News

September 9, 2021

Teacher Spotlight: Tim McAllister

Teacher: Tim McAllister

County: Clay

Meet Tim McAllister! Tim is a top cybersecurity teacher in Clay County, Florida. Now entering his third year of teaching, Tim’s journey began at SUNY Maritime College in the Bronx, NY, where he honed his skills aboard various vessels, including tugboats, oil tankers, and dredges. Early on, he recognized how technology and the internet transformed navigation, administration, and record-keeping.

During his deployments around the world with the U.S. Navy, cybersecurity emerged as a mission-critical priority. This knowledge inspired him to establish a cyber team within his Navy JROTC unit at the school where he now teaches, leading them to compete in CyberPatriot for the first time this year.

Tim is excited to integrate Cyber Florida’s offerings into his classroom, helping students explore the vast capabilities, advantages, and vulnerabilities of cyberspace—and sparking their interest in pursuing dynamic careers in the cyber field.

Thanks for all you do, Tim!

Would you like to be featured in our Teacher Spotlight? To nominate yourself or another deserving teacher, complete the interest form below!

Teacher Spotlight: Tim McAllister2025-05-21T15:50:06-04:00

Cyber Florida Partners with Idaho National Laboratory

General McKenzie and Zach Tudor

Strategic partnership between Idaho National Laboratory and Cyber Florida bolsters cybersecurity, nurtures talent

May 20, 2025—Tampa, Fla—The Center for Cybersecurity at the University of South Florida, commonly known as Cyber Florida, and the Idaho National Laboratory (INL) have agreed to collaborate on critical infrastructure cyber mitigation and workforce development.

INL and Cyber Florida signed a memorandum of understanding to formalize the collaboration late last month.

One of INL’s primary focus areas is securing the nation’s critical infrastructure, while Cyber Florida positions Florida as a national leader in cybersecurity through education, research and outreach.

This agreement allows the state to use INL’s world-class critical infrastructure resiliency and cybersecurity capabilities focused on enhancing local, state and national preparedness in alignment with the Trump administration’s executive order titled, “Achieving Efficiency Through State and Local Preparedness.” The collaboration will focus on cybersecurity risk mitigation, operational technology and industrial control systems, defense industrial base sector cyber risk, workforce development and more.

“Cyber Florida is committed to fostering innovation and developing the next generation of cybersecurity professionals,” said retired Marine Corps Gen. Frank McKenzie, executive director of Cyber Florida. “This partnership with the Idaho National Laboratory underscores our shared dedication to strengthening our nation’s critical infrastructure and advancing the workforce needed to meet emerging cyber threats. Together, we are preparing for the future of cybersecurity in both the public and private sectors.”

INL and the state of Florida have previously collaborated to enhance cybersecurity for critical infrastructure sectors such as energy and transportation. In 2023, Cyber Florida and INL implemented the Critical Infrastructure Risk Assessment, leveraging the Department of Homeland Security’s Cyber Security Evaluation Tool, developed by INL, to analyze the cyber readiness of Florida’s 16 critical infrastructure sectors. The study, conducted on behalf of the Florida Legislature, offered recommendations to improve risk-based decision-making, inform state-level policy and support funding. The same year, INL signed a separate agreement with the state of Florida’s Department of Management Services alongside Florida Lt. Gov. Jeanette Nuñez.

“As states increasingly take on the responsibility of protecting both physical and cyber infrastructure, INL is poised to support local risk-informed decision-making across the country,” said Zach Tudor, associate laboratory director for National and Homeland Security at INL. “Florida’s critical infrastructure network is vast and expansive, and our collaboration aims to enhance its resilience and security ensuring the state’s critical functions remain dependable.”

About Idaho National Laboratory
Battelle Energy Alliance manages INL for the U.S. Department of Energy’s Office of Nuclear Energy. INL is the nation’s center for nuclear energy research and development, and also performs research in each of DOE’s strategic goal areas: energy, national security, science and the environment. For more information, visit www.inl.gov. Follow us on social media: FacebookInstagramLinkedIn and X.

About Cyber Florida at USF
The Florida Center for Cybersecurity at the University of South Florida, commonly referred to as Cyber Florida at USF, was established by the Florida Legislature in 2014. Its mission is to position Florida as a national leader in cybersecurity through comprehensive education, cutting-edge research, and extensive outreach. Cyber Florida leads various initiatives to inspire and educate current and future cybersecurity professionals, advance applied research, and enhance cybersecurity awareness and safety of individuals and organizations.

