Apache OFBiz fixes flaws enabling remote code execution and takeover

Apache OFBiz developers addressed a batch of high‑risk flaws that allowed unauthenticated remote code execution and potential full admin account takeover. The Openwall OS security thread notes 46 security flaws in the project, including CVE-2026-68524 (pre‑authentication RCE) and CVE-2026-109928 (admin account takeover due to a faulty authentication implementation).

Patches are in Apache OFBiz 24.09.08, with maintainers emphasising that unauthenticated RCE and account takeover were among the critical issues corrected. The report attributes the disclosure to the OSS‑security mailing list and the OFBiz maintainers.

In a separate item, DreamHost warned that an unauthorized third party gained access to the server hosting its File Manager for a period between August and 23 October 2026, exploiting a vulnerability in that software. The breach exposed FTP/SFTP usernames and passwords of users who logged in to the File Manager, and potentially some webmail session data, though DreamHost said there was no evidence that control panel logins or customer billing details were accessed.

The California Attorney General’s office published a data‑security notice detailing the incident and confirming the attacker accessed credentials and certain emails and files, while stating the breach did not affect the company’s certificate operations. The notice attributes the breach to a deliberate attack and notes containment work by DreamHost’s team.