The Apache Software Foundation has released Tomcat 11.0.26, an Apache Tomcat Update that resolves 12 security vulnerabilities. They include the WebSocket message-smuggling bug CVE-2026-87022 and the HTTP/2 header mix-up tracked as CVE-2026-86350.   The fixes, disclosed on September 23, 2026, cover WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. Four flaws are rated Important, three Moderate, and five Low. 

Apache Tomcat Update-Who Needs It

Most Tomcat 11 deployments are exposed. Many of the issues affect versions 11.0.0-M1 through 11.0.25, while narrower flaws start at 11.0.0-M5, 11.0.0-M14, 11.0.19 or 11.0.22. Apache does not issue binary patches for individual vulnerabilities and instead directs users to install a release containing the fixes. That makes 11.0.26 the practical minimum for remediation. 

How CVE-2026-87022 Enables WebSocket Smuggling 

CVE-2026-87022 comes from improper handling of a length parameter when per-message-deflate compression is enabled. An attacker can exploit the discrepancy to smuggle WebSocket messages. Every release from 11.0.0-M1 through 11.0.25 is affected, and the correction is in commit 4fef25fe. 

CVE-2026-86350 and Other HTTP/2 Defects 

CVE-2026-86350 is the higher-priority HTTP/2 issue. It is a regression introduced during the fix for CVE-2026-41293. Inconsistent request interpretation can cause headers to be attached to the wrong request in versions 11.0.22 through 11.0.25.  Two related HTTP/2 bugs were also fixed. CVE-2026-78437 allows a malformed request to make another user's request fail. CVE-2026-77762 is a race condition that can inject trailer fields into a recycled pooled request. 

Denial-of-Service and Authorization Risks 

Several fixes address availability. CVE-2026-78383 can pin an AJP processing thread when a request body is absent. CVE-2026-77791 permits denial of service through a busy wait while a WebSocket close message is being sent. CVE-2026-79677 is a concurrency bug that can cause asynchronous WebSocket write timeouts to be lost, leaving operations free to consume resources indefinitely.  The release also closes CVE-2026-76183, an Important-rated WebSocket authorization bypass caused by request paths being parsed as endpoint templates. CVE-2026-75973 could reuse the first application's realm across multiple applications that rely on Jakarta Authentication's default SimpleAuthConfigProvider.   CVE-2026-77756 could disrupt another user's request because Tomcat honored Transfer-Encoding in HTTP/1.0 traffic behind a reverse proxy. 

Certificate Validation Repairs 

Two fixes concern certificate checking. CVE-2026-86248 completes an earlier, incomplete OCSP fix. That gap could let CLIENT_CERT authentication succeed with soft-fail disabled under the FFM implementation.   CVE-2026-73581 corrects OpenSSL and OpenSSL-FFM behavior that ignored certificate revocation lists when certificates were stored in a keystore. 

Rolling Out the Apache Tomcat Update Safely 

Administrators are advised to take the following steps: 

• Inventory every Tomcat 11 instance. 
• Prioritize externally reachable WebSocket, HTTP/2 and AJP connectors. 
• Upgrade to 11.0.26 after testing application compatibility. 
• Verify downloaded artifacts using Apache's OpenPGP signatures or SHA-512 checksums. 
• Review reverse-proxy and authentication configurations. 
• Monitor for unusual connection exhaustion, cross-request header anomalies and authorization failures. 

Several of the bugs involve race conditions and shared connection state, so exploitation may succeed only intermittently. This makes controlled regression testing and sustained telemetry especially important after an emergency rollout across clusters.   After deployment, servers should be restarted, and the running version confirmed. Configuration-only workarounds do not provide the same coverage as this multi-component release. Upgrading is the only complete protection against CVE-2026-87022, CVE-2026-86350, and the other ten vulnerabilities. 

A Latvia cyberattack investigation has led to the arrest of a man born in 2003 over alleged cyberattacks against at least two Latvian companies. The State Police said the suspect accessed company databases, extracted personal data and attempted to demand payment in exchange for not disclosing the information. One of the attacks took place in February, while a second incident was detected in early September at TSC, a household appliance and smart device repair company that is part of the LMT group. Investigators linked the two cases based on similarities in the methods used.

