Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Unrestricted Resource Consumption (API4:2023) is the only threat category in the OWASP API Security Top 10 explicitly dedicated to Denial of Service (DoS) and resource abuse. But despite being just one category, attackers can exploit it in many different ways; from large file uploads and expensive GraphQL queries to abuse of metered third-party services like SMS gateways or AI/LLM APIs.

Prioritizing which vulnerabilities to fix across your application isn't always easy. Is it exploitable? Is it reachable? Will the update introduce breaking changes? Are there any other teams using this library that you should be aware of? What does the backlog look like if other changes need to be made? And that's just this week. Next week, it'll be the same thing all over again, with new discoveries, new version releases, and maybe even a new cybersecurity breach.

A newly discovered zero-day vulnerability, tracked as CVE-2025-54253, affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. Adobe has responded by issuing an urgent security update to prevent exploitation. Rated critical with a CVSS score of 10.0, this vulnerability can allow attackers to bypass authentication and execute arbitrary code remotely without requiring any user interaction.

We’ve normalized drowning in vulnerabilities. Thousands of findings, weekly scans, red dashboards – it’s all become background noise. And still, attackers slip through. Why? Because we’ve been solving for the wrong variable. The real question isn’t what’s vulnerable, it’s what’s exposed. Not every vulnerability is a threat.