Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

wallarm

When APIs Become Attack Paths: What the Q3 2025 ThreatStats Report Tells Us

Oct 30, 2025 By Wallarm In Wallarm
Wallarm’s latest Q3 2025 API ThreatStats report reveals that API vulnerabilities, exploits, and breaches are not just increasing; they’re evolving. Malicious actors are shifting from code-level weaknesses to business logic flaws, from web apps to partner integrations, and from REST to AI-powered APIs. Here’s what stood out this quarter, and what security leaders should do about it.
Read Post
detectify

The API vulnerabilities nobody talks about: excessive data exposure

Oct 28, 2025 By Joviane Jardim In Detectify
TLDR: Excessive Data Exposure (leaking internal data via API responses) is the silent, pervasive threat that is more dangerous than single dramatic flaws like SQL Injection. It amplifies every other API vulnerability (like BOLA) and happens everywhere because developers prioritize speed over explicit data filtering. Fixing it means systematically checking hundreds of endpoints for unneeded PII and sensitive internal data.
Read Post
wallarm

API Attack Awareness: Business Logic Abuse - Exploiting the Rules of the Game

Oct 27, 2025 By Wallarm In Wallarm
As Cybersecurity Awareness Month continues, we wanted to dive even deeper into the attack methods affecting APIs. We’ve already reviewed Broken Object Level Authentication (BOLA), injection attacks, and authentication flaws; this week, we’re exploring business logic abuse (BLA). Unlike technical flaws, business logic flaws exploit how an API is designed to behave.
Read Post
detectify

New API testing category now available

Oct 23, 2025 By Detectify In Detectify
Our API scanner can test for dozens of vulnerability types like prompt injections and misconfigurations. We’re excited to share today that we’re releasing vulnerability tests for OAuth API authorization for organizations that use JWT tokens. These JWT, or JSON Web Tokens, are meant to prove that you have access to whatever it is you are accessing. One of the most critical JWT vulnerabilities is algorithm confusion.
Read Post

After the AWS Outage: How to Build Systems That Survive

Oct 23, 2025 By Wallarm In Wallarm
When AWS goes down, the ripple effects are global, from authentication failures to service disruptions that bring businesses to a standstill. But while every outage makes headlines, the real question is: Why are so many organizations still unprepared? In this live fireside chat, Wallarm’s Field CTO, and STO of Security Edge, Tim Ebbers, unpacks the architectural lessons behind the latest AWS outage — and what engineering, DevOps, and security leaders can do today to prevent history from repeating itself.
View Video

How I 'Hacked' an Online Store #businesslogic #ecommerce #cybersecurity #apisecurity

Oct 23, 2025 By Wallarm In Wallarm
A $10,000 Order for $1? Your Business Logic is Broken Attackers aren't just breaking code; they're exploiting the rules of your business to commit fraud. When your application's logic is flawed: Your payment and fulfillment systems can be desynchronized. You can lose massive revenue to easily preventable abuse. Your inventory and financial reporting become unreliable. Watch how a simple business logic flaw can lead to catastrophic financial loss in this real-world example. Is your e-commerce platform safe?
View Video
Trustwave

API Security: Challenges for a Secure Digital Frontier

Oct 21, 2025 By Dora Miranda In Trustwave
Organizations continue their digital transformation, with APIs now serving as the main communication links between applications, platforms, services, and partners. The widespread use of APIs introduces new security risks despite their common presence. The growing number of APIs significantly increases the cyber risks that security teams must address as they keep up with technological advances.
Read Post
wallarm

Key API Security Takeaways from the Postman 2025 State of API Report

Oct 21, 2025 By Wallarm In Wallarm
API security has never been more important because modern APIs are operational necessities. Unfortunately, many organizations are failing to adapt their security models to a rapidly changing API threat landscape. Like it or not, we live in an AI-first world, and API security must reflect that reality. The Postman 2025 State of API Report is confirmation of that fact.
Read Post
10 Common Vulnerabilities Found During Software Audits - and How to Fix Them

10 Common Vulnerabilities Found During Software Audits - and How to Fix Them

Oct 20, 2025 By SecuritySenses In SecuritySenses
A software audit is not a checklist but a thorough examination into the internal workings of your system that lurking vulnerabilities are usually hiding. Thousands of breaches every year are due to organizations not paying early attention to software audit vulnerabilities that might have been noticed and eliminated at an early stage. This article exposes the top ten vulnerabilities that are oftentimes encountered during software audits, why they occur, and offers some remediation measures that can be taken.
Read Post
miniorange

Why You Should Never Use Basic Auth for Atlassian APIs in 2025

Oct 14, 2025 By Pallavi Narang In miniOrange
Basic Authentication is becoming obsolete for Atlassian APIs in 2025. With Atlassian enforcing token expiration and stricter security standards, it’s time to switch to modern methods like OAuth 2.0, JWT, or API Keys. miniOrange makes this migration seamless with secure, centralized, and auditable API access. Strengthen your Jira integrations while staying compliant and future-ready.
Read Post
levelblue

