API Security

Cybersecurity 6 min ServiceNow's Exploited Endpoint Was Not Broken. Its Auth Flag Was False. A Scripted REST API had its authentication flag set false, so anonymous requests ran as Guest. Exploited 2 to... KE Kenji Tanaka 4 Sep Cybersecurity 7 min A Stolen Key Spent US$600,000 and No Invoice Ever Arrived An attacker took an API key from a researcher's personal server and spent US$600,000 of inference credits over... KE Kenji Tanaka 2 Sep