Imperva mitigates largest DDoS attacks of 2020… so far…

The word “unprecedented” has never been used so much as it has during 2020. And in the latest of many unprecedented events, July saw the two largest recorded DDoS attacks of the year so far. As revealed in our July 2020 Cyber Threat Index Report, published today, Imperva Research Labs recorded tw...

Imperva Wants to Hear From YOU!

Imperva is pleased to announce UserVoice, a new product feedback system that allows YOU to shape the future of Imperva product lines. UserVoice empowers Imperva users to share feedback and ideas in one comprehensive, crowd-sourced place where they can also see and react to the ideas others submit...

CVE-2026-23870: Imperva Customers Protected Against Critical React Server Components DoS Vulnerability

TL;DR:A newly disclosed denial-of-service vulnerability, CVE-2026-23870, impacts React Server Components and dependent frameworks, including Next.js App Router deployments. The flaw enables unauthenticated attackers to send specially crafted HTTP requests that trigger excessive CPU consumption...

Security by Design: Why Multi-Factor Authentication Matters More Than Ever

In an era marked by escalating cyber threats and evolving risk landscapes, organisations face mounting pressure to strengthen their security posture whilst maintaining seamless user experiences. At Thales, we recognise that robust security must be foundational - embedded into products and service...

Unveiling the 2024 Imperva DDoS Threat Landscape Report

In the ever-changing landscape of cybersecurity, Distributed Denial of Service DDoS attacks continue to be a significant threat. To help organizations stay ahead, were excited to introduce the 2024 Imperva DDoS Threat Landscape Report. This comprehensive report offers a deep dive into DDoS attack...

Imperva® and Fortanix Partner to Protect Confidential Customer Data

Imperva Data Security Fabric and Fortanix Data Security Manager combine to provide end-to-end data security. Imperva, Inc., @Imperva the cybersecurity leader that protects critical applications, APIs, and data, anywhere at scale, and Fortanix, Inc. @Fortanix, the Data Security company powered by...

What are Dating Apps Doing to Protect Their Users?

A very public affair When asked about the pitfalls and problems behind using dating apps, users cite data security as one of the most worrying elements of online dating. Since the Ashley Madison breach in July 2015, online dating sites have repeatedly been under media scrutiny for the poor...

How to Teach Colleagues About the Dangers of Phishing

Every day worldwide, tens of thousands of employees fall prey to phishing scams. In the second quarter of 2022, the Anti-Phishing Working Group APWG saw 1,097,811 total phishing attacks, the worst quarter on record. The results can be devastating: from lost data and identity theft to compromised...

What Does an Internal Attack Resulting in a Data Breach Look Like in Today’s Threat Landscape?

In my last blog, I explained why taking the approach of setting up perimeter defenses, restricting data access, patching vulnerabilities, applying sensors to data movement, and encrypting data is no longer solely effective at stopping data breaches in today’s threat landscape. I also discussed th...

The cost of data security – it’s not just about the numbers

Organizations striving to improve their security posture often find this a multi-faceted challenge. In addition to the security product evaluation itself, security budgets are tight and justification is a necessary step. Financial language, however, is not everyone’s forte - and fiscal presentati...

Ransom DDoS: What you need to know now

According to the 2021 DDoS Threat Landscape Report, Ransom DDoS RDoS threats are on the rise. Imperva researchers have been monitoring threats against several of our customers where extortionists have demanded payment in BitCoin to prevent DDoS attacks. The attack patterns this year are very...

Top 5 Most Vicious Bad Bots

Classified by The Open Web Application Security Project OWASP as ‘automated threats’, bad bots can be used to perform a plethora of actions on the application layer, from basic requests to elaborate sessions with sophisticated requests. Some of these bots are more malicious than others. This make...

Questions to Ask Your Application Security Provider

There is a great deal to consider when evaluating application security providers. Understanding your goals will help. If your goal is vendor consolidation, then selecting those that offer multiple security capabilities over single products may make more sense. And if your goal is out-of-the-box...

Connect, Share, and Learn at Imperva Amplify 2021

On the heels of high-profile breaches, attacks e.g., Sunburst, Raindrop and COVID-19, rapid digital transformation places even more pressure on security. We’re seizing the opportunity to launch our first virtual user conference -- Imperva Amplify -- to share our knowledge so together, we can bett...

Fortnite Scammers Approaching $1m in Annual Takings

When something seems too good to be true, it probably is. It’s a hard lesson to learn and, in this case, one that’s being taught by scammers. The perpetrators are abusing the fact that online players of Battle Royale games may be very eager to get free in-game currency and items, and are willing ...

Smuggling Requests with Chunked Extensions: A New HTTP Desync Trick

A new HTTP request smuggling technique was recently discovered, where attackers take advantage of inconsistent parsing behaviors between front-end proxy servers and back-end application servers. This attack technique leverages ambiguous request formatting to inject malicious secondary requests th...

