Tag: api
-
Previously harmless Google API keys now expose Gemini AI data
Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/previously-harmless-google-api-keys-now-expose-gemini-ai-data/
-
Malicious Repo Files Could Hijack Claude Code Sessions
Flaws Let Attackers Run Commands and Steal API Keys Before Trust Prompt. Check Point research found three critical flaws in Anthropic’s Claude Code that allow attackers to execute arbitrary commands and steal API keys through repository configuration files, before users see a trust prompt. The AI giant has patched all three vulnerabilities. First seen on…
-
OpenClaw Security Risk: OAuth and SaaS Identity
OpenClaw runs locally, but the risk lives in SaaS. Learn how OAuth tokens, API access, and AI agents create identity-based exposure across platforms. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/openclaw-security-risk-oauth-and-saas-identity/
-
Kritische Sicherheitslücken in Anthropics Claude-Code
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat kritische Schwachstellen in Anthropics KI-basiertem Coding-Tool ‘Claude Code” identifiziert (CVE-2025-59536, CVE-2026-21852). Diese ermöglichten die Ausführung von Remote-Code und den Diebstahl von API-Anmeldedaten. Durch den Missbrauch integrierter Mechanismen wie Hooks, Model-Context-Protocol (MCP)-Integrationen und Umgebungsvariablen konnten Angreifer beliebige Shell-Befehle ausführen und API-Schlüssel exfiltrieren, wenn Entwickler…
-
Kritische Sicherheitslücken in Anthropics Claude-Code
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat kritische Schwachstellen in Anthropics KI-basiertem Coding-Tool ‘Claude Code” identifiziert (CVE-2025-59536, CVE-2026-21852). Diese ermöglichten die Ausführung von Remote-Code und den Diebstahl von API-Anmeldedaten. Durch den Missbrauch integrierter Mechanismen wie Hooks, Model-Context-Protocol (MCP)-Integrationen und Umgebungsvariablen konnten Angreifer beliebige Shell-Befehle ausführen und API-Schlüssel exfiltrieren, wenn Entwickler…
-
Kritische Sicherheitslücken in Anthropics Claude-Code
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat kritische Schwachstellen in Anthropics KI-basiertem Coding-Tool ‘Claude Code” identifiziert (CVE-2025-59536, CVE-2026-21852). Diese ermöglichten die Ausführung von Remote-Code und den Diebstahl von API-Anmeldedaten. Durch den Missbrauch integrierter Mechanismen wie Hooks, Model-Context-Protocol (MCP)-Integrationen und Umgebungsvariablen konnten Angreifer beliebige Shell-Befehle ausführen und API-Schlüssel exfiltrieren, wenn Entwickler…
-
China-linked hackers used Google Sheets to spy on telecoms and governments across 42 countries
Tags: access, api, apt, china, cloud, communications, cyber, cyberespionage, data, defense, endpoint, espionage, google, government, group, hacker, infrastructure, intelligence, linux, mandiant, monitoring, network, phone, radius, service, spy, theft, threat, vpnHow Mandiant found it: The campaign came to light during a Mandiant Threat Defense investigation, when analysts flagged unusual activity on a CentOS server. A binary named xapt, designed to masquerade as the apt package manager on Debian-based Linux systems, had already escalated to root and was running shell commands to confirm its access level,…
-
Check Point Research identifiziert kritische Sicherheitslücken in Anthropics Claude Code
Die schwerwiegendste Schwachstelle betrifft die Manipulation der API-Kommunikation. Durch eine gezielte Konfigurationsänderung konnte der gesamte API-Verkehr, inklusive des vollständigen Autorisierungs-Headers mit dem aktiven API-Key des Entwicklers First seen on infopoint-security.de Jump to article: www.infopoint-security.de/check-point-research-identifiziert-kritische-sicherheitsluecken-in-anthropics-claude-code/a43835/
-
Malicious StripeApi NuGet Package Mimicked Official Library and Stole API Tokens
Cybersecurity researchers have disclosed details of a new malicious package discovered on the NuGet Gallery, impersonating a library from financial services firm Stripe in an attempt to target the financial sector.The package, codenamed StripeApi.Net, attempts to masquerade as Stripe.net, a legitimate library from Stripe that has over 75 million downloads. It was uploaded by a…
-
Keeper Security führt quantenresistente Verschlüsselung ein
Die Bereitstellung der Kyber-basierten quantenresistenten Verschlüsselung ist nun in den Backend-APIs von Keeper und Keeper Commander verfügbar. In Kürze wird sie auch auf mobilen Plattformen verfügbar sein First seen on infopoint-security.de Jump to article: www.infopoint-security.de/keeper-security-fuehrt-quantenresistente-verschluesselung-ein/a43823/
-
Is Your AppSec Program Truly Mature?
Learn how to build a high-maturity Application Security program with secure SDLC, developer-first practices, automated AppSec controls, practical threat modeling, runtime API protection, and meaningful security metrics. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/is-your-appsec-program-truly-mature/
-
Is Your AppSec Program Truly Mature?
