appsec.fyi · Sources

blog.qualys.com

5 curated AppSec resources from blog.qualys.com across 4 topics on appsec.fyi.

blog.qualys.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-31.

RCE 3 API Sec 1 AuthZ 1 SSRF 1
Date Added Resource Excerpt
2026-07-31 2026Public-Facing Application Attacks Are Now the Initial Access ProblemAPI SecLibrary for continuous runtime application and API risk management, focusing on public-facing application vulnerability exploitation as the leading initial access vector. It addresses the shift in attack paths driven by AI, which compresses attacker timelines and introduces new risks through AI-powered features within applications. This library helps organizations adapt to modern AppSec challenges where traditional vulnerability management fall short, emphasizing the need for runtime testing to validate exploitable attack paths and manage the expanding AI attack surface.
2026-06-15 2026What Changed in OWASP Top 10 2025? Full Breakdown & RecommendationsAuthZAnalysis of the OWASP Top 10 2025 identifies two new categories: Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10). Security Misconfiguration has jumped to #2, highlighting risks from continuous deployment without continuous scanning. Broken Access Control (A01) now explicitly includes BOLA and BFLA, crucial for API security. While OWASP's recommendations are sound, their application requires mature SDLC discipline and unified tooling. Software Supply Chain Failures (A03) shows a high incidence rate but low CVE coverage, indicating current attacks with limited scanner detection. Addressing these shifts by category can improve an organization's security posture.
2026-04-17 2026Microsoft and Adobe Patch Tuesday April 2026 Security Update ReviewRCEAnalysis of April 2026 Patch Tuesday updates from Microsoft and Adobe reveals 163 vulnerabilities addressed by Microsoft, including eight critical-severity issues and two zero-days: an access-control flaw in Windows Defender and an input validation flaw in Microsoft Office SharePoint, both actively exploited. Adobe patched 56 vulnerabilities across various products, with 38 critical. Notable Microsoft issues include use-after-free flaws in Remote Desktop Client and Microsoft Office, and race conditions in Windows Active Directory and TCP/IP, enabling remote code execution or privilege escalation.
2026-04-10 2026Active Exploitation of 7-Zip RCE VulnerabilityRCEAnalysis of active exploitation of 7-Zip RCE vulnerability CVE-2025-11001, stemming from improper symbolic link handling in crafted ZIP files. Exploitation allows attackers to overwrite system files or execute arbitrary code. NHS England Digital confirmed active exploitation, urging updates to version 25.0.0 or later, which also addresses CVE-2025-11002. Unpatched systems face risks including ransomware and data theft.
2026-04-10 2026Serverless Security Risks 2026: Mitigating Identity & SSRF RCE ThreatsRCESSRFAnalysis of serverless security risks in 2026 highlights how identity, permissions, and configuration replace infrastructure as the primary security boundary. Short-lived cloud credentials, while reducing persistence, remain potent when exposed, enabling authenticated access, privilege escalation, and lateral movement. Common issues like public invocation, excessive permissions, and weak input validation are particularly dangerous, especially when leading to SSRF and RCE exploits that directly expose runtime credentials. Risk compounds through interconnected services, shared roles, and reused dependencies, demanding continuous visibility into identity scope, invocation paths, and configuration hygiene to mitigate systemic exposure and prevent cloud-wide compromise.