Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Apache Software Foundation has disclosed a high-severity vulnerability in Apache Tomcat that could let attackers exploit improperly handled Priority headers in HTTP/2 to cause a denial of service (DoS). Tracked as CVE-2025-31650, this flaw stems from improper input validation, specifically when the server handles malformed Priority headers in HTTP/2, resulting in memory leaks and potential OutOfMemoryExceptions.

In the race to deliver software faster and more frequently, Continuous Integration and Continuous Deployment (CI/CD) pipelines have become the backbone of modern DevOps workflows. But with this speed comes a critical trade-off — security. Integrating security checks into your CI/CD pipeline is no longer optional; it’s a necessity. This is where CI/CD security scanning steps in.

The 2025 edition of Verizon’s Data Breach Investigations Report (DBIR) shows a new reality: about one in five confirmed breaches now starts with exploitation of a software vulnerability, a 34 percent jump over the previous year and the first time the vector has surpassed phishing.

APIs are now prime targets for attackers, and as your API landscape grows, so does the challenge of securing it. AppTrana’s API protection just got more powerful—with new enhancements designed to deepen discovery, increase visibility, and strengthen security.

Hospitals, clinics, pharma companies and digital‑health start‑ups are now on the front line of application‑layer threats. Without purpose‑built Web Application and API Protection, vital services and patient safety are placed at risk. Some concerning stats.

Banking & Financial Services (BFS) firms are shouldering a uniquely heavy share of the global threat load. The newly released Indusface State of Application Security 2025 study paints a stark picture: Why the laser focuses on finance? Strict regulations mean banks generally run strong perimeters, so adversaries pivot to bots, API abuse, and nuanced business-logic exploits that slip past ‘default’ defences.

Web Application Firewalls (WAFs) have emerged as indispensable tools not only for blocking cyber threats but also for supporting compliance across various industries and jurisdictions. Whether you’re dealing with sensitive payment information, personal health records, or consumer data, a WAF can significantly simplify your compliance journey.

APIs are now the top attack vector, facing 68% more threats per host and 16 times more DDoS traffic than traditional web apps. These findings come from the State of Application Security 2024 report, based on analysis of over 2 billion API attacks blocked by AppTrana WAAP. As APIs become critical to digital transformation, understanding how to secure them—beyond just authentication—is no longer optional.

APIs are now the most attacked layer in the application stack— APIs are being hit 68% more often per host than traditional web apps with APIs facing 1600% more DDoS traffic than web apps. This was found in the state of application security 2024 report where we analyzed 2 billion API attacks blocked on AppTrana WAAP. This isn’t surprising. APIs are inherently automation-friendly, often underprotected, and expose direct access to data and logic.