Apache Wicket EUVD-2026-27651

Upgrade to patched versions: Apache Wicket 8.18.0 or later for the 8.x branch, 9.23.0 or later for 9.x, and 10.9.0 or later for 10.x (inferred from affected version ranges-exact fix versions should be confirmed from Apache advisory at https://lists.apache.org/thread/6zqcvjyz4lsqty1z2g5hg7pl5fqk88rs). Until patching, implement defense-in-depth controls: require authentication for all application endpoints serving package resources, restrict network access to Wicket applications to trusted IP ranges using firewall rules or reverse proxy ACLs (reduces attack surface but blocks legitimate remote users), and audit PackageResourceGuard configuration to ensure restrictive accept patterns that explicitly whitelist only necessary resource types rather than relying on default deny patterns. For applications serving sensitive configuration files or proprietary code via package resources, move these assets outside the package resource mechanism entirely to filesystem locations with separate access controls. Review application logs for suspicious resource access patterns with URL encoding or path traversal sequences in the May-June 2026 timeframe to detect potential exploitation attempts.