Search: “WAF”

4 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 211 Exploit / PoC 70 Data breach 67 Ransomware 53 Policy & legal 31 Industry 29 Malware 28 AI tools & infra 18 Phishing & fraud 18 Threat actor 11 Tools 9 Advisory 6 Research 4 AI safety & security 1

SeverityAll critical 293 high 98 medium 89 low 40 info 37

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.

The IETF published RFC 10008 in June 2026 defining HTTP QUERY, the first new standard method since PATCH in 2010, behaving as a safe, idempotent, explicitly cacheable GET whose query lives in the request body. SANS handler Xavier Mertens warns that WAF rules, API-gateway allowlists, CSRF middleware, and caches built around the classic verb set may not inspect QUERY bodies, allowing SQL injection or XSS payloads to bypass inspection where POST would be blocked. Behavior in the wild is inconsistent: nginx's limit_except silently rejects QUERY and never caches it, while curl, Caddy, Traefik, FastAPI explicit routes, and .NET 10 pass or support it, and Cloudflare/Akamai co-authored the RFC. The author found no QUERY requests in his logs yet and recommends updating method-matching rules and allowlists to include QUERY.

SANS Internet Storm Center06:05 UTC · 8h agoResearch

What Zero-Day Response Should Be in the Post-Mythos Era

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputerSep 15, 13:45 UTC · 3d agoResearch in the wildCVE-2026-1001

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Cloudflare's Automatic Key Exchange probes origins to lead with preferred key exchange, cutting HelloRetryRequests from 52% to 3.7% and enabling automatic post-quantum origin connections.

Cloudflare announced Automatic Key Exchange, an extension of Automatic SSL/TLS that probes each origin's supported key agreement algorithms and leads with the preferred one, favoring the post-quantum hybrid X25519MLKEM768. Rollover across roughly 45 billion daily origin connections cut HelloRetryRequests from about 52% to 3.7%, saving more than 150 ms of p90 handshake latency. Hundreds of thousands of domains now receive post-quantum origin connections without manual configuration, supporting Cloudflare's goal of quantum-safe encryption by 2029 to counter harvest-now-decrypt-later attacks.

Cloudflare BlogSep 8, 13:10 UTC · 10d agoResearch

338 Million Attack Simulations Reveal The State Of Enterprise Defense

Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.

Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.

Help Net SecurityAug 12, 00:00 UTC · Aug 12, 2026Research