Tag: api
-
NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
The National Institute of Standards and Technology (NIST) has published new implementation guidance to safeguard identity tokens, access tokens, and assertions used in single sign-on, cloud federation, and application programming interface (API) environments. Released on September 15, 2026, NIST Internal Report 8587, titled >>Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for…
-
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.”JWT…
-
SaaS API Security Incidents: What 2026 Breach Data Shows
Key TakeawaysAn analysis of 60 disclosed API breaches in 2025 found broken authentication caused 52 percent of incidents, with unsafe consumption of third party APIs accounting for another 27 percent.SaaS companies accounted for 8 percent of breaches in that same… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/saas-api-security-incidents-what-2026-breach-data-shows/
-
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress has announced it’s launching an automated security review for every release of a plugin before it’s distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved.”New plugins are reviewed before they enter the directory, but updates ship continuously after that,” David Perez,…
-
What is API Penetration Testing?
If your business uses any app or third-party integration, then chances are it’s held together by APIs. APIs, in a nutshell, are the invisible connections that allow your systems to talk to one another by transferring data. They have become… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-is-api-penetration-testing/
-
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read Exploited Within 24 Hours
CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September 10, 2026, a path traversal vulnerability in its repository commits API. CVE-2026-85706 affects GitLab’s repository commits API and can let attackers access files they should not see. A crafted request…
-
OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE
A swarm of AI agents believed to be operated internally by OpenAI uploaded more than 2,000 malicious packages to RubyGems in May 2026, abusing the ecosystem’s documentation build process to execute code remotely and attempting to steal user API keys through a then-undisclosed server-side flaw. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said…
-
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under…
-
US Accuses Six Chinese AI Firms of Distilling Frontier ModelsUS Accuses Six Chinese AI Firms of Distilling Frontier Models
US agencies accuse six Chinese AI firms of distilling frontier models and recommend new defenses that could affect enterprise AI access and API use. The post US Accuses Six Chinese AI Firms of Distilling Frontier ModelsUS Accuses Six Chinese AI Firms of Distilling Frontier Models appeared first on TechRepublic. First seen on techrepublic.com Jump to…
-
US Accuses Six Chinese AI Firms of Distilling Frontier ModelsUS Accuses Six Chinese AI Firms of Distilling Frontier Models
US agencies accuse six Chinese AI firms of distilling frontier models and recommend new defenses that could affect enterprise AI access and API use. The post US Accuses Six Chinese AI Firms of Distilling Frontier ModelsUS Accuses Six Chinese AI Firms of Distilling Frontier Models appeared first on TechRepublic. First seen on techrepublic.com Jump to…
-
Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data
Threat actors are leveraging Microsoft’s Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/voice-callers-exploit-byod-microsoft-365-corporate-data
-
The EU AI Act for the Downstream Provider: What You Owe When You Just Call an API
Most founders building on someone else’s model believe the EU AI Act is the model provider’s problem. That belief is wrong in a specific and expensive way, and the part that trips people up is not the part they expect…. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/the-eu-ai-act-for-the-downstream-provider-what-you-owe-when-you-just-call-an-api/
-
Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data
An exposed Vietnam-linked APIS database contained 220.8 million passenger and crew records, including passport and flight data. Researchers found an exposed Advance Passenger Information System (APIS) database containing 220.8 million passenger and crew records from January 2017 to April 2026. The data includes sensitive details such as passport numbers, identities and flight information, potentially affecting…
-
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim’s browser session. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/clickfix-moves-into-the-browser/
-
220 million traveler records exposed in Vietnam-linked APIS leak
Exclusive: An exposed Advance Passenger Information System (APIS) database held 220 million passenger and crew records containing names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. Researchers accessed the Vietnam-linked system through a cloud-based path using default credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/
-
Authentication Challenges in AI-Powered Applications and How to Solve Them
AI-powered applications are no longer simple request-response tools. They orchestrate long-running agents, call external APIs on a user’s behalf, retain conversational memory, and increasingly act autonomously across systems. That shift changes what “authentication” even means. Verifying a human at login… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/authentication-challenges-in-ai-powered-applications-and-how-to-solve-them/
