Tag: api
-
Unitree Go1: Gefährliche Backdoor in populärem Roboterhund entdeckt
by
in SecurityNewsEin Roboterhund aus China konnte mit einem bestimmten API-Key aus der Ferne gesteuert werden – mit erheblichen Risiken für Personen in der Nähe. First seen on golem.de Jump to article: www.golem.de/news/unitree-go1-gefaehrliche-backdoor-in-populaerem-roboterhund-entdeckt-2504-194933.html
-
10 best practices for vulnerability management according to CISOs
by
in SecurityNews
Tags: api, attack, automation, best-practice, business, ceo, cio, ciso, control, cybersecurity, data, detection, framework, group, incident response, metric, mitre, penetration-testing, programming, ransomware, risk, risk-management, service, software, strategy, technology, threat, tool, update, vulnerability, vulnerability-management1. Culture Achieving a successful vulnerability management program starts with establishing a cybersecurity-minded culture across the organization. Many CISOs admitted to facing historical cultural problems, with one summing it up well. “Our cybersecurity culture was pretty laissez-faire until we got hit with Log4J and then a ransomware attack,” he told CSO. “These events were an…
-
New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth
by
in SecurityNewsCybersecurity researchers have discovered an updated version of a malware loader called Hijack Loader that implements new features to evade detection and establish persistence on compromised systems.”Hijack Loader released a new module that implements call stack spoofing to hide the origin of function calls (e.g., API and system calls),” Zscaler ThreatLabz researcher Muhammed Irfan V…
-
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk
by
in SecurityNewsDespite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
-
New Python-Based Discord RAT Targets Users to Steal Login Credentials
by
in SecurityNewsA recently identified Remote Access Trojan (RAT) has raised alarms within the cybersecurity community due to its innovative use of Discord’s API as a Command and Control (C2) server. This Python-based malware exploits Discord’s extensive user base to execute commands, steal sensitive information, and manipulate both local machines and Discord servers. Bot Initialization and Functionality…
-
Nine-Year-Old npm Packages Hijacked to Exfiltrate API Keys via Obfuscated Scripts
by
in SecurityNewsCybersecurity researchers have discovered several cryptocurrency packages on the npm registry that have been hijacked to siphon sensitive information such as environment variables from compromised systems.”Some of these packages have lived on npmjs.com for over 9 years, and provide legitimate functionality to blockchain developers,” Sonatype researcher Ax Sharma said. “However, […] the latest First seen…
-
PCI DSS 4.0 Compliance Requires a New Approach to API Security
by
in SecurityNewsRetailers, Financial Services, and the API Security Wake-Up Call With the PCI DSS 4.0 compliance deadline fast approaching, Cequence threat researchers have uncovered troubling data: 66.5% of malicious traffic is targeting retailers. And attackers aren’t just after payment data. They’re weaponizing APIs to exploit every stage of the digital buying process. The conclusions in this……
-
CoffeeLoader: A Brew of Stealthy Techniques
by
in SecurityNewsIntroductionZscaler ThreatLabz has identified a new sophisticated malware family that we named CoffeeLoader, which originated around September 2024. The purpose of the malware is to download and execute second-stage payloads while evading detection by endpoint-based security products. The malware uses numerous techniques to bypass security solutions, including a specialized packer that utilizes the GPU, call…
-
Securing Canada’s Digital Backbone: Navigating API Compliance
by
in SecurityNews
Tags: api, attack, authentication, best-practice, breach, compliance, cyber, data, detection, encryption, flaw, framework, governance, government, infrastructure, monitoring, regulation, risk, service, strategy, threat, vulnerabilityHighlights: Understanding Canadian API Standards: Key principles for secure government API development. Critical Importance of API Security: Why robust protection is vital for citizen data. Compliance and Trust: How adherence to standards builds public confidence. Key Security Considerations: Essential practices for Canadian organizations. Salt Security’s Alignment: How the Salt API Security Platform supports Canadian government…
-
Understanding RDAP: The Future of Domain Registration Data Access
by
in SecurityNews
