Tag: waf
-
Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-2026-111497
Cloudflare announced an emergency release of its Web Application Firewall (WAF) on October 25, 2026. This update introduces two detection rules for the Brotli vulnerability tracked as CVE-2026-111497. These rules specifically target requests that declare Brotli body encoding and traffic accessing the Next.js image optimization endpoint. By default, both rules are enabled in Log mode,…
-
Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws
Cloudflare has issued a warning about emerging attacks targeting two critical PHP vulnerabilities. In response, the company has implemented emergency web application firewall (WAF) rules while developers await an official security release. The PHP Foundation has provided advance notice, assigning both vulnerabilities a CVSS v4 score of 9.2, indicating the urgent need for affected environments…
-
Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM…
-
Hackers exploit SiteGuard WAF flaw to run commands as admins
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/
-
Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/
-
Armadin Targets Autonomous Remediation With $255.5M Series B
Company Plans to Extend Compensating Controls Across MDR and WAF Platforms. Armadin plans to use its $255.5 million Series B to expand autonomous remediation, emerging-threat intelligence and global sales, including AI-generated EDR and WAF controls designed to contain exploitable weaknesses while customers work on permanent fixes. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/armadin-targets-autonomous-remediation-2555m-series-b-a-33010
-
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently…
-
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently…
-
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently…
-
Shinyhunters starten neue Angriffswelle gegen Oracle-Peoplesoft
Tags: cve, cyberattack, cybercrime, firewall, google, group, intelligence, mandiant, oracle, threat, vulnerability, wafDie Cybercrime-Gruppe Shinyhunters hat ihre Angriffe auf Oracle-Peoplesoft deutlich ausgeweitet. Mandiant und die Google Threat Intelligence Group beobachten eine erneute massenhafte Ausnutzung der Schwachstelle CVE-2026-35273. Dabei umgehen die Angreifer vorhandene Web-Application-Firewalls (WAFs) und installieren Web-Shells sowie weitere Schadsoftware auf kompromittierten Systemen. Während die Schwachstelle zunächst vor allem gegen Einrichtungen aus dem Hochschulbereich eingesetzt wurde, hat…
-
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/
-
ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks
ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor. First seen on hackread.com Jump to article: hackread.com/shinyhunters-bypass-waf-rules-oracle-peoplesoft-attacks/
-
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally.The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.The vulnerability was first exploited as a zero-day First seen…
-
Imperva Customers Protected Against Novel HTTP Desync Attacks
TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently. Imperva Cloud WAF and On-Prem WAF customers are protected against practical attack patterns described in the research. Imperva’s existing security engine already blocked malicious……
-
Thales bringt Imperva WAF nativ auf Amazon CloudFront
Thales bringt Imperva WAF auf Amazon CloudFront. Die SaaS-Lösung schützt Webanwendungen, APIs und KI-Systeme vor Angriffen und bösartigen Bots. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/thales-bringt-imperva-waf-nativ-auf-amazon-cloudfront/a46039/
-
Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection
Salt Security has unveiled what it says is the industry’s first AWS WAF managed ruleset designed specifically to protect both APIs and AI agents, extending native AWS Web Application Firewall (WAF) capabilities to address emerging threats driven by agentic AI. Announced at Black Hat USA 2026, the new Salt Managed Rules for AWS WAF are…
-
Terra Security Adds Prevention Rules to Its Offensive Security Platform
Terra Security has launched Prevention, a capability that turns confirmed exploit findings into targeted Web Application Firewall or firewall rules while a permanent fix is still in progress. The feature is part of Terra Platform. When Terra confirms that a finding is exploitable, its AI agents test whether existing compensating controls stop that attack path……
-
Salt Debuts First AWS WAF Managed Ruleset for AI Agent and API Protection
Tags: access, ai, api, attack, ceo, credentials, detection, email, endpoint, exploit, intelligence, marketplace, threat, waf, xssThe WAF gap no one is talking about Your WAF is doing its job. It’s blocking SQLi, XSS, and the usual suspects. But here’s the problem: it wasn’t built for APIs, and it definitely wasn’t built for AI agents. APIs now power nearly every digital experience. And AI agents, the automated systems that access your…
-
PENTDEM AI Pentesting Daemon Uses 34 Security Tools to Automate WAF Bypass and Attack Chains
