remote attackers to bypass configured `RequestHeader unset` rules by supplying headers in chunked-request trailer fields; Apache stated that this behavior was not a security issue in httpd itself, although downstream vendors issued advisories for affected distributions.
Aug 29, 2026
HP released bulletin **HPSBMA02535** (`SSRT100029 rev.1`) to remediate nine vulnerabilities in HP Performance Manager versions 8.10, 8.20, and 8.21 for HP-UX, Linux, Solaris, and Windows. The flaws could enable remote unauthorized access, cross-site scripting, and denial-of-service conditions; **CVE-2009-3548** was rated highest, with a CVSS v2 base score of 7.5 and potential impact to confidentiality, integrity, and availability. HP issued platform-specific updates: `HPPM8CPI_00001` for HP-UX IA, `HPPM8CPP_00001` for HP-UX PA, `HPPM8CPL_00001` for Linux, `HPPM8CPS_00001` for Solaris, and `HPPM8CPW_00001` for Windows. Related Apache Tomcat advisories also addressed **CVE-2009-0580**, a FORM-authentication user-enumeration flaw in Tomcat 4.1.x, 5.5.x, and 6.0.x that lets remote attackers identify valid usernames through malformed URL-encoded password input to `/j_security_check`.
Aug 29, 2026
Red Hat released **RHSA-2016:0062** for JBoss Web Server 2.1.0 to address `CVE-2015-3183`, `CVE-2013-5704`, and `CVE-2012-0876`. In particular, `CVE-2013-5704` lets an unauthenticated remote client add HTTP Trailer headers to chunked requests after other modules have processed headers, potentially bypassing restrictions enforced with `mod_headers`. The update also addresses HTTP request-smuggling risk and an Expat XML parsing flaw that could enable CPU-exhaustion denial of service; affected users were advised to apply the update and restart the service. HP also issued **HPSBUX03512 (SSRT102254)** for HP-UX Web Server Suite running Apache, citing remote denial of service, access-control bypass, unauthorized modification, information disclosure, and SSL/TLS weaknesses including Logjam and Bar Mitzvah. HP identified Web Server Suite 2.2.15.21 Apache on HP-UX 11i v2 as affected and directed administrators to install updated packages, including Apache `B.2.2.15.18` or later and, where applicable, Tomcat `C.6.0.35.01` or later.
Aug 29, 2026