From Cloudflare Bypass to Credit Card Theft

Introduction On July 6, 2025, a suspicious Python package called 'cloudscrapersafe' was uploaded to the Python Package Index PyPI. Marketed as a utility to evade Cloudflare’s anti-bot protections, this package was a modified version of a widely used 'cloudscraper' library, which is used to automa...

Imperva Protects Against the Exploited CVEs in the Cleo Data Theft Attacks

The Clop ransomware group has once again demonstrated its ability to exploit vulnerabilities to compromise sensitive systems. As Cleo—a managed file transfer provider for businesses—grapples with the aftermath of Clop’s targeted attack on their systems, the spotlight turns to CVE-2024-50623 and...

Imperva Adaptive Threshold for Layer 7 DDoS Attacks Reduces Risk of Business Disruption

Today’s fast-paced digital landscape demands an optimized user experience that is always available to engage end users. However, businesses are constantly under threat from a variety of attacks that seek to disrupt that experience, including DDoS attacks. And the risk is growing. According to the...

Lessons Learned From Exposing Unusual XSS Vulnerabilities

Misunderstood browser APIs are often at the core of many web security issues. With the rapid expansion of web APIs, keeping up with security best practices can be challenging. In this post, we’ll explore a few common mistakes developers make that lead to modern XSS Cross-Site Scripting...

How to Protect Against Data Lake Hacking

Data lakes, or centralized repositories for large-scale data, are a popular solution for data storage, and there are good reasons for that. Data lakes are flexible and cost-effective, as they allow many object formats and multiple query engines, and there is no need to manage or pay for resources...

RASP: The World Cup’s Last Line of Cyber Defense

No greater sporting event exists that brings the peoples of the world together more effectively than the FIFA World Cup, with the first match kickoff set for Monday, 21 November 2022, in Doha, Qatar, at the Al Bayt stadium in Al Khor. Football fans from all across the globe will pour into the Gul...

Shorter, sharper DDoS attacks are on the rise – and attackers are sidestepping traditional mitigation approaches

Imagine that your network is under attack. A couple of minutes ago, you detected a large burst of traffic, out of nowhere. Now it’s in excess of 60 Gbps, and overwhelming your network. Your mitigation service hasn’t picked up the attack yet, and you’re just about to take a closer look when it sto...

Dynamic Swagger Support Comes to Imperva

It’s no secret that the shift to DevOps deployments has taken center stage at organizations small and large. The ability to quickly configure, manage and update via APIs is critical to a company’s ability to push out small iterative changes, without human intervention. And Swagger has become the...

Stronger Together, Red Hat 3scale Integration

Most enterprises today rely on customers accessing their applications to conduct daily business. These enterprises know by now that application programming interfaces APIs are becoming more common than ever before to enable communication between applications and end users. Even though they are...

72 Hours: Understanding the GDPR Data Breach Reporting Timeline

We're down to the wire with respect to the General Data Protection Regulation GDPR compliance deadline of May 25, 2018. Organizations that fail to comply could face fines of up to €20M roughly $22M or 4 percent of their annual global turnover from the prior year and we’ll soon see just how EU...

Will AI Change the Role of Cybersecurity?

Mention artificial intelligence AI and security and a lot of people think of Skynet from The Terminator movies. Sure enough, at a recent Bay Area Cyber Security Meetup group panel on AI and machine learning, it was moderator Alan Zeichick – technology analyst, journalist and speaker – who first...

Agentic AI Security: The Chatbot Era Is Already Over

This is Post 1 of a three-part series. Continue toPost 2: Generative AI Security: Why AI Needs a New Kind of Security, then continue to Post 3: OWASP LLM Top 10: What Comes Next – Agentic & MCP. There is a diagram most security teams still carry in their heads when they think about AI. A user tal...

The Clock Is Already Ticking: Why Post-Quantum Cryptography Can’t Wait

There is a question I have been hearing more and more from CISOs, compliance officers, and security architects over the past year. It does not start with "we had a breach" or "we failed an audit." It starts with something that sounds almost philosophical: " Are we quantum-safe?" A year ago, that...

The New York Times vs. OpenAI: A Turning Point for Web Scraping?

In a recent blog, we covered the blurry lines of legality surrounding web scraping and how the advent of artificial intelligence AI and large language models LLMs further complicates the matter. Shortly after publishing the blog, a significant legal development began unfolding: The New York Times...

Imperva Unveils Latest API Security Enhancements

Imperva is continuing to evolve its API Security offering to help customers better protect their APIs, wherever they are, and to meet changing market requirements. Since launching API Security in March 2022, we continued investing in our API Security offering with the goal of simplifying the...

2023 Predictions: API Security the new Battle Ground in Cybersecurity

The adoption of application programming interfaces, more commonly known as APIs, has increased dramatically in recent years. In many ways, APIs are now the backbone of the Internet. The reason? APIs are an essential component of digital transformation, enabling applications, containers, and...

The Four-Step Approach to Modernizing Your DAM Strategy

Effective data security is critical to an organizations success and requires a strategy that aligns with the company’s objectives and those of its stakeholders. As the data landscape changes, most Database Activity Monitoring DAM solutions struggle to meet new data security requirements. The resu...

