cyberfeed.io — security news aggregator

Questions for WAF Specialist?

cybersecurity • 2025-10-26 • www.reddit.com

Hello Everyone, I am new to WAF but have worked on Imperva Cloud WAF. I was going through BIGIP(F5) documents, I have few questions for all the mates: 1) What is the standard best practice on critical websites? (Website directly on blocking mode or keep it in monitoring mode) 2) If the website is on monitoring mode(I assume it is not going to block anything), then what if DDOS or any other attacks such as Sql,XSS takes place then if there is a possibility of APPLICATION COMPROMISE? submitted by...

#cloud #waf #xss

Where should i go next?

cybersecurity • 2025-10-21 • www.reddit.com

At the age of 21- Fresher, i joined a company as a SecOps support Engineer. There i got hands on experience on qualys, crowdstrike, cylance, Cloudflare WAF, heimdal and many more tools. Its been one year and i want to change because the pay is horribly low. I want to know whats the next best option for me in cybersecurity and whats would be a good pay for a person with 1 year experience in SecOps. submitted by /u/Otherwise_Bill_4727 [link] [comments]

#waf

Introducing evilwaf most powerful firewall bypass V2.2 was released

cybersecurity • 2025-10-15 • www.reddit.com

Now evilwaf supports more than 11 firewall bypass techniques includes Critical risk: Direct Exploitation • HTTP Request Smuggling •JWT Algorithm Confusion •HTTP/2 Stream Multiplexing •WebAssembly Memory Corruption •cache poisoning •web cache poisoning High risk: Potential Exploitation •SSTI Polyglot Payloads •gRPC/Protobuf Bypass •GraphQL Query Batching °ML WAF Evasion Medium risk: Information Gathering ° Subdomain Discovery ° DNS History Bypass ° Header Manipulation ° Advanced Protocol Attacks...

#exploit #waf #ssti

evilwaf most powerful firewall bypass tool v2.2 was released

Blackhat Library: Hacking techniques and research • 2025-10-15 • www.reddit.com

Now evilwaf supports more than 11 firewall bypass techniques includes: Critical risk: Direct Exploitation • HTTP Request Smuggling •JWT Algorithm Confusion •HTTP/2 Stream Multiplexing •WebAssembly Memory Corruption •cache poisoning •web cache poisoning High risk: Potential Exploitation •SSTI Polyglot Payloads •gRPC/Protobuf Bypass •GraphQL Query Batching °ML WAF Evasion Medium risk: Information Gathering ° Subdomain Discovery ° DNS History Bypass ° Header Manipulation ° Advanced Protocol...

#exploit #security-tools #waf #ssti

We rate-limit + log IPs + reCAPTCHA... spam still wins. What's your proven stack?

cybersecurity • 2025-10-14 • www.reddit.com

We're currently experiencing a persistent spam issue on our website forms, even though both reCAPTCHA v2 and v3 are properly implemented and verified as active. Despite having premium security layers - including Cloudflare (Pro Plan with WAF and Bot Fight Mode) and ClickCease (for ad traffic filtering) - we continue to receive over 150+ spam form submissions per month from repeat IP addresses that successfully pass both reCAPTCHA challenges. Are there known limitations or bypass scenarios...

#waf

Why Unmonitored JavaScript Is Your Biggest Holiday Security Risk

The Hacker News • 2025-10-13 • thehackernews.com

Think your WAF has you covered? Think again. This holiday season, unmonitored JavaScript is a critical oversight allowing attackers to steal payment data while your WAF and intrusion detection systems see nothing. With the 2025 shopping season weeks away, visibility gaps must close now. Get the complete Holiday Season Security Playbook here. Bottom Line Up Front The 2024 holiday season saw major

#detection-engineering #waf