API Security: Challenges for a Secure Digital Frontier

Oct 14, 2025 By Dora Miranda In LevelBlue
Organizations continue their digital transformation, with APIs now serving as the main communication links between applications, platforms, services, and partners. The widespread use of APIs introduces new security risks despite their common presence. The growing number of APIs significantly increases the cyber risks that security teams must address as they keep up with technological advances.
Read Post
wallarm

API Attack Awareness: When Authentication Fails - Exposing APIs to Risk

Oct 14, 2025 By Wallarm In Wallarm
Authentication issues seem like low-level attacks. But authentication today – especially API authentication – can be more difficult than people expect. Companies rely on APIs to carry sensitive information every day. If access to those APIs is not properly secured, all the sophisticated security solutions companies use to protect their data elsewhere are completely undermined.
Read Post
wallarm

Wallarm: API Security Platform of the Year 2025

Oct 10, 2025 By Wallarm In Wallarm
2025 has been one of Wallarm’s biggest years yet. In the last few months alone, we unveiled our industry-first API Revenue Protection capability, launched our next-gen Security Edge offering, were included in the 2025 Inc. 5000 list of fastest-growing private companies in America, and announced our $55M Series C funding round. This October, we’re proud to see our dedication and our customers’ confidence recognized.
Read Post
miniorange

Top 5 Problems You Can Solve with REST API Authentication for Jira and Confluence

Oct 10, 2025 By Akshay Kedari In miniOrange
In the Atlassian ecosystem, REST APIs offered by Jira, Confluence, and other tools quietly power automation, integrations, and data exchange across the ecosystem. These APIs enable seamless communication between Atlassian products and external applications, making workflows smoother and more efficient.
Read Post
salt security

Anatomy of a Modern Threat: Deconstructing the Figma MCP Vulnerability

Oct 9, 2025 By Eric Schwake In Salt Security
Threat researchers recently disclosed a severe vulnerability in a Figma Model Context Protocol (MCP) server, as reported by The Hacker News. While the specific patch is important, the discovery itself serves as a critical wake-up call for every organization rushing to adopt AI. This incident provides a blueprint for a new class of attacks that target the very infrastructure powering the AI Agent Economy. To understand the risk, we must first look at the mechanics of this emerging threat.
Read Post

A CISO's Guide to API Security

Oct 9, 2025 By Wallarm In Wallarm
APIs are powering digital transformation but also exposing organizations to new risks. Securing them requires collaboration between CISOs, CIOs, and the board. This webinar will demystify the evolving API threat landscape, outline governance strategies, and provide leaders with the tools to communicate API risk in business terms. Key Learnings: Why You Should Attend.
View Video
salt security

From Bottleneck to Enabler: A New Approach to API Security in the Age of AI

Oct 8, 2025 By Eric Schwake In Salt Security
AI adoption has fundamentally redefined the role of APIs. They are no longer just conduits for data; they have become the “AI action plane” for autonomous systems. Every AI workflow, agent, and tool call now rides on an API, exposing a critical truth: you cannot secure AI without first securing your APIs. The H2 2025 State of API Security report reveals that this dependency is dangerously outpacing current security practices.
Read Post
levelblue

Facing the Storm: Navigating the Complex Challenges of Bot Threats in Web Application and API Security

Oct 7, 2025 By Dora Miranda In LevelBlue
Picture your online shopping site overwhelmed with fake orders, your customer accounts being drained one after another, or your essential APIs flooded by an endless wave of automated attacks. This is the reality businesses face today—thanks to a fully automated army of cyber criminals determined to cause harm. In this digital bot invasion, businesses of all kinds are under urgent pressure to establish defenses that effectively fight this digital threat.
Read Post
wallarm

API Attack Awareness: Injection Attacks in APIs - Old Threat, New Surface

Oct 3, 2025 By Wallarm In Wallarm
Injection attacks are among the oldest tricks in the attacker playbook. And yet they persist. The problem is that the core weakness, trusting user inputs too much, keeps resurfacing in new forms. As organizations have shifted to API-driven architectures and integrated AI systems that consume unstructured input, the attack surface has expanded dramatically.
Read Post
Trustwave

LevelBlue Managed WAAP Enables Organizations to Solve Day 1 WAAP Implementation Challenges

Oct 2, 2025 By Trustwave In Trustwave
Deploying Web Application and API Protection (WAAP) systems is crucial for bolstering cybersecurity defenses. Akamai reported 108 billion API attacks over an 18-month period, underscoring the value of APIs to cybercriminals. Like any new security measure, the initial deployment brings various challenges during the "Day One" process. These Day One challenges should not compromise security effectiveness or disrupt business operations.
Read Post
wallarm

API Attack Awareness: Broken Object Level Authorization (BOLA) - Why It Tops the OWASP API Top 10

Oct 1, 2025 By Wallarm In Wallarm
For this Cybersecurity Awareness Month, we thought it important to draw attention to some of the most common and dangerous API vulnerabilities. This week, we’re starting with Broken Object Level Authorization (BOLA). BOLA vulnerabilities top the OWASP API Top Ten. And for good reason: they’re startlingly prevalent, remarkably easy to exploit, and can have devastating consequences. So, let’s explore what they are, why they matter, and how you can mitigate them.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.