Apache Struts2: The HTTP Header That Breached Equifax

How one malformed Content-Type header turned a web framework into a remote shell — and exposed 147 million people.