Tags: access, api, attack, authentication, china, compliance, control, cyber, cybercrime, cybersecurity, data, detection, exploit, framework, fraud, GDPR, incident response, infrastructure, intelligence, Internet, law, malicious, malware, phishing, privacy, regulation, service, threat, tool, vulnerability -
The Unseen Battle: How Bots and Automation Threaten the Web
by
in SecurityNewsNew research from F5 Labs examined over 200 billion web and API traffic requests from businesses with bot controls in place. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/the-unseen-battle-how-bots-and-automation-threaten-the-web/
-
API Security: Another Critical Asset Under Threat
by
in SecurityNewsAdam Arellano of Traceable by Harness on Creating Multi-Layered Defense. Increasingly, APIs are in cyber adversaries’ crosshairs. What creates vulnerability complexities in API environments, and what can be done to create a more effective, multi-layered defense? Adam Arellano of Traceable by Harness discusses how AWS and Traceable tackle this challenge. First seen on govinfosecurity.com Jump…
-
Cloudflare now blocks all unencrypted traffic to its API endpoints
by
in SecurityNewsCloudflare announced that it closed all HTTP connections and it is now accepting only secure, HTTPS connections for api.cloudflare.com. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cloudflare-now-blocks-all-unencrypted-traffic-to-its-api-endpoints/
-
Imperva Named a Leader in Forrester Wave: Web Application Firewall (WAF) Solutions: A Continued Legacy of Excellence
by
in SecurityNewsIn today’s digital-first environment, protecting web applications and APIs is a critical priority for businesses. Organisations seek trusted solutions that balance robust protection, scalability, and ease of use. It’s no surprise that Imperva has been named a Leader in the Forrester Wave: Web Application Firewall (WAF), Q1 2025. For us, this recognition further solidifies Imperva’s……
-
70% of leaked secrets remain active two years later
by
in SecurityNewsLong-lived plaintext credentials have been involved in most breaches over the last several years, according to GitGuardian. When valid credentials, such as API keys, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/20/leaked-secrets-threats-in-cybersecurity/
-
How to detect Headless Chrome bots instrumented with Playwright?
by
in SecurityNewsHeadless Chrome bots powered by Playwright have become a go-to tool for bot developers due to their flexibility and efficiency. Playwright’s cross-browser capabilities, coupled with an API similar to Puppeteer and the lightweight nature of Headless Chrome, make it a powerful choice for tasks like web scraping, credential First seen on securityboulevard.com Jump to article:…
-
Critical vulnerability in AMI MegaRAC BMC allows server’ takeover
by
in SecurityNews
Tags: access, advisory, api, apt, attack, authentication, control, credentials, cve, cyberespionage, cybersecurity, data, data-breach, endpoint, exploit, firewall, firmware, flaw, group, infrastructure, Internet, linux, malicious, malware, network, ransomware, supply-chain, technology, training, update, vulnerabilityth vulnerability that Eclypsium researchers found in MegaRAC, the BMC firmware implementation from UEFI/BIOS vendor American Megatrends (AMI). BMCs are microcontrollers present on server motherboards that have their own firmware, dedicated memory, power, and network ports and are used for out-of-band management of servers when their main operating systems are shut down.Administrators can access BMCs…
-
Tomcat PUT to active abuse as Apache deals with critical RCE flaw
by
in SecurityNews
Tags: apache, api, attack, authentication, backdoor, cve, cvss, data, encryption, exploit, flaw, malicious, rce, remote-code-execution, tactics, threat, update, vulnerability) exploit released for the flaw, CVE-2025-24813, just 30 hours after it was publicly disclosed.”A devastating new remote code execution (RCE) vulnerability is now actively exploited in the wild,” Wallarm said in a blog post. “Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers.”PUT API requests are used to update…
-
Top 10 Non-Human Identities Risks by OWASP
by
in SecurityNewsThe Open Worldwide Application Security Project (OWASP) has just unveiled its Top 10 Non-Human Identities (NHI) Risks for 2025. While OWASP has long provided resources on application and API security, none have specifically addressed the unique challenges associated with NHIs. This new document bridges that gap, highlighting critical yet often overlooked risks that pose significant……