Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In 2025, security benchmarks showed that over half of publicly disclosed vulnerabilities can bypass WAF protections when rule updates lag behind real-world exploits. Legacy WAFs were built for stable applications and predictable traffic. Today, frequent releases, API-driven architectures, and rapidly evolving attacks expose the limits of manual tuning and after-the-fact validation, leaving protection out of sync with reality.

According to the Indusface State of Application Security Report, SMBs now experience more attacks per application than large enterprises. Each SMB site facing an average of 2.24 million attacks per quarter, driven largely by malicious bot traffic and automated DDoS attempts. Despite this, many SMBs still operate with minimal security controls or legacy technology stacks, making them extremely vulnerable.

The digital storefront never sleeps, but in the first half of 2025, it has faced unprecedented hostility. According to the State of Application Security report 2025 Report, the threat landscape has shifted dramatically. E-commerce has become a primary target, with DDoS incidents in the retail and e-commerce sector spiking by 420%. Perhaps even more concerning is the vector of these attacks: attacks on APIs rose by 104%, with vulnerability exploitation increasing 13-fold.

A newly disclosed denial-of-service vulnerability, CVE-2025-66675, affects a wide range of Apache Struts 2 versions and poses a serious availability risk for applications that handle file uploads. While the EPSS score is 0.05%, indicating a low probability of exploitation in the next 30 days, the vulnerability still represents a high availability risk for exposed and unpatched environments.

With the rise of CI/CD pipelines, cloud-native development, and globally distributed teams, sensitive credentials like API keys, tokens, and database passwords often slip into source code. Sometimes accidentally, sometimes under pressure to deploy fast. This is not a rare mishap. A recent study found that 34% of API security incidents involve sensitive data exposure. And according to Cyble, over 1.5 million.env files containing secrets have been discovered in publicly accessible environments.

The disclosure of React2Shell (CVE-2025-55182) triggered a rapid patching effort across the React and Next.js ecosystem. However, deeper inspection of React Server Components (RSC) in the aftermath revealed additional vulnerabilities in adjacent code paths. These vulnerabilities pose serious operational and security risks.

A newly disclosed vulnerability in Ivanti Endpoint Manager (EPM) tracked as CVE-2025-10573 allows unauthenticated attackers to inject persistent JavaScript into the EPM administrative dashboard. Assigned a CVSS score of 9.6, this vulnerability presents a critical security risk because it enables attackers to hijack administrator sessions and gain full control over managed endpoints.

A critical vulnerability, CVE-2025-66516 (CVSS 10.0), has been identified in Apache Tika, affecting how the framework processes PDF files containing XFA (XML Forms Architecture) data. The vulnerability resides in tika-core, which means any system using Tika’s default parsing behavior remains vulnerable even if the PDF parser module was previously patched. No special configuration or insecure application code is required; simply ingesting a malicious PDF is enough to trigger the exploit.

The modern JavaScript ecosystem was shaken this week as Meta, Vercel, Google Cloud, AWS, and leading security researchers revealed two critical issues: CVE-2025-55182 and the downstream Next.js variant CVE-2025-66478. Both are rated CVSS 10 and allow remote code execution (RCE) by exploiting weaknesses in the React Server Components (RSC) “Flight” protocol. The vulnerabilities affect React 19 and all major frameworks embedding the RSC implementation, most notably Next.js 15.x and 16.x.

Cybersecurity in 2026 is entering its most transformative and volatile phase yet. For CISOs, the landscape is no longer defined only by web, network, and cloud threats. Instead, attackers now target AI/LLM systems, APIs, identity platforms, SaaS ecosystems and supply chains. The surge in attacks across applications, APIs, and GenAI systems indicates that adversaries are scaling faster, using automation, AI-assisted exploitation, and new social engineering vectors.