The new imperative in API security strategy

Of the 239 vulnerabilities, 33% (79 out of 239) were associated with authentication, authorization and access control (AAA) — foundational pillars of API security, according to Wallarm. Prioritizing AAA principles Open authentication (OAuth), single-si… Continue reading The new imperative in API security strategy

Wallarm API Abuse Prevention protects organizations against bot-based attacks

Wallarm announced its API Abuse Prevention feature to address one of the most critical API threats: bot-based attacks. Wallarm can now accurately identify and mitigate API bot activity, protecting systems against API abuse, account takeover (ATO), and … Continue reading Wallarm API Abuse Prevention protects organizations against bot-based attacks

Attackers exploit APIs faster than ever before

After combing through 350,000 reports to find 650 API-specific vulnerabilities from 337 different vendors and tracking 115 published exploits impacting these vulnerabilities, the results clearly illustrate that the API threat landscape is becoming more… Continue reading Attackers exploit APIs faster than ever before

GoTestWAF: Open-source project for evaluating web application security solutions

GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, WebSockets, SOAP, XMLRPC, etc. It was designed to evaluate web application security solutions, such as API security proxi… Continue reading GoTestWAF: Open-source project for evaluating web application security solutions

Wallarm advances API security with native gRPC and GraphQL support

At RSA Conference 2020, Wallarm released an expanded set of parsers, detection of API-specific vulnerabilities and API schema analysis for gRPC and GraphQL. With Wallarm context-specific protection is delivered both for externally-facing APIs and for s… Continue reading Wallarm advances API security with native gRPC and GraphQL support

PHP RCE flaw actively exploited to pop NGINX servers

A recently patched vulnerability (CVE-2019-11043) in PHP is being actively exploited by attackers to compromise NGINX web servers, threat intelligence firm Bad Packets has confirmed. For a successful exploitation, target servers must have the PHP-FPM (… Continue reading PHP RCE flaw actively exploited to pop NGINX servers