Researcher Corner Archives — Page 3 of 10

In API Security

How Uber was hacked in 2022

November 10, 2022 2 Mins Read

What happened? The first information about the incident was issued yesterday, September 15th, 2022. We know that a hacker called “Tea Pot” successfully accessed Uber infrastructure and critical cloud services such as AWS, Slack, Google Workspace, and others. Most likely, Uber understood what had happened after this message was posted to their corporate Slack from the hacker itself: Source: https://www.theverge.com/2022/9/16/23356213/uber-hack-teen-slack-google-cloud-credentials-powershell The community became aware of this incident from a public message posted by a hacker on…

In API Security

GitLab Security Issues: Six Months of Vulnerabilities

June 11, 2025 4 Mins Read

Have you ever thought the most popular CI/CD platform – GitLab – may have security issues? In fact, it is inevitable with such a massive infrastructure. Don’t worry! The platform is still reasonably secure: it scores well over 700 on BitSight, monitors alerts in real-time, and addresses them instantly. But vulnerabilities still arise, and it’s good to know their types, severity, and how they are addressed. We carefully analyzed GitLab’s security reports from the last…

In API Security

API Vulnerabilities Jump Up 3.7x in Q2-2022

March 30, 2025 2 Mins Read

Since the beginning of 2022, the Wallarm security research team has been analyzing API vulnerabilities and exploits, and releasing quarterly reports. The Q1 report got a lot of attention and positive feedback from the cybersecurity community, as well as a few valuable ideas and suggestions. We included many of these in the Q2 API Vulnerabilities and Exploits report, which will be discussed in our upcoming webinar on August 8th. Register now to reserve your seat!…

In API Security

Two critical security flaws found in Nginx-Ingress controller

February 8, 2023 2 Mins Read

Ingress controllers allow users to configure an HTTP load balancer for applications running on Kubernetes. It’s needed to serve those applications to clients outside of the Kubernetes Cluster. It’s also configured with Kubernetes API to deploy objects called Ingress Resources The NGINX Ingress Controller is a production-grade Ingress controller (daemon) that runs alongside NGINX Open Source or NGINX Plus instances in a Kubernetes environment. The daemon monitors NGINX Ingress resources and Kubernetes Ingress resources to…

In API Security

CVE-2022-1388: Critical security vulnerabilities in F5 Big-IP allows attackers to execute arbitrary code

September 27, 2022 1 Min Read

On May 5, 2022, MITRE published CVE-2022-1388, an authentication bypass vulnerability in the BIG-IP modules affecting the iControl REST component. The vulnerability was assigned a CVSSv3 score of 9.8 The vulnerability was discovered internally by the F5 security team and there is no evidence of whether it’s exploited publicly. There is no publicly available proof of concept at the time of writing this blog post. Newly discovered BIG-IP vulnerability affects the following product and versions:…

In Researcher Corner

Cryptographer – Job Description and How to Become

April 28, 2022 4 Mins Read

Introduction Cryptography is perhaps the main instrument for building a secure computerized framework. These professionals assume a major part in building these frameworks. This makes them probably the most generously compensated and profoundly esteemed laborers inside the growing universe of cybersecurity. A profession as a cryptographic expert can be testing and remunerating both mentally and financially. Assuming that you’re considering a job as this type of specialist, there’s a great deal you should know and…