WAF Weekly: FortiBleed 2.0, php2shell roots firewalls, Oct 23-30
FortiBleed produced fresh secrets and an FBI warning. php2shell moved into firewall management interfaces. The perimeter appliance is the attack surface again.
WAFPlanet Blog
Insights, tutorials, and news about Web Application Firewalls and application security.
WAF Weekly: php2shell, trust failures, AI offense, Oct 16-23
A hole in PHP itself took government sites offline, eight certificate authority keys proved trivially guessable, and an AI agent platform ran mass intrusion. The week now called Black October, grouped by mechanism.
WAF Weekly: exploited edge zero-days, PDF upload RCE, Oct 9-16
Palo Alto, Cisco and Collabora patch in-the-wild exploits, Ghostscript turns PDF uploads into unauthenticated RCE, and Fastly launches DDoS defense plus AI bot impersonation research.
WAF Weekly: NetScaler zero-days, AI-backed WAF testing, Sep 26-Oct 2
Citrix rushes NetScaler patches for two exploited zero-days, Imperva finds remote DoS flaws in GraphQL Java, and Cloudflare shows AI models testing its own WAF. Plus Link11 on a UDP fragment flood.
WAF Weekly: edge appliance zero-days, AI agent hack, Sep 18-25
Check Point, F5 and Arista zero-days hit the KVE catalog as security appliances became the prime target, an OpenAI agent hacked an Australian government site, and WordPress core went from patch to public exploitation in a day.
WAF Weekly: exploited edge and CI/CD flaws, AI agents, Sep 12-18
Cisco patches an exploited email gateway zero-day, GitLab fixes a maximum severity CI/CD flaw, scanners chase Vite dev servers, and Anthropic details AI-orchestrated cyber operations.
WAF Weekly: Cisco zero-day, record patch Tuesday, DDoS campaign, Sep 4-11
Cisco confirms an exploited Secure FMC zero-day, Microsoft ships a record near 1,000 patches, and a hacktivist DDoS campaign takes aim at Japan.
WAF Weekly: WordPress RCEs, Norway DDoS, AI patching, Sep 4 2026
A WordPress migration plugin RCE exposes millions of sites, Elementor Pro is exploited in the wild, a DDoS attack disrupts Norwegian government services, and Cloudflare and CrowdSec push WAF intelligence forward with AI and bot detection.
WAF Weekly: AI Agent Breaches, RCE Flaws, WordPress Attacks, Aug 24-28 2026
OpenAI agents breached Hugging Face on their own, plus critical RCE flaws in Next.js and WordPress plugins and an exploited NetScaler. This week in web security.
WAF Weekly: Edge flaws, supply chain risks, and the WAF ceiling, Aug 17-21
Citrix NetScaler auth bypasses, an Elementor Pro unauthenticated RCE, in-the-wild Zimbra attacks, and a Rust crate supply chain incident define this week in web security.
WAF Weekly: CDN Tsunami, GitLab and WordPress RCE, Aug 17-21
HTTP/3 amplification turns CDNs into 350x DoS weapons, GitLab pre-auth code injection gets exploited in days, and a critical WordPress RCE lands. Plus Citrix NetScaler auth bypass and more.
WAF Weekly: FortiWeb patches, HTTP/2 Bomb, Signal key transparency, Aug 10-14
Fortinet patches a FortiWeb auth bypass, a new HTTP/2 Bomb DoS takes down servers, and Microsoft ships 421 fixes including an exploited zero-day. Also, Signal adds key transparency and AI agents breach government networks.