Learn how to build a high-maturity Application Security program with secure SDLC, developer-first practices, automated AppSec controls, practical threat modeling, runtime API protection, and meaningful security metrics. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/is-your-appsec-program-truly-mature/
-
Firefox 148 Unveils New Sanitizer API to Mitigate XSS Attacks in Web Applications
Firefox has launched a major update to help protect web applications from Cross-Site Scripting (XSS) attacks. With the release of Firefox 148, Mozilla introduces the new standardized Sanitizer API, making it the first browser to ship this built-in security tool. This new feature gives web developers an easy way to clean up untrusted code before…
-
Untrusted repositories turn Claude code into an attack vector
Flaws in Anthropic’s Claude Code could allow remote code execution and theft of API keys when users open untrusted repositories. Check Point Research team found multiple vulnerabilities in Anthropic’s Claude Code AI coding assistant that could lead to remote code execution and API key theft. The vulnerabilities abuse features such as Hooks, MCP servers, and…
-
Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration
Tags: ai, api, cybersecurity, exploit, flaw, intelligence, remote-code-execution, theft, vulnerabilityCybersecurity researchers have disclosed multiple security vulnerabilities in Anthropic’s Claude Code, an artificial intelligence (AI)-powered coding assistant, that could result in remote code execution and theft of API credentials.”The vulnerabilities exploit various configuration mechanisms, including Hooks, Model Context Protocol (MCP) servers, and environment variables executing First seen on thehackernews.com Jump to article: thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html
-
Chinese cyberspies breached dozens of telecom firms, govt agencies
Google’s Threat Intelligence Group (GTIG), Mandiant, and partners disrupted a global espionage campaign attributed to a suspected Chinese threat actor that used SaaS API calls to hide malicious traffic in attacks targeting telecom and government networks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-cyberspies-breached-dozens-of-telecom-firms-govt-agencies/
-
Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files 2025-59536 2026-21852
y Aviv Donenfeld and Oded Vanunu Executive Summary Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. The vulnerabilities exploit various configuration mechanisms including Hooks, Model Context Protocol (MCP) servers, and environment variables -executing arbitrary shell commands…
-
mquire: Linux memory forensics without external dependencies
If you’ve ever done Linux memory forensics, you know the frustration: without debug symbols that match the exact kernel version, you’re stuck. These symbols aren’t typically installed on production systems and must be sourced from external repositories, which quickly become outdated when systems receive updates. If you’ve ever tried to analyze a memory dump only…
-
Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files 2025-59536 –
y Aviv Donenfeld and Oded Vanunu Executive Summary Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. The vulnerabilities exploit various configuration mechanisms including Hooks, Model Context Protocol (MCP) servers, and environment variables -executing arbitrary shell commands…
-
The Coming Regulatory Wave for AI Agents Their APIs
Tags: access, ai, api, attack, ciso, compliance, control, corporate, data, endpoint, finance, framework, governance, guide, infrastructure, leak, monitoring, regulation, risk, toolFor the past two years, the adoption of Generative AI has felt like a gold rush. Organizations raced to integrate Large Language Models and build autonomous agents to assist employees. They often bypassed standard governance processes in the name of speed and innovation. That era of unrestricted experimentation is rapidly drawing to a close. A…
-
Russian group uses AI to exploit weakly-protected Fortinet firewalls, says Amazon
Tags: access, ai, api, attack, authentication, business, ciso, control, credentials, cybersecurity, data-breach, detection, exploit, firewall, fortinet, group, Internet, linkedin, malicious, mfa, monitoring, network, password, russia, software, threat, tool, vpn, vulnerabilityRecommendations: The Amazon report makes a number of recommendations to network admins with FortiGate devices. They include ensuring device management interfaces aren’t exposed to the internet, or, if they have to be, restricting access to known IP ranges and using a bastion host or out-of-band management network. As basic cybersecurity demands, all default and common…
-
NDSS 2025 Generating API Specifications For Bug Detection Via Specification Propagation Analysis
Session 13B: API Security Authors, Creators & Presenters: Miaoqian Lin (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Kai Chen (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Yi…
-
NDSS 2025 Generating API Parameter Security Rules With LLM For API Misuse Detection
Session 13B: API Security Authors, Creators & Presenters: Jinghua Liu (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Yi Yang (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Kai…
-
Cracks in the Bedrock: Bypassing SCP Enforcement with Long-Lived API Keys
Introduction Following the release of Amazon Bedrock Powered by AWS Mantle, I discovered a mechanism to bypass Service Control Policy (SCP) statements limiting the use of bedrock-mantle IAM permissions. By leveraging long-lived API keys backed by Service Specific Credentials, I was able to successfully leverage bedrock-mantle:CreateInference despite an SCP statement denying that action. SCPs are……
-
Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens
Cybersecurity researchers have disclosed what they say is an active “Shai-Hulud-like” supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft.The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code…
-
128M Users Exposed as Popular VS Code Extensions Reveal Critical Flaws
Serious vulnerabilities in four popular Visual Studio Code (VS Code) extensions, affecting over 128 million downloads. These flaws, including three assigned CVEs CVE-2025-65715, CVE-2025-65716, and CVE-2025-65717, highlight IDEs as the weakest link in organizational supply chain security. Developers often store sensitive data like API keys, business logic, database configs, and even customer info right in…
-
NDSS 2025 The Midas Touch: Triggering The Capability Of LLMs For RM-API Misuse Detection
Session 13B: API Security Authors, Creators & Presenters: Yi Yang (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Jinghua Liu (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Kai…