Zoutje is WAFplanet's AI news curator, built to keep you informed about the fast-moving world of web application firewalls. From vendor announcements and vulnerability disclosures to regulatory changes and market shifts, Zoutje scans hundreds of sources daily to surface the stories that matter.
All news articles are fact-checked and reviewed by the WAFplanet editorial team before publication.
Brute-force activity, fast-moving ransomware and new phishing techniques identified in latest Managed XDR analysis Barracuda ...
Fastly, Inc. (NASDAQ:FSLY) was among Jim Cramer’s stock calls, as he discussed the rising market speculation. During the ...
A record 31.4 Tbps DDoS attack in late 2025 proved that yesterday's worst-case scenario is now the baseline. Testing platforms are stepping up to match.
Europol sends warning emails to 75,000 suspected DDoS-for-hire customers as Operation PowerOFF takes down 53 domains and arrests four. The crackdown highlights the growing DDoS threat and why proper mitigation matters.
Cloudflare expands its Agent Cloud with Dynamic Workers, sandboxed environments, and OpenAI model support. The platform aims to become the default runtime for AI agents, but the security implications of millions of autonomous code-executing agents deserve more attention.
Critical SAP, Adobe, Fortinet, and Microsoft flaws disclosed in April Patch Tuesday, enabling RCE and data theft risks.
Security researchers have detected a “sharp rise” in brute-force attempts to hijack SonicWall and Fortinet devices, with the ...
Cloudflare, Inc. (NYSE: NET), the leading connectivity cloud company, today announced Cloudflare Mesh, the first private ...
Akamai bolsters API security offering By Chris Tredger, Technology Portals editor, ITWebJohannesburg, 14 Apr 2026API or Application Programming Interface is a critical component within digital ...
A Cloud Security Alliance (CSA) paper warns of an "AI vulnerability storm" triggered by the introduction of Anthropic's ...
Shares of cloud security and performance company Cloudflare (NYSE:NET) jumped 8.3% in the morning session after investors ...
Objective Development releases Little Snitch for Linux, built in Rust with eBPF. A web-based network monitor that shows which processes phone home, now available for Intel, ARM64, and RISC-V Linux systems.
Cloudflare stock surged 8% as investors bet on AI agent traffic driving edge network demand. Q4 revenue hit $614.5M with 33.6% growth. CEO Matthew Prince says AI agents are the new web users and Cloudflare is the network they pass through.
Akamai Technologies experienced a sharp sell-off after Anthropic launched Claude Managed Agents. Find out why AKAM stock is a ...
CVE-2026-35616 (CVSS 9.1) exploited since March 31, 2026, affects FortiClient EMS 7.4.5-7.4.6, enabling privilege escalation via pre-authentication API access bypass.
A ClickFix clipboard hijacker is running on a US DoD cybersecurity vendor's own WordPress homepage. The attacker injects a script that overwrites the clipboard and shows a fake verification overlay. Two WordPress sites were hit within 24 hours using the same attack infrastructure.
Fastly achieved its first non-GAAP profitable year in FY2025, with $624M revenue and strong 15% YoY growth. Read why we rate ...
Of all the companies, Cloudflare Inc.'s stock plunged the lowest, down nearly 12%, to around $186. Zscaler's stock also saw a ...
New research and industry timelines are accelerating efforts to replace cryptography that quantum computers could eventually ...
Masjesu is a commercially operated IoT botnet active since 2023, offering DDoS-for-hire services via Telegram and targeting routers and embedded devices worldwide.
Anthropic's Claude Mythos Preview found thousands of zero-days in every major OS and web browser, many critical, some surviving decades of human review. Project Glasswing launches with Apple, Amazon, Google, Microsoft, CrowdStrike to deploy the model defensively. But when these findings inevitably leak, expect an AI-driven wave of exploits. Time to verify your WAF is actually in place.
Fortinet warns of a critical FortiClient EMS zero-day vulnerability that is currently being exploited, allowing attackers to ...
Phishing surge, LinkedIn tracking claims, spyware use, and rising stealers expose growing abuse of trusted systems.
Dr. Tom Leighton, Co-founder and CEO of Akamai, envisions a web that is distributed, agent-driven, and edge-powered—and warns that AI's expanding threat landscape could reshape the internet within a decade.
That framing drew a sharp rebuttal from WordPress co-founder and Automattic chief executive Matt Mullenweg, who argued that EmDash is not truly in WordPress’s tradition because WordPress can run ...
Forbes argues WAFs are broken because security teams are afraid to touch the rules. Huskeys launches with $8M to build a control plane on top of existing WAF infrastructure. The management layer is the real problem, not the firewalls themselves.
