https://locodigital.com.br/en/tags/apache-struts/Recent content in Apache Struts on LocodigitalHugoen-USSat, 29 Aug 2026 09:00:00 -0300https://locodigital.com.br/en/technology/equifax-breach-2017-unpatched-apache-struts/Sat, 29 Aug 2026 09:00:00 -0300https://locodigital.com.br/en/technology/equifax-breach-2017-unpatched-apache-struts/<p>On July 29, 2017, an Equifax security analyst noticed suspicious traffic leaving the network. What the investigation revealed over the following hours was alarming: hackers had been inside the company's systems for <strong>76 days</strong>, quietly sweeping databases holding personal information on half of the adult population of the United States. The way in? A patch that had been available for months and simply was never applied.</p> <h2>A known vulnerability, ignored for months</h2> <p>On March 7, 2017, the Apache Software Foundation publicly disclosed <strong>CVE-2017-5638</strong>, a critical flaw in the Apache Struts framework that allows unauthenticated remote code execution. The patch was released the same day. Two days later, on March 9, Equifax's security team sent an internal notice instructing teams to apply the fix urgently.</p>