Cybersecurity articles tagged #API Security on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/securing-model-context-protocol-mcp-traffic-with-cloudflarehttps://runtimerebel.com/blog/securing-model-context-protocol-mcp-traffic-with-cloudflareLearn how Cloudflare One identifies inspected Model Context Protocol traffic and controls AI agent tool calls to secure enterprise environments.Fri, 14 Aug 2026 16:44:20 GMTCloud SecurityZero-DayAPI SecurityIdentity Accesshttps://runtimerebel.com/blog/ai-agent-insecure-direct-object-reference-leads-to-booking-abusehttps://runtimerebel.com/blog/ai-agent-insecure-direct-object-reference-leads-to-booking-abuseAn autonomous AI agent exploited missing authorization controls in a gym booking API to cancel reservations and alter waitlists.Tue, 11 Aug 2026 16:51:58 GMTArtificial IntelligenceAPI SecurityInsecure Direct Object ReferenceVulnerabilityhttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profithttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profitDiscover how attackers use AI token jacking to steal API keys, fuel underground transfer stations, and cause massive financial losses.Thu, 06 Aug 2026 10:31:56 GMTCloud SecurityCredential TheftSupply Chain AttackAPI Securityhttps://runtimerebel.com/blog/vatican-click-to-pray-app-api-leak-exposes-700k-user-recordshttps://runtimerebel.com/blog/vatican-click-to-pray-app-api-leak-exposes-700k-user-recordsAn insecure API endpoint in the Vatican's Click to Pray app exposed PII of 700,000 users, including location data and emails, risking targeted phishing.Fri, 24 Jul 2026 13:53:14 GMTVaticanAPI SecurityPIIMobile App SecurityClick to Prayhttps://runtimerebel.com/blog/github-api-abuse-detecting-ghost-account-reconnaissance-campaignshttps://runtimerebel.com/blog/github-api-abuse-detecting-ghost-account-reconnaissance-campaignsThreat actors are leveraging thousands of ghost accounts to map GitHub organizations via API abuse, facilitating future targeted supply chain attacks.Sat, 11 Jul 2026 20:51:29 GMTGitHubAPI SecurityReconnaissanceGhost Accountshttps://runtimerebel.com/blog/klue-salesforce-breach-exposes-competitive-data-threat-actors-hackedhttps://runtimerebel.com/blog/klue-salesforce-breach-exposes-competitive-data-threat-actors-hackedKlue's Salesforce instance breach exposed customer competitive intelligence and contact data via an API vulnerability.Fri, 26 Jun 2026 16:48:46 GMTKlueSalesforceData BreachSupply Chain AttackWhite RabbitDarkVaultIntelBrokerAPI Securityhttps://runtimerebel.com/blog/servicenow-data-exposure-via-unauthenticated-api-flawhttps://runtimerebel.com/blog/servicenow-data-exposure-via-unauthenticated-api-flawServiceNow warns customers about a security incident after attackers exploited an unauthenticated API vulnerability to access and query customer instance data.Wed, 10 Jun 2026 01:03:52 GMTServiceNowAPI SecurityData ExposureUnauthenticated AccessCloud Security Incidenthttps://runtimerebel.com/blog/detecting-api-discovery-scans-for-swagger-json-security-guidehttps://runtimerebel.com/blog/detecting-api-discovery-scans-for-swagger-json-security-guideAnalysis of automated scans for swagger.json and OpenAPI files. Learn how to secure RESTful APIs against discovery-based attacks and reconnaissance.Wed, 03 Jun 2026 13:51:10 GMTAPI SecurityReconnaissanceSwaggerOpenAPISANS ISChttps://runtimerebel.com/blog/cisco-secure-workload-rce-via-cve-2025-20165-mitigation-guidehttps://runtimerebel.com/blog/cisco-secure-workload-rce-via-cve-2025-20165-mitigation-guideCisco patches a critical 9.8 CVSS vulnerability in Secure Workload