-
APIs Are the Attack Surface That Matters in AI-Powered Apps FireTail Blog
Sep 07, 2026 – Jeremy Snyder – Recently, I had the opportunity to speak on the main stage at the combined API:World, AI TechWorld and CloudX event in Santa Clara. I wanted to share my thoughts on what I presented,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/apis-are-the-attack-surface-that-matters-in-ai-powered-apps-firetail-blog/
-
Sichtbarkeit und Kontrolle für KI, APIs und Anwendungen – Mehr Cyberresilienz in Hybrid- und MultiUmgebungen
First seen on security-insider.de Jump to article: www.security-insider.de/cyberresilienz-hybrid-multi-cloud-a-92b4ab465d4faf9a39538119fbbfc5f5/
-
What Are the Main Types of AI Gateways? LLM, MCP, and Agent Gateways Explained
Gateways have long marked important boundaries in computing.Network gateways connected systems that used different protocols. Secure web gateways inspected traffic moving between employees and the internet.And API gateways gave organizations a central point for routing service requests, authenticating clients, applying… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-are-the-main-types-of-ai-gateways-llm-mcp-and-agent-gateways-explained/
-
SSOJet API Error Codes: A Developer Reference (and What Not to Retry)
Tags: apiEvery SSOJet API error returns the same three fields, a stable error string, a human-readable error_description, and a numeric error_code, and there are 148 documented codes across seven domains. This is the reference for handling them in code:… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/ssojet-api-error-codes-a-developer-reference-and-what-not-to-retry/
-
AI safety organization METR reports API key theft and credit misuse
First seen on scworld.com Jump to article: www.scworld.com/brief/ai-safety-organization-metr-reports-api-key-theft-and-credit-misuse
-
Hackers Steal Metr API Key, Burn $600K in AI Credits
Separate Database Flaw Could Have Exposed Sensitive Model Data. Attackers in March stole a Metr API key and used it for three weeks to consume about $600,000 worth of AI model credits. In a separate May campaign, hackers probed a public Metr service with a bug that could have exposed unpublished and sensitive model data.…
-
API-first DCIM: Reduce Integration Friction and Keep Control Across Tools
Disconnected tools slow your operations down more than missing data ever could. Every day, teams waste hours stitching together systems that don’t naturally talk to each other. API-first DCIM cuts through that drag, turning scattered signals into one clear operational… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/api-first-dcim-reduce-integration-friction-and-keep-control-across-tools/
-
What a 14-Day Federal Patch Clock Costs a Team That Isn’t a Federal Agency
(MLflow, CVE-2026-64849, August 2026)By Pablo Bleck, Engineering Manager & Software Engineer, ActiveStateMLflow shipped its webhook API open by default across a platform with more than 30 million monthly downloads, and a CISA listing turned that unauthenticated endpoint into a 14-day… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-a-14-day-federal-patch-clock-costs-a-team-that-isnt-a-federal-agency/
-
Claude AI Develops Working RCE Exploit Against WAGO PLC With Researcher Assistance
Researchers have demonstrated that Anthropic’s Claude AI can assist in porting a remote code execution exploit between vulnerable models of WAGO programmable logic controllers (PLCs). However, this process requires significant human guidance, lengthy analysis sessions, and more than $500 in API usage. The experiment focused on CVE-2021-31886, a pre-authentication buffer overflow flaw in the Nucleus…
-
Hackers Exploit LiteLLM Admin API Flaw to Turn Read-Only Access Into Full Server Takeover
Attackers are actively exploiting a critical authorization flaw in LiteLLM’s administrative API. This vulnerability allows low-privileged, read-only users to modify proxy configurations, expose sensitive secrets, and potentially gain full administrator control over affected servers. Researchers at Zenity Labs tracked approximately 3,900 requests targeting LiteLLM’s administration endpoints from February to June 2026, originating from 73 different…
-
Hackers Hide Reverse Shell Traffic Behind Signed Apps and AWS API Gateway
Threat actors are using a layered fake IT-support campaign to obtain remote access, deploy a malicious MSI package and conceal hands-on-keyboard activity behind legitimate signed applications and AWS API Gateway infrastructure. The operation demonstrates how attackers can divide execution, command-and-control and interactive shell functions across multiple processes to frustrate conventional endpoint and network detections. Once…
-
9 Enterprise Identity Trends That Will Define 2026 and Beyond
Trend 1: Agentic Identity Becomes a First-Class Citizen in IAM AI agents are already operating in production environments. They read emails, write code, query databases, post to Slack, file tickets, and call APIs across dozens of enterprise systems. Their identity… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/9-enterprise-identity-trends-that-will-define-2026-and-beyond-2/
-
Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira
Sift is a free, open-source command line tool that searches for passwords, API keys, and other sensitive data across the places a company keeps its work: local disks, Windows … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/02/sift-open-source-secret-scanning/