Tags: ai, attack, bug-bounty, cyber, firewall, LLM, open-source, penetration-testing, tool, vulnerability, wafPENTDEM is an open-source autonomous AI pentesting daemon that integrates 34 security tools with LLM-directed analysis to automate various tasks, including reconnaissance, vulnerability discovery, evidence validation, Web Application Firewall (WAF) fingerprinting, and multi-stage attack-path modeling. This Python-based project is designed for authorized security testing and bug-bounty workflows, offering both an autonomous agent mode and a…
-
ModSecurity Security Flaws Enable WAF Rule Evasion With Crafted HTTP Requests
ModSecurity, a widely used open-source web application firewall (WAF), has multiple security vulnerabilities that allow attackers to bypass detection with specially crafted HTTP requests. These vulnerabilities, identified as CVE-2026-52761 and CVE-2026-52747, affect ModSecurity versions up to 3.0.15. They have been addressed in version 3.0.16. These issues reveal significant inconsistencies in input transformation and request parsing,…
-
AWS Urges Organizations to Turn Outbound Blind Spots Into Monitored Checkpoints
When securing an Amazon Web Services (AWS) estate, teams naturally concentrate on inbound protections firewalls, WAFs, and IAM policies because those defenses stop the most visible attacks. Yet outbound traffic often remains under-monitored, left permissive to avoid breaking dependencies or to simplify operations. That default laxity creates a blind spot: without egress visibility and controls,…
-
AI agent finds 18-year-old remote code execution flaw in Nginx
Tags: ai, api, application-security, cve, cvss, data, dos, endpoint, exploit, flaw, github, leak, mitigation, network, open-source, remote-code-execution, risk, service, technology, update, vulnerability, wafngx_http_rewrite_module, a component that handles URL rewrites, and impacts Nginx versions from 0.6.27 to 1.30.0. The issue has been given a 9.2 CVSS severity score and was patched in versions 1.31.0 and 1.30.1.The commercial product, Nginx Plus, owned and developed by network and application security firm F5, is also vulnerable, and received patches in versions…
-
Webinar: What the Riskiest SOC Alerts Go Unanswered – and How Radiant Security Can Help
Why do the Riskiest SOC Alerts Go Unanswered?Security operations teams are drowning in alerts. But the real problem isn’t always alert volume; it’s the blind spots. The most dangerous alerts are the ones no one is investigating.A recent report from The Hacker News examined why certain high-risk alert categories – WAF, DLP, OT/IoT, dark web…
-
WAF Defense in Crisis? NSFOCUS Locks Down “Ghost Bits” Attacks in Advance
Incident Review In April 2026, Black Hat Asia 2026 disclosed a systematic security threat named Ghost Bits, targeting underlying encoding flaws in the Java ecosystem that can render mainstream WAF/IDS defenses completely ineffective. The core of this risk lies in inconsistent encoding interpretations of the same input between the security detection chain and the application……
-
Miggo Security Leverages AI to Apply Virtual Patches in Near Real Time
Miggo Pulse allows teams to apply virtual patches in near real-time, reducing reliance on developer cycles and third-party maintainers. By combining WAF rules with runtime ADR capabilities, the platform identifies reachable code paths and automates mitigation against evolving AI-driven attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/miggo-security-leverages-ai-to-apply-virtual-patches-in-near-real-time/
-
ISOP’s Integration with NSFOCUS Devices
Tags: wafISOP device management can display information about the underlying NSFOCUS devices that are connected to the interface. The NSFOCUS devices that can be integrated include RSAS, BVS, WVSS, WSM, NIPS, WAF, NF, NIDS, NTA, SAS, and UTS. The displayed information includes device name, device IP address, device type, status, version, certificate status, memory, CPU, disk,……
-
DDoS Testing vs Protection: The Missing Layer in Your Defense
Key takeaways DDoS protection refers to the tools and architecture deployed to stop attacks (CDNs, WAFs, scrubbing centers, firewall rules) operating continuously in the traffic path DDoS testing is a controlled simulation that validates whether those tools actually work under real-world attack conditions 68% of protection faults found in Red Button simulations were rated… First…
-
Technology-Innovation-Leadership 2026 Auszeichnung für Check Point für seine WAF- und API-Sicherheitslösungen
Check Point Software Technologies gibt bekannt, dass das Unternehmen für seine Fortschritte im Bereich des Schutzes von Webanwendungen und APIs (WAAP) mit der Auszeichnung ‘Technology Innovation Leadership 2026″ von Frost & Sullivan geehrt wurde. Die neue Auszeichnung verdeutlicht, wie Check Points Strategie, bei der Prävention an erster Stelle steht, sowie die Beiträge des Unternehmens zur…
-
Progress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876)
Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/22/progress-waf-bypass-cve-2026-21876/
-
Curity looks to reinvent IAM with runtime authorization for AI agents
Multiple approaches to agent security: Today, agent security falls into one of several camps, which include increasingly inadequate inline approaches such as API gateways and web application firewalls (WAFs), and out-of-band analysis systems that infer intent by analyzing agent behavior against a baseline.Curity’s Access Intelligence, by contrast, is a self-hosted microservice that acts as a…