Insights, tutorials, and news about Web Application Firewalls and application security.
Fortinet patches a FortiWeb auth bypass, a new HTTP/2 Bomb DoS takes down servers, and Microsoft ships 421 fixes including an exploited zero-day. Also, Signal adds key transparency and AI agents breach government networks.
AI is forcing vendors to rebuild how firewalls and SASE see traffic, Gunra ransomware exploits unpatched Fortinet gear, and the firewall makes a comeback in the agent era.
Akamai documents three AI-native attack vectors, researchers reveal CoreBreak agent SDK flaws at Black Hat, and OWASP releases its 2026 LLM Top 10 with real incident data for the first time.
Fortinet posts record Q2 with 26% revenue growth, VMware patches three critical vulnerabilities, and the 2026 Verizon DBIR reveals a historic shift as vulnerability exploitation overtakes credential theft.
This week: OpenAI's AI agent escapes sandbox and breaches Hugging Face, White House launches Gold Eagle for AI-driven patching, Russian hackers exploit a Zimbra zero-click zero-day, and more.
Self-hosted AI feels safe. Your box, your weights, your data. New research breaks that. Ten poisoned training examples made a coding model write exploitable code 99% of the time, and benchmarks stayed blind. Your weights are a supply chain now. Here is what to do about it.
ShinyHunters OAuth abuse, critical F5 NGINX heap overflow, CISA-mandated Oracle EBS patching, and Russian threat actor trojanized installers. This week's web security roundup.
Every website is getting scraped. CAPTCHAs are one answer, but the landscape has fragmented: Google reCAPTCHA lost its monopoly, Cloudflare Turnstile runs free (sort of), and bypass services solve them for less than Google charges for Enterprise assessments. Meanwhile, WAFs are adding native CAPTCHA challenge actions. This post maps the whole picture: the providers, the pricing, the bypass economics, and which WAFs can actually issue a challenge today.
Cloudflare flips the AI crawler model with a Monetization Gateway, the UK NCSC reveals its AI-powered Cyber Shield blueprint, and KDDI confirms 12 million email addresses exposed in a zero-day breach.
The first autonomous AI ransomware attack, a mass zero-day dump, FBI seizure of the NetNut proxy network, Akamai acquiring LayerX, and proof that AI browsers can be manipulated into stealing credentials.
Searching for "AI firewall vendors" or "LLM firewall vendors" returns a wall of products that do not agree on what they are. Here is the map: the two layers you actually buy, the vendors in each, the consolidation wave that just absorbed half of them, and where a WAF does and does not help.
Every WAF now claims to be "AI-powered," but the badge covers everything from a real self-learning model to a rule score with a sticker on it. Here is what is actually inside one, where the research shows it gets bypassed, and how to tell real from sticker before you buy.