Bissa scanner and the hunt for application secrets
Bissa research describes AI-assisted exploitation and credential harvesting. Our logs reveal a recurring multipart marker across 67 source IPs.
From an exposed .env file to an SMTP login in 22 seconds
One source fetched three exposed .env decoys, then presented each exact password to SMTP within 22 seconds. Here is the evidence and what to protect.
PHP2Shell probes and PHP multipart upload vulnerabilities
How PHP2Shell probes target CVE-2026-109618 and CVE-2026-109619, what we captured, and how WAF protections help block these requests.
How to recognise vulnerability scanners across changing IP addresses
Scanner IPs change. Multipart boundaries, user-agent strings and ordered HTTP headers can help you find recurring request patterns across addresses.
How to Tune F5 BIG-IP Advanced WAF
Run F5 BIG-IP Advanced WAF in Transparent mode, review staged matches and learning suggestions, and limit each exception to the URL, parameter, cookie or content profile that needs it.
How to Tune Google Cloud Armor WAF Rules
Tune Cloud Armor preconfigured WAF rules with preview traffic, versioned signatures, sensitivity levels, field exclusions and policy priority.
How to Tune Cloudflare WAF When Rule 949110 Blocks a Request
Trace a Cloudflare OWASP anomaly-score block to the rules that raised the score, then choose the right override or exception.
How to Tune Azure Application Gateway WAF
Start Azure Application Gateway WAF in Detection mode, find false positives in Log Analytics, narrow each exclusion and move into Prevention mode.
How to Tune AWS WAF with Count, Labels and Rule Priority
Use Count overrides, managed-rule labels and rule priority to fix AWS WAF false positives while keeping the rest of the managed rule group in force.
How to Tune Coraza on Caddy
Run Coraza and OWASP CRS on Caddy in DetectionOnly, read the audit log and limit each exclusion to the field and route that need it.
How to Tune Your WAF Without Turning It Off
A practical process for running a CRS-based or managed WAF in detection mode, finding repeatable false positives and writing narrow exceptions that survive real application traffic.
When and Why to Use a WAF: A Guide for WAF Sceptics
WAFs are neither useless nor a security force field. Here is what they are good at, where they fail, and when putting one in front of an application makes sense.
Your Application Needs a WAF. Just Not for the Reason You Think
A web application firewall will not fix insecure code. It can still give applications a valuable layer of protection when bugs, bots and attacks reach the front door.
Everyone Says a WAF Is Useless. Are They Right?
Ten good reasons not to trust a web application firewall—and why most of them are arguments for using one properly, not going without one.