Apache administrators are urged to immediately upgrade the Struts 2 web application framework to address a remote code execution flaw under public attack.