Philippe Leothaud

[Philippe Leothaud @pleothaud]

@S1r1u5_ HMAC Algorithm Attack • HMAC is symmetric: same shared key used to sign & verify • RSA is asymmetric: public & private keys • Attacker: 1. Puts HS256 instead of RS256 2. Signs with public RS256 key • API code blindly uses public RSA key with HMAC alg to verify signature

[Midi Libre Sports @MidiLibreSports]

Matthias Leothaud poursuit son ascension dans le peloton junior non sans lorgner sur les professionnels
➡️ https://t.co/HU6mqinoUK

[Philippe Leothaud @pleothaud]

@BetterCallMedhi At last blue teams will be as good as red teams 😉 And we might end up with software built with security in mind from design to prod

[Philippe Leothaud @pleothaud]

@BetterCallMedhi No choice but to implement a rock solid agentic DevSecOps workflow now, and continuous AI based pentesting... With a little bit of luck AI based blue team efforts will prevent AI based red team ones

[Philippe Leothaud @pleothaud]

@ZackKorman @pilvar222 Very nice!
We have simular stuff at @42crunch and currently working on integrating the distributed testing of increments in the IDE and the central governance layer verified in the CI/CD when building/moving to prod
What can be probabilistic and what must remain deterministic ?

[André Baptista @0xacb]

GraphQL Introspection Bypass via Field Suggestions

Even with introspection disabled, GraphQL APIs leak schema information through error messages.

When introspection returns errors, exploit the suggestion feature:
> Send queries with intentional typos
> GraphQL suggests similar field names in error responses
> Tools like Clairvoyance can automate schema reconstruction
> Build a complete schema map from suggestions alone

Source👇
https://t.co/eqbuV3d76Z

[42Crunch @42crunch]

Join our experts Anthony Lonergan and Heshaam Attar for an exclusive webinar unpacking the findings of the State of API Security 2026 Report
https://t.co/rrsmwFGszl

[42Crunch @42crunch]

Join our webinar featuring highlights from two years of investigative research on breaches mentioned in the https://t.co/nXLrWZCRw0 newsletter, and a demonstration of how a continuous API security approach is the only strategy in an AI-driven world.
https://t.co/nmtBTYD8vo

[Philippe Leothaud @pleothaud]

@gugus_bontaquin Un s en trop dans subrepticement

[Philippe Leothaud @pleothaud]

There are no logs when Actor tokens are issued or used.
They cannot be revoked within their 24 hours validity.
They completely bypass any restrictions configured in Conditional Access.

[Philippe Leothaud @pleothaud]

https://t.co/kBEeXiMMty

[Philippe Leothaud @pleothaud]

following Entra ID data could be accessed without any traces:
User information including all their personal details stored in Entra ID.
Group and role information.
Device information and BitLocker keys synced to Entra ID

[42Crunch @42crunch]

FAPI 2.0 sets a strong foundation for API access control, but it doesn’t cover many common, high-risk vulnerabilities, like Broken Object Level Authorization (BOLA) or API logic flaws. 42Crunch extends FAPI security further.
https://t.co/AvhKtEqk2a

[APIsecurity.io @apisecurityio]

In Issue 278 we dive into reports of vulnerabilities impacting Intel, McDonald’s, and TeaForHer, the latest news from the Optus 2022 API breach and an insightful article offering practical tips for designing APIs for efficient AI agent consumption.
https://t.co/Sz8bqEk9Rj

[APIsecurity.io @apisecurityio]

Two key API endpoints with no authorization lead to access bypass flaw in AI-powered platform Base44
https://t.co/VrQBR5oLt6

[APIsecurity.io @apisecurityio]

In Issue 276 we have articles on input validation best practices, take a look at claims about API discovery that risk distracting from real security issues, and review API security incidents reported at McDonald’s and Cisco.
https://t.co/xURZq9OBUC

#apisecurity #newsletter

[42Crunch @42crunch]

API Drift describes inconsistencies between an API’s actual behavior and its intended design and is a security concern with real consequences - the recent attack on CoinMarketCap.

Explores the challenges and how to prevent unintended consequences:
https://t.co/vfq2GHw36q

[42Crunch @42crunch]

Registrieren Sie sich für unser bevorstehendes Webinar über das Auffinden und Beheben der OWASP-API-Sicherheitsschwachstellen BOLA, BA und BOPLA.
https://t.co/1yDvbGKiAC

#BOLA #BOPLA #OWASP #APIsecurity