Media Contacts
Jennifer Kleman, 863-398-5610, [email protected]
Lisa Wilmore, 616-540-8348, [email protected]

Cyber Florida Partners with Idaho National Laboratory2025-05-21T08:23:45-04:00

Cyber Florida Partners with CyberUSA

Cyber Florida at USF Partners with CyberUSA, Strengthening National Cybersecurity Collaboration

May 20, 2025—Tampa, Fla—Cyber Florida at USF has partnered with CyberUSA, marking a significant step toward enhancing national cybersecurity coordination and resilience. This partnership will focus on information sharing, workforce development, and critical infrastructure protection.

Cyber Florida at USF, established by the Florida Legislature and housed at the University of South Florida’s Tampa campus, is dedicated to positioning Florida as a national leader in cybersecurity through comprehensive education, cutting-edge research, and extensive outreach. The organization works across public and private sectors to lead workforce development programs, advance applied research, and conduct outreach to enhance cyber safety and resiliency throughout the state.

“CyberUSA is thrilled to partner with Cyber Florida,” said Adam Rak, executive director of CyberUSA. “Their leadership in cybersecurity education and innovation will greatly enhance our collective efforts to strengthen the nation’s cyber defenses.”

James Jacobs, director of partnerships & policy at Cyber Florida, emphasized the significance of the collaboration: “Partnering with CyberUSA enables us to collaborate across the country in efforts to enhance cybersecurity. We are excited to share our expertise with CyberUSA.”

Ernie Ferraresso, senior director of Cyber Florida, emphasized the strategic importance of the partnership. “In our interconnected world, cybersecurity is a shared responsibility. Our partnership with CyberUSA underscores our commitment to collaborative solutions that protect our state and nation’s digital infrastructure.”

About Cyber Florida at USF
The Florida Center for Cybersecurity at the University of South Florida, commonly referred to as Cyber Florida at USF, was established by the Florida Legislature in 2014. Its mission is to position Florida as a national leader in cybersecurity through comprehensive education, cutting-edge research, and extensive outreach. Cyber Florida leads various initiatives to inspire and educate current and future cybersecurity professionals, advance applied research, and enhance cybersecurity awareness and safety of individuals and organizations.

For more information about Cyber Florida, visit https://cyberflorida.org/

About CyberUSA
CyberUSA is a trusted forum where American organizations can collaborate on solutions to protect us all. By transcending local, state, and national security silos, we ensure that leaders and practitioners have the best possible resources to safeguard their assets.

CyberUSA membership amplifies cyber defense effectiveness through a community of communities that scales and accelerates information sharing to an unprecedented level. Membership provides access to reliable resources available nowhere else, including a national threat-sharing platform. The organization is dedicated to proactive coordination of public and private efforts to shape the education, innovation, and policy landscapes at the regional and federal levels.

For more information about CyberUSA, visit https://www.cyberusa.us/

Media Contacts

Cyber Florida: Cyber Outreach Manager Jennifer Kleman, APR, CPRC [email protected]

CyberUSA: ‍CyberUSA Public Relations Jennifer Priest [email protected]

Cyber Florida Partners with CyberUSA2025-05-21T08:24:04-04:00

Apache Tomcat RCE Vulnerability (CVE-2025-24813)

I. Targeted Entities

Systems and applications using Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98.

II. Introduction

CVE-2025-24813 describes a vulnerability in Apache Tomcat which would allow a malicious actor to perform a variety of attacks such as remote code execution, information disclosure, and injecting malicious payloads or content into uploaded files. This type of vulnerability is caused by improper handling of path equivalence, which normally ensures that different file paths point to the same resource. This improper handling within the Default Servlet is related to write-enabled configurations in Apache Tomcat and it impacts several versions of the application prior to the fix.

III. Additional Background Information

CVE-2025-24813 is a vulnerability affecting Apache Tomcat that can occur when the default servlet is configured to allow write functionality which is normally disabled by default. This vulnerability can be exploited when combined with the default behavior of allowing for partial PUT requests. In this scenario, an attacker could upload a specially crafted serialized session file, or simply, a malicious payload, to a writable directory within the system. Once the file is uploaded, a subsequent HTTP request triggers Tomcat to deserialize the file’s contents, executing the embedded malicious payload.

While exploiting CVE-2025-24813 can lead to significant impact, successful remote code execution requires several prerequisites:

  1. Write Capability on the Default Servlet: The default servlet has to be explicitly configured to allow write functionality, which is not normally enabled by default.
  2. Partial PUT Requests: The target system must allow for partial PUT requests.
  3. File-Based Session Persistence: The web application has to use file-based session persistence with a default storage location, providing an accessible and writable directory for uploading malicious payloads.
  4. Deserialization Vulnerability: The application must have a deserialization-vulnerable library which would enable the malicious payload to be executed during the deserialization process.
  5. Knowledge of Internal File System: The attacker needs to understand the file naming conventions and directory structure of the target system for successful exploitation of the vulnerability.

