Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

As the clock ticks closer to 2025, we’re all trying to brainstorm goals and resolutions for the new year. But unlike the annual pledge to exercise more and eat fewer sweets around the holidays (whoops), application security is one area where nobody can afford to slip up. Let’s skip the procrastination phase and hit the ground running with some practical New Year’s resolutions that will help you step up your AppSec game.

CVE-2024-3393 is a high severity (CVSS v4.0 score 8.7) Denial of Service (DoS) vulnerability affecting specific versions of Palo Alto Networks PAN-OS DNS Security feature. This vulnerability allows unauthenticated attackers to send malicious packets through the data plane of the firewall. This forces the firewall to reboot. Repeated attempts can force the firewall into maintenance mode, requiring security teams to manually reset the firewall and significantly disrupting operations.

A newly discovered critical vulnerability, CVE-2024-53677, in Apache Struts enables remote code execution (RCE) and is actively exploited in the wild using a publicly available Proof-of-Concept (PoC). Apache Struts is an open-source framework for building Java-based web applications. It helps developers create scalable software solutions, that powers everything from e-commerce websites to financial systems and government platforms.

In 2024, several significant vulnerabilities were identified within the Kubernetes and broader cloud-native ecosystem. In this post we have compiled a roundup of the most notable Common Vulnerabilities and Exposures (CVEs) reported this year.