Discussions, questions and news about WAF from cybersecurity professionals on Cyberr.
0 members · 27 posts
samuel watua Soita — Full Stack Software Engineer
What happens when the internet-facing part of your business becomes the target of a traffic tsunami? DDoS attacks are becoming increasingly difficult to ignore. Cloudflare reported a 519% increase in hyper-volumetric DDoS attacks during the first half of 2026, with attacks incre…
· 4 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Inside the ETBV Engine State Machine: Eliminating Vulnerability Classes in <0.15ms If you want to survive sub-minute weaponization windows, your defenses must be completely deterministic. Here is exactly how the Execution-Time Boundary Verification (ETBV) engine processes, handl…
· 5 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Moving Validation Before Allocation: Securing Agentic Commerce at Layer Zero As automated transaction networks and autonomous AI agents take over global checkout paths, application security interfaces are facing a catastrophic engineering gap: traditional Web Application Firewal…
· 2 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Look at the sheer velocity of this week's tactical threat snapshot. BeyondTrust, Ivanti, Cisco, and Palo Alto Networks all had critical edge vulnerabilities weaponized in the wild. Take a close look at the mechanics behind the BeyondTrust exploit (CVE-2026-102764). It’s a 9.3 CV…
· 7 reactions · 1 comments
samuel watua Soita — Full Stack Software Engineer
The attacker doesn't have to be smarter than your security team. They just need to be quieter. Most organizations invest heavily in prevention. Firewalls. EDR. MFA. SIEM. WAF. IDS/IPS. And rightly so. But security controls don't eliminate risk. They create signals. The real ques…
· 3 reactions · 1 comments
Schomer — Principal Security Solutions Architect & Founder
Out-of-band emergencies are the new normal. Look at the web tier burning on the feed right now. Within hours, we have emergency security updates hitting major deployment frameworks: 🌐 Next.js & Drupal Critical RCEs: Both ecosystems just rushed out emergency patches for unauthen…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
The system isn't just breaking—it’s completely blind. Look at the Cyberr threat feed over the last hour. Three massive stories just dropped that prove application-layer, identity-based security is entirely obsolete: 1️⃣ BAE Systems Hacked: A cyberattack on a defense giant has kn…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
The reason our framework handles edge infrastructure variance natively where standard automation drops the ball is simple: we validate the execution boundary at Layer Zero, pre-authentication. Look at what happened this month with Cisco and NetScaler—major enterprises burned tho…
· 4 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Pre-Execution State Validation: Decoupling Validation Matrices from Execution Logic at Layer Zero Technical Abstract As network-connected environments grow more complex, software stacks face an increasing risk of Emergent Trust Boundary Violations (ETBV). Traditional network pro…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Sustaining Wire-Speed Chaos: How Layer Zero Posture Validation Achieved 100% Containment Against 20,000 Mutated Attacks Executive Summary Traditional perimeter defense relies on a dangerous assumption: that an ingestion engine can safely parse an exploit payload to determine if…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
That 9.8 In Your Ticket Queue Isn't Your Risk Every few months I end up having the same conversation. Someone forwards a CVE with a 9.8 next to it, the word "Critical" gets used a lot, and the implied question is why we haven't patched it yet. Usually the honest answer is that t…
· 1 reactions · 4 comments
Schomer — Principal Security Solutions Architect & Founder
Google’s Mandiant just confirmed that threat actors are actively bypassing Web Application Firewalls (WAFs) to exploit Oracle PeopleSoft systems globally. This is the fatal flaw of application-layer security: it relies on filtering variable traffic patterns. If an attacker sligh…
· 1 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Defeating Concurrent Kernel-Stack Anomalies: 500k Unpredictable Inbound Permutations Blocked in 0.18sApplication-layer perimeters fail against foundational, zero-click kernel anomalies—specifically socket race conditions like the recent CISA KEV additions (CVE-2025-39964 / Linux…
· 1 reactions · 0 comments
Zane Anderson — Security Consultant
Search Engines Are Passive Reconnaissance Sensors: Search engines are the most accessible intelligence platform on the internet. Used correctly, they let you map attack surfaces, exhume deleted content, and fingerprint internal infrastructure without sending a single packet to t…
· 3 reactions · 0 comments
Armaan Ilyas — MEng Cybersecurity and Digital Forensics | Open to Work
Running a local Al (like Qwen) on LMStudio to speed up your research during bug bounties is amazing, but exposing your setup to a public network isn't. Here is how I built a 100% private, hardware-accelerated link from my Kali VM to my Mac, so I can query the Al safely without l…
· 2 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
Yesterday, I had the privilege of facilitating another amazing hands-on training session. We covered the OWASP Top 10, installed OWASP Broken Web Applications on VirtualBox, and conducted a brute force attack on DVWA. We also carried out SQL injection and command execution attac…
· 2 reactions · 0 comments
Zane Anderson — Security Consultant
Internet Structure, Breaches & Anonymity in OSINT and Cybersecurity: Your Internet Footprint Is Talking: Before an attacker sends a packet, your organization may already be telling a detailed story through public routing data, DNS delegations, certificate logs, peering records,…
· 1 reactions · 0 comments
Ikechukwu Justin Onyekwere — Security Operations Center (SOC) Analyst
Quick cybersecurity reality check: Buying a SIEM does not mean you are secure. Out of the box, most security monitoring tools are completely blind to unique business and application logic. If you aren't actively engineering your detections, you're blind to real threats. I recent…
· 3 reactions · 2 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
Urgent need for a Vice President in the Cybersecurity Perimeter Response Team at JPMorganChase, you will play a critical role in defending the Firm’s digital perimeter against sophisticated Layer 3/4 and Layer 7 DDoS attacks. You will personally create, test, implement, and moni…
· 4 reactions · 3 comments
Imrane T. — Offensive Security | Attack Chains & Business Logic
OTP Authentication Weakness - Backend vs WAF Gap Identified a flaw in an OTP verification flow where security controls were not enforced at the application layer. Key observations: - No backend rate limiting on /auth/.../otp/verify - No account/session lockout after repeated fai…
· 4 reactions · 0 comments
Jason Twin — IT Support and Systems Monitoring
Completed a another SOC simulation that was focused on SQL injections and Directory Traversal against a web server. This involved understanding what Malicious Or Unusual User agent's were used, and as well knowing what HTTP Methods and Response Codes are so you can identify if t…
· 2 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
Most websites are not getting hacked because of “advanced attacks”… They’re getting exposed because of the basics. I recently analyzed a simple HTTP response from a live web application, and here’s what stood out: - No Content Security Policy - No HSTS - No X-Frame-Options - No…
· 5 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
Networking Protocols Explained, Simple & Practical Behind every website you visit, every email you send, every file you download, there's a protocol making it happen. Here's what every professional should know: HTTP · The foundation of web communication between browsers and serv…
· 2 reactions · 0 comments
Mark Cutting — Executive Technology & Cyber Leader | CIO | Cyber, Governance & Operational Resilience
The "Glass House" of cyber security is surprisingly common. Their pitch: A self-proclaimed cybersecurity "expert" posts a long thread on "essential hardening." The reality: You visit their website. It is missing basic HTTP security headers. No Content Security Policy (CSP). No H…
· 1 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
📢 Shared from Cyberr UK UK cyber security agency warns of AI-driven 'patch wave' Overhaul software update processes or risk being overwhelmed. The chief technology officer of the United Kingdom's National Cyber Security Centre (NCSC) has told organisations to deal with their te…
· 1 reactions · 0 comments