Insights, tutorials, and news about Web Application Firewalls and application security.
ShinyHunters OAuth abuse, critical F5 NGINX heap overflow, CISA-mandated Oracle EBS patching, and Russian threat actor trojanized installers. This week's web security roundup.
Every website is getting scraped. CAPTCHAs are one answer, but the landscape has fragmented: Google reCAPTCHA lost its monopoly, Cloudflare Turnstile runs free (sort of), and bypass services solve them for less than Google charges for Enterprise assessments. Meanwhile, WAFs are adding native CAPTCHA challenge actions. This post maps the whole picture: the providers, the pricing, the bypass economics, and which WAFs can actually issue a challenge today.
Cloudflare flips the AI crawler model with a Monetization Gateway, the UK NCSC reveals its AI-powered Cyber Shield blueprint, and KDDI confirms 12 million email addresses exposed in a zero-day breach.
The first autonomous AI ransomware attack, a mass zero-day dump, FBI seizure of the NetNut proxy network, Akamai acquiring LayerX, and proof that AI browsers can be manipulated into stealing credentials.
Searching for "AI firewall vendors" or "LLM firewall vendors" returns a wall of products that do not agree on what they are. Here is the map: the two layers you actually buy, the vendors in each, the consolidation wave that just absorbed half of them, and where a WAF does and does not help.
Every WAF now claims to be "AI-powered," but the badge covers everything from a real self-learning model to a rule score with a sticker on it. Here is what is actually inside one, where the research shows it gets bypassed, and how to tell real from sticker before you buy.
Cisco's 7th SD-WAN zero-day of 2026 exploited for months before disclosure. Ubiquiti UniFi OS criticals under active attack. FFmpeg PixelSmash bug threatens cloud infrastructure. Plus curl patches a 25-year-old vulnerability.
Run the model yourself and you inherit a server, one that ships wide open. A data-backed tour of exposed inference endpoints, KV-cache prompt leaks, and backdoored weights, plus SEAL, four rules for locking the box down.
The model is not a security boundary, and no prompt will make it one. A data-backed look at why prompt-level defenses leak, what actually drives attack success rates toward zero, and the five-rule CLAMP framework you can ship this week.
FortiBleed exposes 75K Fortinet firewall credentials. F5 patches critical NGINX RCE flaws. Popa botnet traced to NASDAQ-listed proxy firm. Plus Cloudflare AI agent tools for SASE.
F5 launches neural-network WAF for behavioral detection. Ivanti Sentry CVSS 10.0 flaw exploited within 24 hours. ShinyHunters breach 100+ orgs via Oracle PeopleSoft zero-day. Palo Alto patches rogue VPN flaw. Microsoft fixes 200 flaws including 6 zero-days.
AI-discovered HTTP/2 Bomb exploit downs servers in seconds. Magento cache warmer flaw hits CISA KEV. WordPress eval() RCE under active exploitation. Gartner SRM pivots to resilience. Fortinet and Palo Alto ride AI security wave.