ApyGuard research

API Security Blog

Practical guidance on API authorization, attack paths, secure delivery, and the OWASP API Security Top 10.

Latest research and guides

Vulnerabilities

PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What PHP Teams Need to Do Now

Beyond Traditional API Scanning: How ApyGuard Brings API Discovery, Testing, and Documentation Into One Platform

Why API Documentation Matters Before Security Testing Starts

Why OpenAPI Documentation Alone Doesn't Make Your API Testable

How API Scanners Should Handle OAuth2 & OIDC | ApyGuard

Unsafe Consumption of APIs (OWASP API10): What It Is and How to Fix It

API Security for Startups: Enterprise-Grade Protection Without a Security Team

OWASP API Security Top 10: Test Every Risk With Examples and a Checklist

API Security in CI/CD: How to Protect APIs Without Slowing Delivery

API Authentication 101: What to Use, How to Use It, and Where It Breaks

CORS Misconfigurations: The Silent Gateway to Data Exposure

API Behavior Profiling: Stop Guessing, Start Detecting

IDOR and BOLA: The API Vulnerabilities Traditional Scanners Miss

Second-Order API Vulnerabilities: Why Scanners Fail

Why API Authorization Vulnerabilities Are Hard to Detect

OpenAPI: Documentation or a Security Contract?

OpenAPI Security Testing: How to Scan APIs Smarter Using Your Spec

Vulnerabilities

CVE-2025-29927: Understanding the Vulnerability and How to Protect Your Next.js Application

The Ultimate Guide to API Security in 2026

Subscribe to our newsletter

Get API security tips and ApyGuard updates straight to your inbox. No spam, just useful content.

You can unsubscribe at any time with one click.