Category: Middleware Optimization
Blog
CVE-2025-54539 & CVE-2025-29953: Apache ActiveMQ® .NET Client RCE
Most Apache ActiveMQ® security advice is about the broker. CVE-2025-54539 and CVE-2025-29953 turn that around: the broker attacks the application. A broker that has been compromised, impersonated or simply isn't yours can send a crafted message to an Apache ActiveMQ® .NET client, and the client runs the attacker's code while reading it.
Blog
The Jolokia Problem: Eight CVEs, One Door in Apache ActiveMQ®
The Apache ActiveMQ® Jolokia endpoint has been the route to remote code execution in three separate years. In 2023, it was reflection into the JVM. In 2024, a default configuration left it without a login. In 2026, it was the broker's own management operations, patched in March, exploited in April, and reopened three more times by summer.
Blog
10 Questions to Ask an Apache ActiveMQ® Support Vendor
Deciding to buy open source support for Apache ActiveMQ® is the easy part. Working out which vendor can actually keep a broker alive at three in the morning is considerably harder, because nearly every vendor in this market is vague in exactly the same places.
Blog
Apache ActiveMQ® CVE-2023-46604: DripDropper Exploit Explained
When a CVSS 10.0 vulnerability is published, the expectation is that affected software gets patched within days. When it involves an open-source broker that processes business-critical transactions in enterprise environments, the expectation is that the security teams responsible for those brokers treat it as an emergency. “The attacks exploit a maximum-severity security flaw in Apache
Blog
Apache ActiveMQ® CVE Guide: Complete Vulnerability Reference
This Apache ActiveMQ® CVE guide is the maintained reference for every significant Apache ActiveMQ® vulnerability: what it does, how it is scored, which versions it affects, which release fixes it, and whether it is being exploited.
Blog
Why Most Enterprise AI Agent Programs Overspend, and What Actually Fixes It
Enterprise AI agent programs overspend because leaders optimize token costs, which represent just 20-25% of variable run costs. Human oversight accounts for 70-75%. The real fix is reducing exception rates and embedding governance directly into agent execution from the start.