REST APIs that allows unauthenticated attackers to gain Site Admin privileges.Thu, 21 May 2026 13:21:33 GMTCVE-2025-20165Cisco Secure WorkloadAPI SecurityPrivilege Escalationhttps://runtimerebel.com/blog/teampcp-threatens-sale-of-mistral-ai-source-code-repositorieshttps://runtimerebel.com/blog/teampcp-threatens-sale-of-mistral-ai-source-code-repositoriesTeamPCP hackers claim to have exfiltrated 22GB of source code from Mistral AI. This report analyzes the breach impact and API key security risks.Fri, 15 May 2026 00:52:30 GMTTeamPCPMistral AIData BreachSource Code TheftAPI Securityhttps://runtimerebel.com/blog/exposed-google-api-keys-in-android-apps-grant-gemini-accesshttps://runtimerebel.com/blog/exposed-google-api-keys-in-android-apps-grant-gemini-accessAnalysis of Google API keys found in Android apps that enable unauthorized access to Gemini AI endpoints, detailing risks and mitigation for developers.Thu, 09 Apr 2026 12:47:35 GMTGoogle API KeysAndroid SecurityGemini AIAPI SecurityData ExposureMisconfigurationhttps://runtimerebel.com/blog/uk-companies-house-vulnerability-api-flaw-exposed-millions-of-firmshttps://runtimerebel.com/blog/uk-companies-house-vulnerability-api-flaw-exposed-millions-of-firmsA broken access control vulnerability at UK Companies House allowed unauthorized access to sensitive records and potential modification of corporate filings.Tue, 17 Mar 2026 16:31:20 GMTCompanies HouseAPI SecurityUK GovernmentBroken Access ControlData Integrityhttps://runtimerebel.com/blog/escape-secures-18m-to-scale-automated-api-pentesting-and-ai-agentshttps://runtimerebel.com/blog/escape-secures-18m-to-scale-automated-api-pentesting-and-ai-agentsCybersecurity startup Escape secures $18 million in Series A funding to expand its AI-driven API security platform and automated pentesting capabilities.Tue, 10 Mar 2026 12:19:22 GMTAPI SecurityGraphQLAutomated PentestingEscapeAppSechttps://runtimerebel.com/blog/google-cloud-api-keys-exposed-via-public-gemini-accesshttps://runtimerebel.com/blog/google-cloud-api-keys-exposed-via-public-gemini-accessResearch reveals nearly 3,000 public GCP API keys exposed in client-side code grant unauthorized access to sensitive Gemini and Vertex AI endpoints.Sat, 28 Feb 2026 12:12:17 GMTGCPGoogle CloudGeminiAPI SecurityTruffle SecurityInformation Disclosurehttps://runtimerebel.com/blog/insecure-google-api-keys-expose-gemini-ai-and-private-datahttps://runtimerebel.com/blog/insecure-google-api-keys-expose-gemini-ai-and-private-dataExposed Google API keys, once considered low-risk for services like Maps, now allow unauthorized access to Gemini AI models and sensitive project data.Fri, 27 Feb 2026 00:35:17 GMTGoogle CloudGemini AIAPI SecurityCredential ExposureCloudflarehttps://runtimerebel.com/blog/security-flaws-in-android-mental-health-apps-affect-14-7m-usershttps://runtimerebel.com/blog/security-flaws-in-android-mental-health-apps-affect-14-7m-usersMultiple Android mental health apps suffer from hardcoded credentials and insecure data storage, putting sensitive patient information at risk.Tue, 24 Feb 2026 08:20:26 GMTAndroidData PrivacyMental Health AppsHard Coded CredentialsAPI SecurityPaiihttps://runtimerebel.com/blog/mitigating-attack-surface-expansion-in-distributed-llm-infrastructurehttps://runtimerebel.com/blog/mitigating-attack-surface-expansion-in-distributed-llm-infrastructureAn analysis of the security implications of exposing inference servers, vector databases, and orchestration APIs in self-hosted LLM environments.Mon, 23 Feb 2026 12:20:07 GMTLLMAPI SecurityInferenceSSRFOrchestration