All news with #imperva tag

Wed, October 8, 2025

Severe Figma MCP Command Injection Enables RCE Remotely

#Security Advisory #Patch #Figma #Imperva #Command Injection #Disclosure

🔒 Cybersecurity researchers disclosed a now-patched command injection vulnerability in the figma-developer-mcp Model Context Protocol server that could allow remote code execution. Tracked as CVE-2025-53967 (CVSS 7.5), the flaw stems from unsanitized user input interpolated into shell commands when a fetch fallback uses child_process.exec to run curl. Imperva reported the issue and maintainers released a fix in figma-developer-mcp v0.6.3; users should update immediately.

read more →

Tue, September 16, 2025

API Attacks Surge: 40,000 Incidents in H1 2025 Report

#Threat Report #Credential Stuffing Wave #Data Scraping #RCE #DDoS Surge #Imperva

🔒 Thales' Imperva analysed telemetry from over 4,000 environments and reported about 40,000 API incidents in H1 2025, finding APIs now attract 44% of advanced bot traffic. Key findings included a 40% rise in credential-stuffing and account-takeover attempts against APIs without adaptive MFA, plus data scraping (31%) and coupon/payment fraud (26%). Financial services, telecoms and travel were among the most targeted sectors, and Thales warned the pace and sophistication of attacks will continue to increase.