APIs used to be the quiet backstage crew that made apps feel magical. Now attackers have learned the script — they walk onstage, deliver perfectly polite lines, and walk off with the props. In H1 2025 Imperva observed 40,000+ API…
Category: Blog
Google Pay, Drug Bots, and SIM Swaps: How Old Leaks and New Vulnerabilities Power Attacks
It starts with something simple: a CAPTCHA box on your screen. You type the number you see, because of course you do. That’s what humans do online. But what if that “CAPTCHA” wasn’t a CAPTCHA at all? In this post,…
Operation Eastwood: Measuring the Real Impact on NoName057(16)
Introduction On July 16, 2025, Europol revealed the details of Operation Eastwood, a coordinated international strike against one of the most active pro-Russian cybercrime groups, NoName057(016). The announcement promised a major disruption to the group’s activities. In this blog, we…
The Hidden Threat: How Sensitive Information Leakage Puts Your Business at Risk
You Don’t Know What You Don’t Know – And That’s the Problem Picture this: Your development team has built a robust e-commerce platform. Your security team has implemented comprehensive protection measures. Your compliance team has checked all the boxes. Yet…
Imperva API Security: Authentication Risk Report—Key Findings & Fixes
An in-depth analysis of common JSON Web Token (JWT) mistakes, basic auth, long-lived tokens, and quick, high-impact fixes to secure your APIs. Introduction APIs are the backbone of modern digital services—from mobile apps and e-commerce to banking and IoT. That…
When You’re Always Under #DDoS Attack
We recently mitigated a 1.55 terabit per second (Tbps), DDoS attack for a steady customer of ours. This particular customer is a reputable domain name service (DNS) provider. I’ve personally used them for over a decade to register domains for…
Why Separating Control and Data Planes Matters in Application Security
Modern application environments are dynamic, distributed, and moving faster than ever. DevOps teams deploy new services daily, APIs multiply across regions, and traffic fluctuates by the hour. At the same time, organizations must uphold security, compliance, and availability without slowing…
Why Separating Control and Data Planes Matters in Application Security
Modern application environments are dynamic, distributed, and moving faster than ever. DevOps teams deploy new services daily, APIs multiply across regions, and traffic fluctuates by the hour. At the same time, organizations must uphold security, compliance, and availability without slowing…
Critical Flaws in Base44 Exposed Sensitive Data and Allowed Account Takeovers
Our research uncovered multiple critical vulnerabilities in Base44, an AI-powered platform that lets you turn any idea into a fully functional custom app. These flaws ranged from an open redirect that leaked access tokens, to stored cross-site scripting (XSS), insecure…
Marginal Emissions Rates: See Carbon Emissions with Clarity in Real Time
Learn how Akamai is using marginal emissions rates to improve the transparency and accuracy of our emissions accounting. This article has been indexed from Blog Read the original article: Marginal Emissions Rates: See Carbon Emissions with Clarity in Real Time
A New Way to Manage Property Configurations: Dynamic Rule Updates
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Blog Read the original article: A New Way to Manage Property Configurations: Dynamic Rule Updates
Smuggling Requests with Chunked Extensions: A New HTTP Desync Trick
A new HTTP request smuggling technique was recently discovered, where attackers take advantage of inconsistent parsing behaviors between front-end proxy servers and back-end application servers. This attack technique leverages ambiguous request formatting to inject malicious secondary requests that appear after…
Stop LLM Attacks: How Security Helps AI Apps Achieve Their ROI
AI security is a business problem. Protect your LLM application investment and ROI by connecting your security team with business stakeholders. This article has been indexed from Blog Read the original article: Stop LLM Attacks: How Security Helps AI Apps…
Akamai Beats Other WAAP Vendors in Third-Party Evaluation
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Blog Read the original article: Akamai Beats Other WAAP Vendors in Third-Party Evaluation
QUIC-LEAK (CVE-2025-54939): New High-Risk Pre-Handshake Remote Denial of Service in LSQUIC QUIC Implementation
Imperva Offensive team discovered that threat actors could smuggle malformed packets to exhaust memory and crash QUIC servers even before a connection handshake is established, therefore, bypassing QUIC connection-level safeguards. Executive Summary QUIC-LEAK (CVE-2025-54939) is a newly discovered pre-handshake memory…
Accelerating Secure Enterprise Kubernetes Adoption
Learn how LKE-E solves critical problems while providing streamlined adoption, operational simplicity, and cost efficiency at scale. This article has been indexed from Blog Read the original article: Accelerating Secure Enterprise Kubernetes Adoption
Akamai Named an Overall Leader for API Security by KuppingerCole
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Blog Read the original article: Akamai Named an Overall Leader for API Security by KuppingerCole
The Reality of Modern Cyberattacks: Lessons from Recent Retail Breaches
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Blog Read the original article: The Reality of Modern Cyberattacks: Lessons from Recent Retail Breaches
Akamai and Bitmovin: Revolutionizing Live and On-Demand Video Streaming
Discover how Akamai and Bitmovin?s partnership reduces costs, enhances performance, and delivers personalized video experiences to content providers. This article has been indexed from Blog Read the original article: Akamai and Bitmovin: Revolutionizing Live and On-Demand Video Streaming
MadeYouReset: Turning HTTP/2 Server Against Itself
Introduction HTTP/2 was designed for performance- faster multiplexed connections, stream prioritization, and header compression. But these same features have also opened the door for sophisticated denial-of-service attacks. Back in 2023, the HTTP/2 Rapid Reset vulnerability made headlines after attackers exploited…