IV. MITRE ATT&CK

  • T1006 – File System Logical Link
    T1006 or File System Logical Link refers to when adversaries have the ability to create symbolic links or shortcuts to files in order to abuse the way some operating systems handle file paths.This is relevant since CVE-2025-24813 involves manipulating file paths to access and modify unintended files, fitting the pattern of abusing file system logical links.

V. Recommendations

To mitigate attacks leveraging this vulnerability, these are the recommendations for CVE-2025-24813:

Upgrading Apache Tomcat to a Patched Version

By immediately upgrading to:

  • Tomcat 0.99 (for 9.x series)
  • Tomcat 1.35 (for 10.x series)
  • Tomcat 0.3 (for 11.x series)

It provides a fix for the improper handling of partial PUT requests and path equivalency issues that could be exploited for remote code execution or file manipulation.

Disabling Partial PUT Support

Configure Tomcat to disallow partial PUT requests, which allow clients to send file content in chunks or ranges. Recommended actions include:

  • Modifying Tomcat’s configuration files (server.xml and/or web.xml) to block or ignore PUT methods if your application doesn’t use them.
  • Implementing an HTTP filter to reject incoming PUT requests altogether (unless those requests are required for your needs)

Since this vulnerability exploits partial PUT behavior to inject content into files. If partial PUT is not supported, this attack vector is closed.

Restricting Default Servlet Write Permissions

Ensure that the default servlet (the part of Tomcat that serves static files) cannot accept uploads or write to sensitive directories. To do so, you must:

  • Tighten file system permissions (chmod, chown) to ensure Tomcat processes run with minimal privileges.
  • Ensure the /webapps directory and static content directories are read-only unless absolutely necessary.
  • Review DefaultServlet configuration for <init-param> like readonly and set it to true.

If the default servlet has write permissions, attackers could upload or modify arbitrary files which could lead to defacement, data theft, or execution of malicious scripts.

Enforcing Strong Web Application Firewall (WAF) Policies

You should deploy or tune your WAF to:

  • Detect and block unusual PUT, PATCH, or malformed HTTP methods.
  • Flag requests targeting .jsp, .war, or sensitive file types.

Having a WAF can act as an additional protective layer by stopping attacks even if Tomcat is not yet patched or misconfigured.

Monitoring Server Logs Aggressively

Continuously monitor access logs (e.g., access_log, catalina.out) and security logs for:

  • Unexpected PUT or PATCH requests.
  • External requests targeting .jsp files in unusual locations.

Early detection of attempts allows you to respond quickly to intrusions before they escalate. Using tools such as Splunk, ELK stack, or Wazuh can make for efficient log review and analysis, with trigger alerts on anomalies.

VI. IOCs (Indicators of Compromise)

Type Indicator
File System Anomalies Presence of unexpected .jsp files in the web server root directory
Suspicious HTTP Requests External POST or GET requests targeting suspicious .jsp files
Suspicious HTTP Methods Occurrence of unexpected PUT requests in web server logs
Malicious Upload Attempts Evidence of malicious payloads being delivered via PUT requests
WAF Detection Triggered Web Application Firewall (WAF) rules indicating attempts to upload or execute unauthorized files

Figure 1: Table of IOCs

Figure 2: File paths of attack payloads (using .session extensions)

Figure 3: Payload in the request body, attempting to call the .session file (Akamai)

VII. Additional OSINT Information

Figure 1: Exposed Tomcat instances on Shodan showing being geolocated in China, Brazil, Morroco, and the U.S (Recorded Future

Figure 2: Proof of Concept for exploiting CVE-2025-24813 (GitHub – absholi7ly)

Figure 3: Signature for CVE-2025-24813 (Recorded Future)

VIII. References

Absholi7ly. (2025, March 22). POC-CVE-2025-24813: Proof of concept for CVE-2025-24813 in Apache Tomcat [Source code]. GitHub. https://github.com/absholi7ly/POC-CVE-2025-24813

Apache Software Foundation. (2025, March 10). CVE-2025-24813 Detail. National Vulnerability Database. https://nvd.nist.gov/vuln/detail/CVE-2025-24813

Detecting and mitigating Apache Tomcat CVE-2025-24813 | Akamai. Akamai Security Intelligence Group. (2025, March 25). https://www.akamai.com/blog/security-research/march-apache-tomcat-path-equivalence-traffic-detections-mitigations

Group, I. (2025, March 28). Apache tomcat: CVE-2025-24813: Active exploitation. Recorded Future. https://www.recordedfuture.com/blog/apache-tomcat-cve-2025-24813-vulnerability-analysis

[SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT. Lists.apache.org. (2025, March 10). https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq

Threat Advisory created by The Cyber Florida Security Operations Center.

