Tag: api
-
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk
by
in SecurityNewsDespite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
-
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk
by
in SecurityNewsDespite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
-
New Python-Based Discord RAT Targets Users to Steal Login Credentials
by
in SecurityNewsA recently identified Remote Access Trojan (RAT) has raised alarms within the cybersecurity community due to its innovative use of Discord’s API as a Command and Control (C2) server. This Python-based malware exploits Discord’s extensive user base to execute commands, steal sensitive information, and manipulate both local machines and Discord servers. Bot Initialization and Functionality…
-
Nine-Year-Old npm Packages Hijacked to Exfiltrate API Keys via Obfuscated Scripts
by
in SecurityNewsCybersecurity researchers have discovered several cryptocurrency packages on the npm registry that have been hijacked to siphon sensitive information such as environment variables from compromised systems.”Some of these packages have lived on npmjs.com for over 9 years, and provide legitimate functionality to blockchain developers,” Sonatype researcher Ax Sharma said. “However, […] the latest First seen…
-
PCI DSS 4.0 Compliance Requires a New Approach to API Security
by
in SecurityNewsRetailers, Financial Services, and the API Security Wake-Up Call With the PCI DSS 4.0 compliance deadline fast approaching, Cequence threat researchers have uncovered troubling data: 66.5% of malicious traffic is targeting retailers. And attackers aren’t just after payment data. They’re weaponizing APIs to exploit every stage of the digital buying process. The conclusions in this……
-
CoffeeLoader: A Brew of Stealthy Techniques
by
in SecurityNewsIntroductionZscaler ThreatLabz has identified a new sophisticated malware family that we named CoffeeLoader, which originated around September 2024. The purpose of the malware is to download and execute second-stage payloads while evading detection by endpoint-based security products. The malware uses numerous techniques to bypass security solutions, including a specialized packer that utilizes the GPU, call…
-
Securing Canada’s Digital Backbone: Navigating API Compliance
by
in SecurityNews
Tags: api, attack, authentication, best-practice, breach, compliance, cyber, data, detection, encryption, flaw, framework, governance, government, infrastructure, monitoring, regulation, risk, service, strategy, threat, vulnerabilityHighlights: Understanding Canadian API Standards: Key principles for secure government API development. Critical Importance of API Security: Why robust protection is vital for citizen data. Compliance and Trust: How adherence to standards builds public confidence. Key Security Considerations: Essential practices for Canadian organizations. Salt Security’s Alignment: How the Salt API Security Platform supports Canadian government…
-
Understanding RDAP: The Future of Domain Registration Data Access
by
in SecurityNews
Tags: access, api, attack, authentication, china, compliance, control, cyber, cybercrime, cybersecurity, data, detection, exploit, framework, fraud, GDPR, incident response, infrastructure, intelligence, Internet, law, malicious, malware, phishing, privacy, regulation, service, threat, tool, vulnerability -
The Unseen Battle: How Bots and Automation Threaten the Web
by
in SecurityNewsNew research from F5 Labs examined over 200 billion web and API traffic requests from businesses with bot controls in place. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/the-unseen-battle-how-bots-and-automation-threaten-the-web/
-
API Security: Another Critical Asset Under Threat
by
in SecurityNewsAdam Arellano of Traceable by Harness on Creating Multi-Layered Defense. Increasingly, APIs are in cyber adversaries’ crosshairs. What creates vulnerability complexities in API environments, and what can be done to create a more effective, multi-layered defense? Adam Arellano of Traceable by Harness discusses how AWS and Traceable tackle this challenge. First seen on govinfosecurity.com Jump…
-
Cloudflare now blocks all unencrypted traffic to its API endpoints
by
in SecurityNewsCloudflare announced that it closed all HTTP connections and it is now accepting only secure, HTTPS connections for api.cloudflare.com. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cloudflare-now-blocks-all-unencrypted-traffic-to-its-api-endpoints/
-
Imperva Named a Leader in Forrester Wave: Web Application Firewall (WAF) Solutions: A Continued Legacy of Excellence
by
in SecurityNewsIn today’s digital-first environment, protecting web applications and APIs is a critical priority for businesses. Organisations seek trusted solutions that balance robust protection, scalability, and ease of use. It’s no surprise that Imperva has been named a Leader in the Forrester Wave: Web Application Firewall (WAF), Q1 2025. For us, this recognition further solidifies Imperva’s……
-
70% of leaked secrets remain active two years later
by
in SecurityNewsLong-lived plaintext credentials have been involved in most breaches over the last several years, according to GitGuardian. When valid credentials, such as API keys, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/20/leaked-secrets-threats-in-cybersecurity/
-
How to detect Headless Chrome bots instrumented with Playwright?