How Organizations Manage to Understand Millions of Unstructured Data Files at Scale

For an ever-growing segment of organizations, making sense of unstructured data is fast becoming imperative. It is also far more challenging. Unlike structured data that’s stored in rows and columns, text-based, and easy to search in relational databases and data warehouses, there is no defined...

Bots Hide Behind User Privacy – Should You Be Concerned?

Bot operators are perpetually devising innovative techniques to sneak past security as they go about their dubious, often downright illegal business. Emulating human behavior and traffic patterns are key elements of their strategy. One of the many layers comprising this strategy is reporting thei...

7 Facts About Insider Threats That Should Make you Rethink Data Security

In the report, Insider Threats Drive Data Protection Improvements, Forrester Research asserts that most organizations are making positive steps toward protecting the sensitive data they are migrating to the cloud. However, Forrester suggests that many have not devised a comprehensive plan that...

Preparing for Heightened Attacks in the Current Geopolitical Environment

The current geopolitical environment has raised many concerns about security postures and readiness to respond to a cyberattack. Today, Imperva customers are protected by our world-class network, application, and data security products. Alongside that, Imperva Threat Research is closely monitorin...

Infographic: How Do You Stop Bad Bots?

According to Imperva’s Bad Bot Report 2021, bad bot traffic has maintained its upwards trend, amounting to 25.6 percent of all traffic in 2020, an all-time high. Combined with good bot traffic, 40.8 percent of internet traffic in 2020 wasn’t human, as human traffic decreased by 5.7 percent to 59....

Advanced Bot Protection Handling More Traffic Than Ever

It’s been six months since we launched the Advanced Bot Protection solution as fully integrated into Imperva’s Application Security platform. Previously, the Advanced Bot Protection solution lived on a separate platform, known as the ‘Distil’ platform, from our acquisition of Distil Networks...

Auditing Your Database – Is It Enough For Your Data Security Needs?

Audit trails have been a feature of databases for a long time, but are they still compatible with todays data security demands? What do you need to do, as a security officer, to get the most information about what’s happening to your company’s data? Are audit trail features impregnable to possibl...

Maintaining Privacy in the Cloud [Podcast Discussion]

Not long ago I joined Brian Contos, CISO and VP of Product Innovation at Verodin, for one of his Verodin Cybersecurity Effectiveness Podcasts. It’s been about 10 years since I worked with Brian at Imperva when he was the Chief Security Strategist. Back then, he was the one traveling the world,...

Seven Must-Dos to Secure MySQL 8.0

Most database breaches are blamed on insiders such as employees who are either malicious or whose security has been compromised. In fact, most of these breaches are actually caused by poor security configuration and privilege abuse. Every new database version brings security upgrades. Use them...

Q4 2017 Global DDoS Threat Landscape Report

Today we are releasing our latest Global DDoS Threat Landscape Report, a statistical analysis of 5,055 network and application layer DDoS attacks mitigated by Imperva Incapsula services during Q4 2017. In Q4, the number of application layer attacks nearly doubled, just as the number of network...

Data Anonymization: Motivation and Mechanics

Data is one of the most valuable assets a company has in its possession. And while it may not be listed as a line item on the balance sheet, when a company’s data is breached it can have a very negative impact on the bottom line—in a company’s stock price, reputation and brand. One approach to...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

Enterprise-Grade Application Security, Cloud-Native Speed: Introducing Imperva for Google Cloud

In today’s dynamic digital environment, the pressure to innovate has never been greater. Development teams are pushing for native cloud tools to maximize performance and cost-efficiency, while security teams require best-of-breed, enterprise-grade protection to defend against an ever-evolving...

The Privacy Gap in API Security: Why Protecting APIs Shouldn’t Put Your Data at Risk

The more critical APIs become, the more sensitive data they carry identities, payment details, health records, customer preferences, tokens, keys, and more. And this is where organizations face a painful, often invisible problem: To protect APIs, many organizations end up exposing the very data...

How Imperva Infused AI Throughout Research and Development

The Age of AI Is Upon Us The current pace of technological change beggars’ belief. Generative Artificial Intelligence GenAI, released to the world a mere two years ago, promises to eliminate much of the tedium of the digital world. Software engineers around the world are already using it to speed...

Understanding the OWASP API Security Top 10: Why BOLA is the Number One Risk for APIs

Understanding and addressing vulnerabilities is critical in cybersecurity, where APIs serve as the backbone for seamless data exchange. The OWASP API Security Top 10, revised in 2023, provides a comprehensive guide to the critical issues that organizations must tackle to ensure the robust securit...

Imperva customers are protected against the recent GoAnywhere MFT vulnerability CVE-2024-0204

Recently, Fortra released a security advisory for CVE-2024-0204, a GoAnywhere MFT authentication bypass vulnerability. This bug allows an unauthenticated attacker to create an administrative user by exploiting an InitialAccountSetup.xhtml endpoint–accessible via path traversal–to initiate the...