Cloudflare's inaugural 2026 Threat Report reveals attackers are shifting from breaking in to logging in. AI lowers the barrier for sophisticated attacks, DDoS hits 31.4 Tbps, and nation-state actors pre-position inside critical infrastructure. 230 billion threats blocked daily.
Cloudflare released EmDash, an open-source CMS with sandboxed plugin security. The architecture is solid, but the ecosystem gap with WordPress is vast. The real impact may be pushing WordPress toward better plugin isolation.
Sucuri disclosed a DDoS attack targeting its Paris region infrastructure on April 2. The attack disrupted at least one media publisher. Sucuri contained the incident within 45 minutes, but attribution remains unknown.
Huskeys exits stealth with $8M seed funding for an agentic AI platform that sits on top of existing WAFs. The thesis: WAF enforcement works, but nobody can manage the rules at scale. Early customers include TikTok and Hugging Face.
DDoS attacks surged 150% in H2 2025. Gcore reports 1.3 million attacks in Q4 alone. Cloudflare mitigated 47.1 million over the year, peaking at 31.4 Tbps. Attack durations under 60 seconds make manual response useless.
AI labs are pushing into application security, but three structural barriers keep them out of runtime protection, proprietary threat intelligence, and SOC workflows. WAFs are safe for now. Here is what RSAC 2026 revealed.
Cloudflare, AMD, and WebPros collaborate to build an AI hosting stack, combining cloud infrastructure, processors, and hosting tools for scalable AI deployment.
SecureIQLab today announced that its SOCx AI-Driven Cloud Security Validation Platform has integrated AI Security CyberRisk Validation as its fourth active methodology, joining Advanced Cloud Firewalls (ACFW),
Palo Alto Networks patches CVE-2026-0227, a high-severity DoS flaw in PAN-OS that lets unauthenticated attackers push firewalls into maintenance mode. Nearly 6,000 devices are exposed online.
Gartner formalized the hybrid mesh firewall category in 2025. Check Point, Fortinet, and Cisco are the three vendors leading the space. Here is how they compare and what it means for WAF buyers.
HAProxy Technologies has launched HAProxy Fusion 2.0 and HAProxy Unified Gateway 1.0 at KubeCon Amsterdam. Fusion 2.0 introduces centralized security policy management with Security Profiles, a visual Threat-Response Matrix, and a unified security control plane for WAF, bot management, and DDoS protection. Built on HAProxy Enterprise 3.2 LTS, it includes native Kubernetes deployment via a new Oper
SecureIQLab has published the first independent methodology for validating AI security solutions, spanning 32 validation scenarios across three security layers. Up to 20 vendors are considered for validation, spanning pure-play LLM firewalls, broader AI security solutions, and API security and edge platforms offering LLM protection. The methodology measures both prevention and detection, penalizin
HPE expands its hybrid mesh firewall platform with AI visibility controls, keyword filtering for AI tools, and the new SRX440 appliance. Announced at RSAC 2026, all features ship in Q2.
Radware spin-off Skyhawk Security now maps AI-driven cloud attack simulations to five named adversary groups including Scattered Spider and APT29, helping teams prioritize defenses based on actual threats.
CISA gives federal agencies three days to patch CVE-2026-20131, a CVSS 10 RCE flaw in Cisco Secure Firewall Management Center already exploited by Interlock ransomware since January.
Cloudflare launches Dynamic Workers in open beta, an isolate-based sandbox for AI agent code that starts 100x faster than containers. The security implications for edge WAF providers are significant.
At RSAC 2026, hot new cybersecurity tools were announced Monday by vendors including Palo Alto Networks, CrowdStrike, Cisco and Arctic Wolf.
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability, CVE-2026-20131, in Cisco Secure Firewall Management Center (FMC) by Sunday,
Sansec discloses PolyShell, a critical Magento REST API flaw that lets unauthenticated attackers upload malicious files for RCE and account takeover. All versions up to 2.4.9-alpha2 are affected.
Cloudflare makes AI Security for Apps generally available, adding LLM threat detection to its WAF. AI endpoint discovery is now free for all plans, giving teams visibility into shadow AI deployments.
Cloudflare CEO Matthew Prince predicts AI bot traffic will surpass human traffic online by 2027. The shift has major implications for WAF operators and bot management strategies.
The U.S. DoJ disrupted four IoT botnets that infected 3 million devices and launched record-breaking 30 Tbps DDoS attacks. Akamai, Cloudflare and other tech firms assisted the takedown.
AWS reveals that the Interlock ransomware group has been exploiting a critical Cisco firewall zero-day (CVE-2026-20131) since January. The CVSS 10 flaw allows unauthenticated remote code execution as root.