by
in SecurityNewsHeadless Chrome bots powered by Playwright have become a go-to tool for bot developers due to their flexibility and efficiency. Playwright’s cross-browser capabilities, coupled with an API similar to Puppeteer and the lightweight nature of Headless Chrome, make it a powerful choice for tasks like web scraping, credential First seen on securityboulevard.com Jump to article:…
-
Critical vulnerability in AMI MegaRAC BMC allows server’ takeover
by
in SecurityNews
Tags: access, advisory, api, apt, attack, authentication, control, credentials, cve, cyberespionage, cybersecurity, data, data-breach, endpoint, exploit, firewall, firmware, flaw, group, infrastructure, Internet, linux, malicious, malware, network, ransomware, supply-chain, technology, training, update, vulnerabilityth vulnerability that Eclypsium researchers found in MegaRAC, the BMC firmware implementation from UEFI/BIOS vendor American Megatrends (AMI). BMCs are microcontrollers present on server motherboards that have their own firmware, dedicated memory, power, and network ports and are used for out-of-band management of servers when their main operating systems are shut down.Administrators can access BMCs…
-
Tomcat PUT to active abuse as Apache deals with critical RCE flaw
by
in SecurityNews
Tags: apache, api, attack, authentication, backdoor, cve, cvss, data, encryption, exploit, flaw, malicious, rce, remote-code-execution, tactics, threat, update, vulnerability) exploit released for the flaw, CVE-2025-24813, just 30 hours after it was publicly disclosed.”A devastating new remote code execution (RCE) vulnerability is now actively exploited in the wild,” Wallarm said in a blog post. “Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers.”PUT API requests are used to update…
-
Top 10 Non-Human Identities Risks by OWASP
by
in SecurityNewsThe Open Worldwide Application Security Project (OWASP) has just unveiled its Top 10 Non-Human Identities (NHI) Risks for 2025. While OWASP has long provided resources on application and API security, none have specifically addressed the unique challenges associated with NHIs. This new document bridges that gap, highlighting critical yet often overlooked risks that pose significant……
-
Wazuh SIEM Vulnerability Enables Remote Malicious Code Execution
by
in SecurityNewsA critical vulnerability, identified as CVE-2025-24016, has been discovered in the Wazuh Security Information and Event Management (SIEM) platform. This vulnerability affects versions 4.4.0 to 4.9.0 and allows attackers with API access to execute arbitrary Python code remotely, potentially leading to complete system compromise. The flaw stems from the unsafe deserialization of Distributed API (DAPI)…
-
AI development pipeline attacks expand CISOs’ software supply chain risk
by
in SecurityNews
Tags: access, ai, api, application-security, attack, backdoor, breach, business, ciso, cloud, container, control, cyber, cybersecurity, data, data-breach, detection, encryption, exploit, flaw, fortinet, government, infrastructure, injection, intelligence, LLM, malicious, malware, ml, network, open-source, password, penetration-testing, programming, pypi, risk, risk-assessment, russia, saas, sbom, service, software, supply-chain, threat, tool, training, vpn, vulnerabilitydevelopment pipelines are exacerbating software supply chain security problems.Incidents of exposed development secrets via publicly accessible, open-source packages rose 12% last year compared to 2023, according to ReversingLabs (RL).A scan of 30 of the most popular open-source packages found an average of six critical-severity and 33 high-severity flaws per package.Commercial software packages are also a…
-
7 misconceptions about the CISO role
by
in SecurityNews
Tags: api, attack, breach, business, ceo, ciso, compliance, control, corporate, cyber, cyberattack, cybersecurity, defense, exploit, finance, firewall, governance, infrastructure, insurance, jobs, network, password, phishing, resilience, risk, risk-assessment, risk-management, saas, software, startup, strategy, technology, threat, tool, training, update, vulnerabilityKatie Jenkins, EVP and CISO, Liberty Mutual Insurance Liberty Mutual InsuranceThe field is changing so rapidly, Jenkins adds, she needs to commit time to keeping up on research and connecting with other CISOs for knowledge exchange.In addition to securing infrastructure, an effective CISO focuses on securing the business, experts say. This requires understanding how security…
-
Invisible C2″Š”, “Šthanks to AI-powered techniques
by
in SecurityNews
Tags: ai, api, attack, breach, business, chatgpt, cloud, communications, control, cyberattack, cybersecurity, data, defense, detection, dns, edr, email, encryption, endpoint, hacker, iot, LLM, malicious, malware, ml, monitoring, network, office, openai, powershell, service, siem, soc, strategy, threat, tool, update, vulnerability, zero-trustInvisible C2″Š”, “Šthanks to AI-powered techniques Just about every cyberattack needs a Command and Control (C2) channel”Š”, “Ša way for attackers to send instructions to compromised systems and receive stolen data. This gives us all a chance to see attacks that are putting us at risk. LLMs can help attackers avoid signature based detection Traditionally, C2…
-
OBSCURE#BAT Malware Highlights Risks of API Hooking
by
in SecurityNewsResearchers discovered an attack chain that uses several layers of obfuscated batch files and PowerShell scripts to deliver an advanced and persistent rootkit. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/obscurebat-malware-highlights-api-hooking
-
One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild
by
in SecurityNewsA devastating new remote code execution (RCE) vulnerability, CVE-2025-24813, is now actively exploited in the wild. Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers. The exploit, originally published by a Chinese forum user iSee857, is already available online: CVE-2025-24813 PoC by iSee857. Exploit Breakdown: How a Simple PUT Request…
-
What role do APIs play in automating NHI management?
by
in SecurityNewsCould API Automation Be The Missing Piece In Your NHI Management? One critical question stands out: Could the underutilized potential of API automation be the missing piece in your Non-Human Identities (NHI) management strategy? With the increasing complexity of cloud environments and the mounting demand for robust security measures, the answer is a resounding yes….…