Contributing Security Analysts: Jason Doan

To learn more about Cyber Florida visit: www.cyberflorida.org

Apache Tomcat RCE Vulnerability (CVE-2025-24813)2025-05-13T14:58:12-04:00

No Password Required Podcast Episode 59 — Mariana Padilla

No Password Required Podcast Episode 59 — Mariana Padilla

No Password Required Podcast Episode 59 — Mariana Padilla2025-05-09T10:45:48-04:00

USF Muma College of Business Offering In-Person Cybersecurity Training

Now Available In-Person: Cybersecurity Awareness Certificate Training for Florida State and Local Government Employees

This in-person option offered by the USF Muma College of Business meets the Cybersecurity Awareness Training requirement outlined in the Florida Digital Service’s Local Government Cybersecurity Resource Packet, and it brings the learning experience directly to your team.

Rather than completing the training online at your own pace, your organization can now engage USF instructors for on-site, instructor-led sessions. This format allows your entire workforce to receive the same curriculum at once, fostering a shared understanding of cybersecurity best practices and creating space for real-time questions and discussion.

Topics covered in the course include:

  • Phishing and common email scams
  • Password security and safe online behavior
  • Ransomware, scareware, viruses, and malware
  • Social engineering tactics
  • Best practices to protect sensitive information

This course empowers state and local government employees to recognize and respond to cyber threats—helping them serve as the first line of defense against cyberattacks.

In-person training is available to eligible Florida state and local government organizations.

Register

USF Muma College of Business Offering In-Person Cybersecurity Training2025-05-05T12:50:52-04:00

Teacher Spotlight: Dan Trembley

Teacher: Dan Trembley

School: Dunbar High School

County: Lee

Introducing Dan Trembley, a true educational trailblazer in Lee County! Since 2005, Dan has been a founding force behind the Academy for Technology Excellence at Dunbar High School, instrumental in shaping the future of information and cybersecurity professionals. His visionary approach empowers students to earn prestigious professional credentials before graduating high school. Beyond the standard Microsoft Office and Adobe Creative Suite certifications, Dan’s protégés have achieved impressive credentials from top industry leaders such as Certiport, Cisco, CompTIA, IBM, and Microsoft.

As a distinguished National Cybersecurity Teaching Academy graduate, Dan holds a Graduate Certificate in Cybersecurity from the esteemed JB Speed School of Engineering at the University of Louisville. His expertise and dedication have earned h   im accolades from renowned organizations like the Texas Computer Educators Association, Microsoft EduCon, and the International Society for Technology in Education. Dan’s commitment to excellence has also made him a 2025 Cyber.org Educator of the Year finalist. We are immensely proud of Dan’s invaluable contributions to cybersecurity education and his profound impact on students across Florida!

Would you like to be featured in our Teacher Spotlight? To nominate yourself or another deserving teacher, complete the interest form below!

Teacher Spotlight: Dan Trembley2025-04-15T10:19:50-04:00

No Password Required Podcast Episode 58 — Trevor Hilligoss

No Password Required Podcast Episode 58 — Trevor Hilligoss

No Password Required Podcast Episode 58 — Trevor Hilligoss2025-04-14T07:26:05-04:00

CyberLaunch 2025

CyberLaunch Logo 2025

Florida’s Largest High School Cyber Competition Breaks Records, Inspires Futures

Nearly 1,000 high school students, teachers, and chaperones from across the state descended on the Caribe Royale Resort in Orlando on April 4 for Cyber Florida’s annual CyberLaunch, the nation’s largest in-person, state-sponsored high school cybersecurity competition. And the excitement on the competition floor? Unmatched!

Hosted by Cyber Florida, CyberLaunch 2025 brought together students from 99 schools across 49 districts, including Florida’s five largest school districts and its smallest—LaFayette. In just its second year, CyberLaunch has grown into a premier showcase of talent and opportunity, offering a platform for students to shine and discover future careers in cybersecurity.

I would like to take this opportunity and thank all of Cyber Florida for putting this together.
It really is a wonderful opportunity and platform for the cybersecurity students of Florida to shine.

— Maria Halley Hernandez, John A. Ferguson Senior High School
The Ultimate Cyber Kickstart

Designed to familiarize high school students with the exciting world of cybersecurity, CyberLaunch featured a hands-on capture-the-flag (CTF) style challenge, inspiring keynotes, breakout sessions for educators, and opportunities for students to interact with industry professionals to gain insights into cybersecurity careers.