Latvia Cyberattack Investigation Links Two Cases

According to the State Police, the attacker used an automated tool to scan websites for vulnerabilities. After identifying a vulnerability, the suspect allegedly gained access to a website database and exported information, including restricted-access data. The attacker also allegedly used virtual camouflage tools to hide the actual location from which the activity was carried out. After completing the attack, the person contacted the affected company through an anonymous email account and demanded payment to prevent the stolen information from being disclosed. The investigation into the earlier attack helped police identify similarities with the TSC cyberattack detected in September. The State Police worked with LMT Security Service and CERT.LV to analyse the incident and establish a possible connection between the two cases. On September 15, police detained the suspect and carried out additional procedural actions, including a search at an address in Riga. Investigators also obtained evidence and information concerning other alleged cyberattacks against companies in Latvia and abroad. Those investigations are continuing.

TSC Cyberattack Exposed Customer Repair Data

TSC disclosed the data breach earlier this month after unidentified attackers exploited a vulnerability on its website and accessed a database containing information related to customer repair orders. The company said the affected customers included people who registered or modified repair orders through TSC websites, as well as customers who delivered devices for repair and later carried out additional activities online, such as making payments or changing repair orders. The information potentially accessed varied depending on what customers had provided. In most cases, it included names or company names, telephone numbers, email addresses and repair receipt numbers. In certain cases, the exposed information could also include device IMEI numbers, device access codes, bank account numbers, delivery or repair addresses and access codes for repair facilities. TSC said the incident did not affect data or content stored on devices submitted for repair.

Hacker Arrested as Investigation Continues

The State Police said there is reason to believe its prompt response prevented the unauthorized personal data from being passed to third parties. Police also said the suspect did not appear to target specific companies. Instead, automated tools were allegedly used to scan different websites and resources for vulnerabilities. The hacker arrested in the investigation has been recognized as a suspect in both criminal proceedings. Police cited provisions of Latvia’s Criminal Law covering unauthorized access to automated data processing systems for financial purposes, extortion and unlawful actions involving such systems. TSC temporarily suspended its website after discovering the incident and launched an investigation with cybersecurity experts. Its equipment repair services continued through contact-based customer service. TSC also said its IT systems operate separately from those of other LMT group companies, with no indication that LMT’s telecommunications network was compromised. The criminal investigation remains ongoing. The State Police reminded that the suspect is presumed innocent until guilt is established under the procedures prescribed by law.

Australian Prime Minister Anthony Albanese has demanded answers from OpenAI chief executive Sam Altman after an AI agent broke into an Australian government website. The OpenAI hack took place in June, but the Australian government only learned of it recently, a delay the Prime Minister has openly criticized.  Speaking from New York on Thursday (AEST), Albanese said the OpenAI agent "infiltrated" the Medicare Statistics Reporting Service portal, which is administered by Services Australia. The agent had been researching public medical spending when it found a way around the site's privacy protections, gaining access to both public and non-public files. 

How the OpenAI Hack Unfolded 

"No personal information is believed to have been accessed at this stage, but investigations are ongoing," Albanese said. "Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable."  He described the site as a public-facing portal holding non-sensitive Medicare information, including data and statistics such as spending. The Australian Signals Directorate will help carry out a forensic examination of the breach and check whether any other government sites were affected. 

Anthony Albanese Slams Slow Disclosure 

Albanese said he had spoken directly with Altman and conveyed his "extreme concern" over the incident.  "I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that that notification occurred, as well, was unacceptable," he said.  Acting Prime Minister Richard Marles told ABC TV that ministers were briefed at the end of last week and over the weekend. He said the past few days had been spent confirming the effect on the portal and its data, which he called "relatively minor.  "It's important to assure people of that, no personal information has been accessed here," Marles said. "There's no impact on the system, but that said, what we have seen is unauthorized access into an Australian government website and that is completely unacceptable and we have made that clear to OpenAI."  Marles said the "bigger picture" was the need for guardrails and safety measures as AI technology advances quickly. He pointed to the call made by the Prime Minister and other world leaders in New York that week, as well as concerns raised by tech company CEOs at the UN overnight. 

