This week, we share news of API vulnerabilities affecting Avelo Airlines, WhatsApp, and Oracle, and an incident notification from OpenAI to API developers about potential information exposure. We also highlight a new survey from F5 on the role of API security in agentic AI systems. And to wrap up, we have an article examining the [...] Read More... The post Issue 285: API hack at Avelo Airlines, 3
This week, we have views from Forbes on how APIs are being used to target businesses and articles on the role of cloud-native for APIs and how APIs are becoming attractive targets. We also have a doubleheader from Dana Epp covering his predictions for 2024 and structured format injection attacks. We also have news of [...] Read More... The post Issue 238: APIs used to target business, cloud-native
This week, we have an article from the NewStack on API security best practices in Kubernetes, a podcast with Corey Ball discussing API security best practices, an article on broken access control concerns in APIs, and 42Crunch’s eBook on API security. Most importantly, we have news of last week’s winner in the 200th-issue giveaway and [...] Read More... The post Issue 201: API security in Kubernet
This week, we have articles on the importance of API security for the software supply chain, and how API adoption is increasing in the healthcare industry whilst addressing cyber security concerns. We also have new guidance from Microsoft Azure on security baselines for API management, and a free software security course from the Linux Foundation. [...] Read More... The post Issue 196: Software su
This week, our theme is “how secure is your API security?”. We highlight two recent attacks targeting major financial platforms, along with a new industry survey that exposes significant gaps in API security practices. We also explore technical deep-dives into vulnerabilities such as JWT flaws and host header injection attacks. Plus, we share details on [...] Read More... The post Issue 275: API h
This week, we have news of another API key leak, this time affecting users of Sumo Logic, who have been advised to rotate their keys out of caution. We also have articles on the risk of RBAC vulnerabilities for APIs and why CFOs should prioritize API security as a cost-saver and business enabler. We also [...] Read More... The post Issue 234: Sumo Logic breach leads to key reset, risk of RBAC vuln
This week, we have five best practices from SoftwareAGGov for API security, and views from Jeff Williams at Contrast Security on the suitability (or not) of application security (AppSec) testing tools for API security. We also feature guides on how to secure partner API integrations with OAuth mTLS and on what to look for in [...] Read More... The post Issue 193: Five API security best practices,
This week, we have a report revealing that the manufacturing industry experiences more API-related incidents than other industries. To follow, we have two guides for developers: the first describes the REST protocol and common API vulnerabilities, and the second prescribes best practices for secure API design. Finally, we have a fun read on cracking API [...] Read More... The post Issue 205: Manuf
This week, we have new research from FORTBRIDGE that reveals a client-side request forgery (CSRF) vulnerability in API-enabled instances of Plesk, the popular server administration portal. We also have an article on the top five API security myths according to Hacker News, a quick look at the Ory Hydra OAuth2/OIDC server, and a guide to [...] Read More... The post Issue 209: CSRF in Plesk API-enab
This week, we focus on the topic of API error handling and how a REST API exposed 4 million WordPress websites to account takeover attacks. We also cover the risks and best practices for designing API error responses, and we look at an article that makes a great case for API-First. Vulnerability: 4,000,000 WordPress sites [...] Read More... The post Issue 259: API flaw exposes 4 million WordPress
This week, we have views from Matias Madou (CTO of Secure Code Warrior) on why API security needs a reset to focus on people and not tools, another excellent walkthrough of the vAPI vulnerable API, an article covering the five stages necessary to attain API security, and a quick guide on exploiting GraphQL endpoints. Article: [...] Read More... The post Issue 225 : API security needs a reset, vAPI
This week, we have news of a breach affecting users of the OpenSea NFR trading platform, requiring a key rotation; and disclosure of an API vulnerability in the Atlas VPN exposing user IP addresses. We also have an article from The New Stack on API fuzzing and its benefits and a guide on using Keycloak [...] Read More... The post Issue 230: OpenSea API breach, flaw in Atlas VPN, using API fuzzing
