All news with #api security tag

⚠️ Truffle Security found nearly 3,000 Google Cloud API keys (prefix "AIza") embedded in client-side code that can now authenticate to Gemini endpoints when a project enables the Generative Language API. Attackers scraping sites can use exposed keys to access uploaded files, cached contents, and make LLM calls that charge victims' accounts. Google says it has implemented measures to detect and block leaked keys and advises rotating and restricting exposed keys.

🤖 Apigee API Hub and API Gateway now integrate to centralize dispersed API metadata and make specs agent-ready. A new API Gateway–API Hub sync brings OpenAPI definitions and gateway configurations into a single control plane without changing existing services or client behavior. The spec boost add-on analyzes gaps and produces a specboost-draft that enriches specs with examples, parameter validation, and error details. Teams can review boosted and original specs side-by-side before adopting changes.

🔧 Amazon MSK now exposes three public topic management APIs — CreateTopic, UpdateTopic, and DeleteTopic — enabling programmatic topic lifecycle operations without running Kafka admin clients. You can use AWS CLI, AWS SDKs, and CloudFormation or the integrated MSK console to create and update topics with guided defaults and view partition-level details and metrics. These features are available at no extra cost for provisioned clusters running Kafka 3.6 and above; ensure appropriate IAM permissions before use.

🔐 Intruder's research scanned roughly 5 million web applications and identified over 42,000 exposed tokens across 334 secret types, revealing widespread leakage in front-end JavaScript bundles. The report shows how traditional path-and-regex scanners, many SAST tools, and some DAST deployments miss secrets introduced during build and deployment, especially in SPAs. High-impact findings included active GitHub/GitLab personal access tokens, project-management API keys, and hundreds of live webhooks; Intruder developed automated SPA secrets detection to close these gaps.

🔁 Infinity Playblocks introduces API Request Step and Webhook Trigger to enable seamless bi-directional integration with any external system. Security teams can now call outbound APIs from playbooks and accept inbound webhook events to initiate automations. This open automation approach connects SIEMs, ITSM platforms, cloud and network controls, and third-party services without bespoke connectors. The result is simpler orchestration, fewer manual handoffs, and faster incident response.

🔒 Google’s Apigee now supports MCP with fully managed, remote servers, enabling organizations to expose existing APIs as agent tools without code changes or running MCP infrastructure. By creating an MCP proxy with your OpenAPI spec and a /mcp basepath, Apigee handles transcoding, protocol handling, and automatic registration in API hub. You can apply Apigee’s built-in security, identity, quota, and analytics controls to govern and monitor agent interactions. The capability is currently available in preview for a limited set of customers.

🔗 Amazon API Gateway REST APIs now support private integration with Application Load Balancer (ALB), enabling direct inter‑VPC connectivity to internal ALBs. This removes the previously required Network Load Balancer hop, which can reduce latency and simplify deployments. The integration brings Layer 7 capabilities — such as HTTP/HTTPS health checks, advanced request‑based routing, and native container service alignment — while retaining NLB-based layer‑4 options.

🔧 Amazon API Gateway now offers Portals, a fully managed, AWS-native developer portal for discovering, documenting, governing, and monetizing REST APIs across accounts. Portals automatically discover existing APIs, generate documentation with a "Try It" experience, and support custom content, branding, access controls, and analytics via CloudWatch RUM. This reduces onboarding time and keeps API configurations within AWS boundaries to reduce third-party security risks.

🔒 Check Point expands CloudGuard to protect GenAI applications by extending the ML-driven, open-source CloudGuard WAF that learns from live traffic. The platform moves beyond traditional static WAFs to secure web interactions, APIs (REST, GraphQL) and model-integrated endpoints with continuous learning and high threat-prevention accuracy. This evolution targets modern attack surfaces introduced by generative AI workloads and APIs.

🔒 AWS has introduced enhanced API key restrictions for Amazon Location Service to help developers secure location-based applications. Keys can now be bound to specific Android applications using package names and SHA-1 certificate fingerprints, or to iOS apps using Bundle IDs, enabling separate keys for testing and production. The feature is available in multiple AWS Regions and is configurable via the console or APIs. This reduces the risk of key misuse and enforces app-level access control.

🔒 Cloudflare, in partnership with Visa and Mastercard, explains how Web Bot Auth together with payment-specific protocols can secure agent-driven commerce. The post describes agent registration, public key publication, and HTTP Message Signatures that include timestamps, nonces, and tags to prevent spoofing and replay attacks. Merchants can validate trusted agents during browsing and payment flows without changing infrastructure. Cloudflare also provides an Agent SDK and managed WAF rules to simplify developer adoption and deployment.

🔐 AWS details practical guidance for implementing and managing Amazon Bedrock API keys, the service-specific credentials that provide bearer-token access to Bedrock. It recommends STS temporary credentials when possible and defines two API key types: short-term (client-generated, auto-expiring) and long-term (IAM-user associated). Protection advice includes using SCPs, iam and bedrock condition keys, and storing long-term keys in secure vaults. Detection and monitoring use CloudTrail, EventBridge rules, and an AWS Config rule, and response steps show CLI commands to deactivate and delete compromised keys.

🏆 Google Cloud's Apigee has been named a Leader in the 2025 Gartner Magic Quadrant for API Management and was positioned highest for Ability to Execute. The announcement highlights Apigee's expansion to support generative and agentic AI workloads by acting as an intelligent, secure API proxy that improves governance, security, scalability, and cost control. Key capabilities called out include AI productization, agent-ready API specification boosting (Private Preview), native quota-based token controls and Looker Studio reporting, a centralized API hub with Gemini-driven semantic search, and enhanced security policies including Model Armor and Advanced API Security.

🔒 This Special Report examines the distinct security challenges of cloud environments, the current threat landscape organizations face, and how rapid AI adoption is amplifying those risks. It highlights common hidden exposures across configurations, data stores, and APIs. The report also presents practical strategies and best practices for improving cloud posture, governance, and operational controls to reduce overall attack surface.

💳Cloudflare is partnering with Coinbase to form the x402 Foundation and to ship developer support for the x402 protocol, enabling machine-to-machine payments on the web. The announcement introduces a proposed deferred payment scheme that decouples cryptographic commitment from settlement, tailored to agentic use cases like pay-per-crawl. Developers can experiment with x402 today via Cloudflare's Agents SDK, MCP integrations, and a live x402 playground funded with Testnet USDC.

🛡️ Bugcrowd's annual "Inside the Mind of a CISO 2025: Resilience in an AI-Accelerated World" report warns that rapid, AI-assisted development is expanding the attack surface and exposing foundational weaknesses. Published September 23, the study links faster release cycles to gaps in access control, data protection and hardware security, and highlights rising API and network vulnerabilities. It calls for continuous offensive testing and collective intelligence to mitigate escalating risks.

🔔 Amazon EventBridge now provides its API destinations capability in the AWS Asia Pacific (Melbourne) and AWS Asia Pacific (Thailand) Regions. API destinations allow event buses to invoke HTTPS endpoints as rule targets and support flexible authentication methods such as API key and OAuth, while storing credentials securely in AWS Secrets Manager. This expansion reduces call latency for local workloads and simplifies secure, managed integrations. To get started, consult the EventBridge documentation for configuration guidance.