Cloud misconfigurations remain one of the biggest preventable security risks in 2026. Open storage buckets, overly permissive IAM roles, and default credentials keep causing breaches that cost billions.
HAProxy earns 78 badges including 25 Leader positions in G2 Spring 2026 Grid Reports, maintaining a perfect satisfaction score across WAF, DDoS Protection, and Bot Detection categories.
AWS researchers reveal the Interlock ransomware group exploited a maximum-severity Cisco firewall flaw for over five weeks before Cisco disclosed the vulnerability.
Red Access, the agentless platform built to simplify security across all browsers, is introducing a firewall-native SSE, an agentless cloud layer that instantly upgrades any existing firewall with modern Security Service Edge (SSE),
New approach to application security in production at 11 companies analyzes code behavior at runtime rather than relying on CVEs or external defenses. PALO ALTO, Calif., March 18, ...
Every year, security vendors publish threat reports. Most say variations of the same thing. But Barracuda’s Managed XDR Global Threat Report stands out for a reason that matters to MSPs: it’s built on ...
F5 announced major updates to its Application Delivery and Security Platform at AppWorld, including a new observability tool, post-quantum cryptography for BIG-IP WAF, and agentic AI support for NGINX.
SentinelOne’s Singularity AI SIEM integrates Cloudflare Logpush telemetry to strengthen enterprise security posture ...
Cloudflare Inc. (NYSE:NET) operates as a cloud services provider that delivers a range of services to businesses worldwide.
We pointed an AI agent at the actual OWASP Core Rule Set regex patterns and let it find bypasses, fix them, and reduce false positives. 20 experiments, 20 kept, 0 discarded. TPR went from 55.8% to 100%, FPR dropped from 29.7% to 4.8%.
IO River leverages WebAssembly to decouple WAF engines from CDN providers, starting with Check Point on Akamai. The goal: run your preferred WAF everywhere without vendor lock-in.
F5 CEO Francois Locoh-Donou argues that AI workloads are making hybrid multi-cloud even more complex, pushing enterprises toward consolidated delivery and security platforms.
Starting from stock OWASP CRS defaults, an AI agent improved balanced accuracy from 86.7% to 96.7% on CRS v3.3.8, and from 80.8% to 98.4% on CRS v4.24.0, running 30 experiments over 7 hours. Full methodology, results, and downloadable configs.
F5 rolls out AI-powered WAF risk scoring, automated AI vulnerability remediation, bot defense for agentic AI, and post-quantum cryptography readiness across its ADSP platform.
Red Access launches agentless SSE that layers on top of existing firewalls from Palo Alto, Fortinet, Cisco, and Check Point. Deployment in hours, not months.
User-driven recognition highlights HAProxy’s leadership in Load Balancing, WAF, and DDoS Protection for scaling modern ...
Red Access, the agentless platform built to simplify security across all browsers, GenAI, SaaS and corporate apps, today announced Firewall-Native SSE, an agentless cloud layer that instantly upgrades any existing firewall with modern Security Service Edge (SSE),
Radware's new Alteon Protect separates cloud-based threat detection from on-device enforcement, letting organizations add WAF, bot, API, and DDoS protection to existing ADC infrastructure without rerouting traffic or sharing SSL certificates.
Critical CVE-2026-1492 in WPEverest's User Registration plugin (60K+ sites) lets attackers create admin accounts without authentication. Wordfence blocked 200+ attacks in 24 hours. Patch to 5.1.4 now.
Akamai is projecting 45-50% cloud growth in 2026 and pushing hard into AI inference with NVIDIA GPUs. The security business that built this company is now "Act 2" in a three-act strategy. What does that mean for WAF customers?
Sansec open-sources Yargo, a pure Go YARA engine optimized for web source code. 6.8x faster than go-yara, processing 57K scans/day in production. MIT licensed.
Ukrainian telecom Datagroup partners with Akamai to offer pay-as-you-go cloud WAF to small and medium businesses, lowering the barrier to enterprise-grade web application protection in a high-threat market.
SafeLine, a self-hosted open-source WAF, targets SaaS bot abuse with semantic traffic analysis and 99.45% claimed detection accuracy. A viable option for teams that need full control over traffic inspection.
Cisco patches two CVSS 10.0 flaws in Secure Firewall Management Center. Both allow unauthenticated remote attackers to gain root access. Fourth max-severity firewall flaw in 8 months.
Team Cymru links CyberStrikeAI, an open-source AI attack platform, to the threat actor who breached 500+ FortiGate firewalls. The tool automates scanning, exploitation, and post-exploitation using AI orchestration.
