Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Many organizations have hundreds or thousands of API endpoints across their services, each of which handles authentication differently. For example, one service might rely on standard headers like Authorization: Bearer, while another uses an API key, and a third uses a custom JSON Web Token header with mechanisms or naming conventions specific to the team that built it.

A newly disclosed security issue, tracked as CVE-2026-44578, affecting Next.js applications is raising concerns across the developer and security communities after researchers identified multiple authorization bypass and middleware evasion paths that could expose protected application data and credentials. The vulnerabilities impact several versions of Next.js and allow attackers to bypass middleware-based authorization controls using crafted requests and route manipulation techniques.

Editor's note: This article was originally published by Craig Riddell on LinkedIn. It has been republished here with the author's permission. Boards are giving AI security more airtime than ever. What they're not giving is the right framing. A year or two ago, AI was mostly a question of experimentation risk. Today, it's tied directly to revenue, customer experience, operational efficiency, and competitive advantage. The urgency is real, and it's translating into aggressive deployment timelines.

In conversations with CISOs about their agentic environments, the question I ask first is not whether they have agents deployed. Most do. It is not whether those agents are creating value. Most are. The question I ask is whether they have mapped their Agentic Security Graph. Almost none of them have. And that gap, between the agentic infrastructure that exists inside their organizations and the visibility they have into it, is where the most serious AI security risk in the enterprise lives right now.