B

Blog (Imperva)

http://feeds.feedburner.com/Imperviews?format=xml (RSS订阅地址)

Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager

<p>Somewhere in your estate right now, a certificate is counting down to its expiry date. Today you probably know which one, because renewals still come around annually and someone owns the calendar. The industry is taking that comfort away: the CA/Browser Forum has voted to cut the maximum TLS certificate lifespan to 47 days by [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/ssl-integration-center-digicert-trust-lifecycle-manage/">Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/24
阅读更多

The OWASP LLM Top 10 Was the Warm-Up: What Comes Next

<p>This is Post 3 of a three-part series. Start with Post 1: Agentic AI Security: The Chatbot Era Is Over, then continue to Post 2: Generative AI Security: Why AI Needs a New Kind of Security. When the OWASP Top 10 for LLM Applications arrived, it did the industry a real service. It gave security [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/owasp-llm-top-10-what-comes-next-agentic-mcp/">The OWASP LLM Top 10 Was the Warm-Up: What Comes Next</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/16
阅读更多

Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks

<p>Every year, the security industry publishes benchmark reports built more or less the same way: pick a handful of common vulnerabilities, measure how often they show up, publish the percentages, and move on. We just finished our second year running one of those reports — and the most important thing we found wasn&#8217;t a percentage. [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/imperva-api-security-token-authentication-risk-report-nearly-40-of-apis-face-multiple-authentication-risks/">Imperva API Security Token &#038; Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/13
阅读更多

CopyEscape: Taking Over Docker Hosts with docker cp

<p>Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. A malicious container or sandbox could exploit the copy process to create or overwrite files outside the destination selected by the user, [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/">CopyEscape: Taking Over Docker Hosts with docker cp</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/11
阅读更多

Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core

<p>TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and backported the fix through maintained branches. Imperva Cloud WAF and On-Prem WAF [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/imperva-customers-protected-against-xss2shell-cve-2026-64638-in-wordpress-core/">Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/10
阅读更多

What SecureIQLab Cloud WAAP 5.0 means for your application security

<p>You cannot verify a vendor’s security claims from their own datasheet, including ours. That is why independent validation matters. In our recent guide to the best WAAP solutions (Best WAAP Solutions 2026: Enterprise Buyer Guide), we argued that every serious shortlist should include independent third-party testing across both web and API threats. SecureIQ Lab’s Cloud [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/what-secureiqlab-cloud-waap-5-0-means-for-your-application-security/">What SecureIQLab Cloud WAAP 5.0 means for your application security</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/9
阅读更多

Why Generative AI Needs a New Kind of Security

<p>This is Post 2 of a three-part series. Start with Post 1: Agentic AI Security: The Chatbot Era Is Over, then continue to Post 3: OWASP LLM Top 10: What Comes Next – Agentic &#038; MCP. There is a moment every CISO is having right now, often without warning. A developer shows a working internal [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/generative-ai-security-why-ai-needs-a-new-kind-of-security/">Why Generative AI Needs a New Kind of Security</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/9
阅读更多

ShadowAI-Watch: Bringing AI Agent Activity Out of the Shadows

<p>AI agents are rapidly becoming part of everyday development. They operate inside terminals, IDEs, and internal workflows, helping users write code, troubleshoot problems, and automate repetitive tasks. But their capabilities can extend far beyond what users see in the chat interface or terminal output. Agents may read files, execute commands, launch subprocesses, access credentials, call external tools, and transmit data to [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/shadowai-watch-bringing-ai-agent-activity-out-of-the-shadows/">ShadowAI-Watch: Bringing AI Agent Activity Out of the Shadows</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/9
阅读更多

Imperva Customers Protected Against Novel HTTP Desync Attacks

<p>TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently. Imperva Cloud WAF and On-Prem WAF customers are protected against practical attack patterns described in the research. Imperva’s existing security engine already blocked malicious [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/imperva-customers-protected-against-novel-http-desync-attacks/">Imperva Customers Protected Against Novel HTTP Desync Attacks</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/7
阅读更多

Agentic AI Security: The Chatbot Era Is Already Over

<p>This is Post 1 of a three-part series. Continue to Post 2: Generative AI Security: Why AI Needs a New Kind of Security, then continue to Post 3: OWASP LLM Top 10: What Comes Next – Agentic &#038; MCP. There is a diagram most security teams still carry in their heads when they think about [&#8230;]</p> <p>The post <a href="https://www.imperva.com/blog/agentic-ai-security-the-chatbot-era-is-over/">Agentic AI Security: The Chatbot Era Is Already Over</a> appeared first on <a href="https://www.imperva.com/blog">Blog</a>.</p>

2026/8/5
阅读更多

推荐订阅

Zoom Security Bulletin

Intel Product Security Advisories

Heimdal Security Blog

Dell Security Advisories and Notices

Mozilla Foundation Security Advisories