This week, we look at how familiar API security failures — authentication bypasses, missing input validation allowing old school attacks like SQL injections — continue to surface across enterprise platforms and critical infrastructure. From exposed supply-chain APIs to identity-layer weaknesses and unauthenticated RCEs, the pattern is clear: basic API controls still break in production. We [...] R
This week, we have news of two API security incidents: the reported leakage of the data of 2.6 million DuoLingo users and an incident at JumpCloud that resulted in resetting customer API keys. For the technically minded, we have two guides: the first discusses how to use API keys in an ASP.Net Core application, and [...] Read More... The post Issue 229: Incidents with DuoLingo and JumpCloud, FastA
This week, we dive into an unusual case of humans spoofing AI. We also examine three real-world API incidents of OWASP API Security Top 10 vulnerabilities. Plus, we share insights from a new industry report on rising API attack trends and explore how GitHub’s MCP vulnerability may signal a new set of authorization challenges to [...] Read More... The post Issue 273: Dangers from AI Hype, Top OWASP
This week, we have a report from Akamai focusing on APIs which they describe as “the attack surface that connects us all”. We also feature an API security checklist that covers seven of the most important requirements, and an article on the dangers of API security overconfidence. Finally, we round off with a video from [...] Read More... The post Issue 190: Akamai’s report on APIs, API security ch
This week, we have an article on the six top API security risks being favored by attackers, an article on why your APIs have no clothes, a guide on API security testing to improve security and data confidentiality, and finally, news of API security testing training courses being off by @theXSSRat. Due to annual vacation, [...] Read More... The post Issue 202: Six top API security risks, why APIs h
This week, we have news of four API-related security vulnerabilities, including Kronos’s $25m loss. Other vulnerabilities include a malware threat of DDoS on Docker APIs, a report on vulnerabilities on WordPress and Netflix, and an API vulnerability found in the Ray AI framework. We also have an article on why APIs are fertile ground for [...] Read More... The post Issue 235: 25m loss at Kronos du
This week, we share reports on the latest insights into the API breach at Optus and CocoaPods vulnerabilities reveal severe risks from the software supply chain. We examine the importance of API input validation for blocking DoS and authentication attacks. And finally a mention of our upcoming webinar examining recent API breaches and how to [...] Read More... The post Issue 249: Major API breach
This week, we investigate a recent flaw in WhatsApp’s View Once privacy feature and also critical vulnerabilities reported in the IBM WebMethods integration platform. We highlight a NordicAPIs article on the risks from third-party API and LLMs, and an article on solving the challenges of fine-grained access control for APIs. There’s also an interesting webinar [...] Read More... The post Issue 254
This week, we have news of a vulnerability in the API of the Zendesk Explore platform allowing an attacker to inject malicious SQL payloads. We also have coverage of the recent breach affecting up to 5.4 million users of the Twitter platform. We also have two articles — the first is an article on the [...] Read More... The post Issue 211: SQLi vulnerability in Zendesk Explore, Twitter API vulnerab
This week, we have a report from Imperva indicating that vulnerable APIs may be costing as much as $75 billion annually with the largest organizations being at the highest risk. We also have coverage of the new API security platform from Google, views from Curity on API-driven backends for frontends for increased API security, and [...] Read More... The post Issue 192: Vulnerable APIs costing $75
This week, we’re sharing two articles focused on input validation best practices, exploring how weak validation can leave APIs exposed. We also take a closer look at some recent claims about API discovery that risk distracting from real security issues, plus a review of recent API security incidents reported at McDonald’s and Cisco. Article: How [...] Read More... The post Issue 276: API discovery
This week, we look at a survey of API security priorities in Asia Pacific and why canary testing became a hot topic following the Crowdstrike incident. We examine two cases of API vulnerabilities discovered in the field, and finally, we review the potential cost and implications of a data breach. Survey: API security insights from [...] Read More... The post Issue 252: API Security in APAC, Crowds
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.