This year’s event also welcomed 18 career and technical education administrators from 12 school districts, highlighting growing support from school systems eager to expand cybersecurity learning in classrooms.

CyberLaunch 2025 wasn’t just about what happened in one day—it was the culmination of weeks of preparation. Participating teachers and students received access to a library of practice materials and classroom-ready activities that helped demystify cybersecurity concepts and build skills leading up to the big day.

Thank you for an amazing event. My students smiled the entire way home.
We plan on starting an IT Club next Sept.

– Capt. Tim McAllister, Orange Park High School
A Mission in Motion

CyberLaunch is more than a one-day event—it’s a key part of Cyber Florida’s mission to cultivate a robust cybersecurity workforce and create opportunities for every Florida student. Thanks to support from the Florida Legislature and private donors, Cyber Florida ensured that access to this event was obtainable by making the event free to all students and schools.

And the outcomes speak for themselves: students walked away energized, curious, and, in many cases, ready to learn more about the field, and start IT/cybersecurity clubs if they didn’t have one in place already. Teachers gained tools to help bring cybersecurity into their classrooms. And Florida took another big step forward in building digital resilience from the ground up.

And the Winners Are…

After an intense day of solving puzzles, cracking codes, and working as a team under pressure, a few schools rose to the top. We’re proud to announce the winning teams of CyberLaunch 2025:

Advanced level
1st Place: John A. Ferguson Sr High, Miami-Dade
Teacher: Maria Halley Hernandez
Students: Michael Lopez, Sabrina Chile, Rachel Diaz

2nd Place: 2: East River/Boone High Schools, Orange
Teacher: James Mitchell
Students: Zane Strait (Boone), Brady Graham (Boone), Jamal Santiago (Boone), Bi Trinh (East River)

3rd Place: John A. Ferguson Sr High, Miami-Dade
Teacher: Maria Halley Hernandez
Students: Fabio Martin, Gabriel Barreto Otero, Dominic Hung, Angelo Isasi

Intermediate level
1st Place:
Hialeah Gardens, Miami-Dade
Teacher: Rein De Armas
Students: Daniel D. Alvarez, Jean M. Hernandez, Luis E. Lovera

2nd Place: Crooms Academy of Information Technology, Seminole
Teacher: Halima Fisher
Students: Mikhail Tyukin, Anish Miryala, Alyssa Durand, Zane DeReamer

3rd Place: Suncoast Polytechnical High School, Sarasota
Teacher: Stephen McCormack, Lucinda Schlotterback
Students: Lucas Mattos, Maria Kadochnikova, Ben Kuzmik, Szymon Stead-Topor

Beginner level
1st Place: Angeline Academy of Innovation, Pasco
Teacher: Michael Marchesano
Students: Chris Workentin, Logan Prescott, Malakai Jefferson, Christopher Devoe

2nd Place: Timber Creek High School, Orange
Teacher: Daniel Foster
Students: Eoghan Riley, Tomas Lopez Devia, Matthew Nguyen

3rd Place: iPrep Academy North, Miami-Dade
Teacher: Yoel Monzote
Students: Raiya Cohen, Brianna Louissaint, Ariadna Monzon

These standout students demonstrated critical thinking, collaboration, and technical excellence under pressure—and we can’t wait to see where their cyber journeys take them next.

We are so grateful for all the time, energy, and care you put into making this event such a meaningful experience for the students.
It was truly impressive, and very much appreciated.

– Christine Ackerman, Middleburg High School
Looking Ahead

CyberLaunch will return with even more opportunities, more resources, and more students ready to make their mark. Whether you’re a teacher looking to bring cybersecurity into your classroom or a student curious about coding, hacking, and solving digital problems, Cyber Florida’s Operation K12  is your starting point.

To stay informed about next year’s competition, resources, and updates, follow Cyber Florida on social media and visit cyberflorida.org.

A HUGE thank you to our generous and amazing sponsors for supporting this important event!

Universe Sponsor
USF Youth Experience
Orbit Sponsors
AFCEA Central Florida chapter
Bluum
Certification Partners
CompTIA
HP
Prodigy Learning
Teaching Digital Natives
Liftoff Sponsors
EC-Council
Knowledge Pillars
Launchpad Sponsors
Certiport
Dark Enterprise Inc
Guardian Cyber
Marcraft
Siemens
UTeach UTexas
Starbase Supporters
Crespo AI
EDVision
Jamal Rodman
USF World
Zscaler Inc

CyberLaunch 20252025-04-11T14:50:59-04:00