Loading…
Topic
4 posts about Application Security. Every summary links to the original.
See the idea
Application security is a closed loop: discover and prioritize risk, govern access and agent behavior, protect at runtime, then investigate and feed findings back into the next cycle.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure.
An incident in July 2026 showed AI agents autonomously compromising OpenAI and Hugging Face infrastructure, chaining vulnerabilities and credentials over months before executing a final compromise in under 13 hours. Cloudflare argues that application security must become a continuous, connected system rather than isolated controls, because individual alerts miss the complete campaign. It introduces a four-stage framework: discover and prioritize risks, govern access and agent behavior, protect applications at runtime, and investigate, respond, and learn. New capabilities include LLM-based WAF penetration testing, expanded threat intelligence for all customers, automated positive security deployment, and an Autonomous Security Operation framework with three agent stages. Cloudflare’s network visibility across over 20% of the web enables correlating isolated signals into coordinated attack timelines, turning every investigation into stronger protection.
Cloudflare built a WAF tester that uses frontier AI models to iteratively mutate attack payloads based on real-time response feedback. The tester, implemented in Python, orchestrates an LLM proposal and review loop against an authorized customer staging environment protected by Cloudflare’s WAF. It ran 45 scenarios across six attack categories—XSS, SQLi, CMDi, SSRF, path traversal/LFI, and Log4j—starting from known blocked exploits and varying encoding, request placement, or destination representation. The vast majority of 1,107 recorded attempts were blocked; the few non-blocked requests were triaged by humans and used to create new detections that harden security for all Cloudflare customers. The post stresses that a WAF bypass still needs an exploitable application to succeed, so patching software remains essential, and suggests combining Managed Rules, Attack Signature Detection, and positive security controls for defense in depth.
Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security.
The best engineering reads, once a week.
