Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Apache SkyWalking is one of the most widely adopted open-source Application Performance Monitoring (APM) and observability platforms, trusted by developers and DevOps teams to visualize telemetry, trace distributed systems, and ensure application uptime. However, a recently disclosed vulnerability has revealed that the very dashboards designed to improve visibility could be turned into attack vectors.

APIs are now the foundation of SaaS product development, powering authentication, user onboarding, billing, integrations, webhooks, analytics, and internal microservices. As this API footprint grows, the threat landscape has intensified. The Indusface State of Application Security H1 2025 Report recorded a 104% rise in API-targeted attacks, a 13X increase in API vulnerability exploits, and 388% more DDoS attacks on API hosts than on websites.

During the first half of 2025, APIs faced significantly higher number of attacks than traditional web applications. On average, attacks per API host were 72% higher than those targeting websites, and exploitation of API vulnerabilities surged 13× compared to a 27% increase for website vulnerabilities, according to the State of Application Security Global H1 2025.

On 14 November 2025, the Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025, officially activating the DPDP Act, 2023. The Rules transform the law from a policy framework into a fully enforceable compliance regime, starting an 18-month implementation countdown for every business in India.

The internet’s fragility was evident again during the recent Cloudflare outage. A single internal fault rippled outward and disrupted major websites and business applications. X, ChatGPT, media platforms, dashboards and thousands of other services simultaneously showed 5xx errors. And this is not new.

Apache Tomcat continues to play a central role in hosting Java-based web applications across enterprises, cloud services, and government systems. Its reliability and lightweight architecture make it a go-to choice for developers, but its ubiquity also means that a single vulnerability can have widespread security implications. CVE-2025-55752, disclosed in late 2025, highlights how a subtle processing regression can evolve into a high-impact vulnerability under the right conditions.

The Django Software Foundation has rolled out important security fixes addressing two serious vulnerabilities that could let attackers manipulate databases and disrupt application availability. The vulnerabilities such as CVE-2025-64459 (SQL Injection) and CVE-2025-64458 (Denial of Service), were found in commonly used functions of the Django web framework. These vulnerabilities affect how Django processes queries and handles redirects, especially when user-supplied input is not properly validated.

SessionReaper (CVE-2025-54236), an unauthenticated vulnerability in the Commerce REST API enables session takeover and possible RCE. If you run Adobe Commerce or Magento Open Source, this critical, pre-auth vulnerabilities can let attackers hijack customer accounts, manipulate orders, and in many real-world setups drop persistent PHP web shells on your servers.

API Security Evaluation Checklist In the first half of 2025, APIs have emerged as the primary focus for attackers. Unlike traditional broad attacks on websites, threat actors are increasingly exploiting vulnerabilities and launching DDoS attacks on APIs, which are often harder to secure and manage at scale. Key insights from the State of Application Security Report H1 2025.

Managed Security Service Providers (MSSPs) are tasked with securing dozens or even hundreds of client applications at once. Each client may have unique traffic patterns, custom rules, and distinct compliance needs. Managing Web Application Firewalls (WAFs) for such diverse environments can easily become chaotic if done manually or across fragmented systems. A centralized MSSP WAF dashboard changes that equation.