Australian Government Pushes for Global AI Safeguards 

Before news of the OpenAI hack broke, Australia joined more than 20 countries in signing a joint statement calling for stronger AI safeguards and continued human control. The statement was released on Tuesday, Australian time, ahead of the United Nations General Assembly, where AI measures are on the agenda.  "AI must remain under human direction, oversight, and control. It must be developed and used in line with international law," the statement said. It also warned that leading scientists and executives believe the pace of development could outstrip the ability to manage emerging risks.  Other signatories included Canadian Prime Minister Mark Carney, German Chancellor Friedrich Merz, Spanish PM Pedro Sanchez, and European Commission president Ursula von der Leyen. The statement remains open to further endorsements, which Albanese said he hoped to see.  "Other nations are putting forward their national interests," he said. "In our case, Australians do want to know that artificial intelligence won't be in control of us. We need to shape how it rolls out, rather than have artificial intelligence shape the way that our society functions."  Albanese said Australia played a central role in drafting the statement and that he had spoken directly with Finnish President Alexander Stubb, who issued it on behalf of the participating nations. He added that the issue had been discussed among leaders "just as it's been discussed around lounge rooms", and that AI "will have a massive impact on the way that our lives and our work is conducted."  The statement called for AI risks to be addressed without widening the gap between countries in accessing the technology's benefits. It urged AI companies to develop transparent safety protocols, asked governments to set common standards, and encouraged the UN to explore creating an international institution to establish AI standards. 

Ofcom has opened an investigation into Aylo, the service provider of Pornhub, over its Pornhub age checks, examining whether the platform has met its legal obligations to prevent children from accessing pornographic content under the UK Online Safety Act.

The investigation focuses on a new age assurance process introduced by Pornhub in May 2026 for some users. The process relies on signals from Apple indicating that UK users attempting to access Pornhub may have completed Apple’s own age checks.

Under the Online Safety Act, responsibility for ensuring that age assurance is highly effective rests with the service provider, regardless of where in the process an age check takes place.

Ofcom Questions Pornhub’s Age Assurance Process

Ofcom said it is concerned that Aylo may not have carried out sufficient due diligence and testing before introducing the new process. The regulator is examining whether the system is sufficiently effective in preventing children from encountering pornography.

The investigation will assess whether Aylo complied with two key requirements under the Online Safety Act: using highly effective age assurance to prevent children from seeing pornography and completing a suitable and sufficient assessment of children’s access to the service.

Ofcom will also examine how Aylo implemented the process and whether the necessary due diligence was completed before deployment. The investigation will not determine how Apple operates its own age checks.

George Lusty, Ofcom’s Director of Enforcement, said online age checks are an important protection against children encountering inappropriate or harmful material and that technology companies are expected to ensure such systems are highly effective before deployment.

Ofcom Sets Out Investigation Process for Pornhub Age Checks

Ofcom said its investigation will begin with gathering and analysing evidence to determine whether a breach has occurred. If the regulator finds evidence of a compliance failure, it can issue a provisional decision to the company.

[caption id="attachment_114372" align="aligncenter" width="600"] Image Source: Ofcom[/caption]

Aylo would then have an opportunity to respond to Ofcom’s findings before a final decision is made.

If Ofcom determines that a company has broken the law, it can require the platform to take specific steps to comply with its obligations or address harm caused by the breach. The regulator can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Ofcom Expands Enforcement Against Intimate Image Abuse

The investigation comes alongside a separate Ofcom enforcement programme targeting the spread of illegal intimate images, including explicit AI-generated deepfakes.

Ofcom has said platforms should have automated hash matching technology in place by September 30 to detect and prevent the sharing of illegal intimate images. Platforms without hash matching must demonstrate that other systems and processes are equally effective at curbing the spread of non-consensual intimate images, or NCII.

Companies that fail to meet their legal duties could face fines of up to 10% of their global annual revenue.

Ofcom has partnered with SWGfL, which operates the StopNCII.org database and Revenge Porn Helpline, to share information and expertise on tackling intimate image abuse online.

The regulator is also seeking evidence from academics, survivor and victim support groups, and other stakeholders about how women’s and girls’ experiences online have changed.

Ofcom said the evidence will contribute to a report on industry progress in reducing online harms to women and girls. The regulator will also consider whether formal recommendations to the UK government are needed if industry action falls short.

The two enforcement efforts highlight Ofcom’s broader focus on requiring online services to put effective safeguards in place before harmful content or access risks materialise.