Loading story…
API vulnerabilities surged in Q3 2025, with researchers identifying 1,602 API-related flaws—a 20% increase from the previous quarter. The most common issues included security misconfigurations, broken authorization, and broken authentication, with a notable rise in AI-API and Model Context Protocol (MCP) vulnerabilities. Attackers increasingly exploited business logic flaws and partner integrations, shifting their focus from traditional code-level weaknesses to more complex attack paths, particularly in AI-powered APIs.
Simultaneously, threat actors aggressively targeted software supply chains, especially by compromising npm package maintainers through phishing campaigns. These attacks enabled adversaries to upload malicious packages, impacting thousands of developers. The quarter saw a spike in compromised legitimate packages, highlighted by the S1ngularity campaign and the emergence of the Shai-Hulud npm worm. Attackers used advanced phishing techniques, including adversary-in-the-middle attacks, to bypass traditional multi-factor authentication, underscoring the need for phishing-resistant authentication methods.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Wallarm publicly released its Q3 2025 API ThreatStats report, warning that API sprawl, AI integration, and business logic flaws were creating systemic risk that outpaced traditional application security measures. The report urged organizations to prioritize unified API governance, shadow API discovery, and protection for AI pipelines.
By the time of the Q3 2025 reporting, CISA's Known Exploited Vulnerabilities catalog had added eight new API-related exploited flaws. The additions were cited as evidence that API weaknesses were being actively exploited in real-world attacks.
The Q3 2025 Wallarm report said eight major API-related breaches were confirmed, affecting industries including fintech, hospitality, SaaS, and AI. One cited example was the Salesloft/Drift OAuth compromise, which reportedly impacted multiple enterprises.
During Q3 2025, business logic abuse was identified as a mainstream attack path, with traditional security tools described as inadequate for detecting or preventing many of these attacks. The trend underscored the need for context-driven testing and active monitoring.
The Q3 2025 reporting highlighted a sharp increase in vulnerabilities affecting AI-connected APIs and Model Context Protocol implementations. This reflected a broader shift toward attacks on AI pipelines and API-driven integrations.
Wallarm's Q3 2025 ThreatStats report found a 20% quarter-over-quarter increase in API vulnerabilities, while average severity remained persistently high. The report said attackers were increasingly exploiting business logic flaws, AI-powered APIs, and partner integrations rather than only traditional code-level weaknesses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Software supply-chain compromise continued to blend into normal development activity, with attackers exploiting the speed and trust of modern workflows—third-party dependencies, automated updates, and rapid release cycles—to distribute malware and steal credentials. A ReversingLabs study covering 2025 open-source ecosystems reported **npm** as the dominant distribution channel for malicious packages, including incidents where attackers **compromised maintainer accounts** and shipped tainted updates that propagated quickly into downstream projects via routine dependency updates and CI/CD processes. One highlighted case was the **Shai-hulud** worm, described as a registry-native, self-propagating threat that used **stolen credentials** to inject malicious code into **hundreds of packages**, exposing **tens of thousands of downstream repositories** and complicating detection because it did not rely on external infrastructure. In parallel, commentary on generative AI’s impact on software delivery emphasized that faster code production and release pressure can increase security debt: reported industry claims that **20–30% of code** at major firms is AI-generated, alongside estimates that a large share of AI-generated code can introduce **OWASP Top 10**-class weaknesses, reinforcing the need for stronger testing and controls as development velocity increases.
Jun 29, 2026
Recent research from Bugcrowd has revealed a dramatic increase in hardware, API, and network vulnerabilities, prompting cybersecurity professionals to reevaluate their defense strategies. The proliferation of Internet of Things (IoT) devices has contributed to an 88% rise in hardware vulnerabilities, as more organizations deploy connected sensors, appliances, and medical equipment. Security researchers have reported that 81% discovered new hardware flaws over the past year, highlighting the scale of the problem. Network vulnerabilities have doubled, and API bugs have increased by 10%, further expanding the attack surface for enterprises. Critical vulnerabilities, particularly those involving broken access control and sensitive data exposure, have seen significant growth, with payouts for these flaws rising by 32%. Broken access control alone has increased by 36%, while sensitive data exposure vulnerabilities have grown by 42%, underscoring persistent foundational security issues. The rapid adoption of AI-assisted software development is accelerating release cycles but also introducing new security gaps, especially in access control and data protection. As applications become more complex and agentic AI systems gain autonomy, managing access control becomes increasingly challenging. IoT security remains a major concern, as many devices are not designed to receive timely vulnerability patches or updates, leaving them exposed to attacks such as distributed denial-of-service (DDoS) and data theft. Attackers are exploiting the remote control capabilities of IoT devices, targeting everything from smart office lighting to advanced medical equipment and agricultural machinery. Efforts to improve IoT security include legislative initiatives and voluntary programs like the US Cyber Trust Mark, which aims to encourage device-makers to adopt better security practices. However, progress on these initiatives has been slow, and it remains uncertain when or if they will have a significant impact. The expanding use of nonhuman identities, such as API keys and machine accounts, further complicates the security landscape, as these digital identities often have broad access and are difficult to monitor. Security leaders are increasingly aware that agentic AI and the growing complexity of interconnected systems are likely to accelerate existing vulnerability trends. As a result, organizations are being urged to rethink their security strategies, focusing on foundational issues like access control, data protection, and the secure management of digital identities. The convergence of these trends signals a need for more robust, adaptive, and proactive security measures to address the evolving threat landscape.
Jun 29, 2026
A major supply chain attack targeted the npm ecosystem in September 2025, where an infostealer with worm-like characteristics, dubbed **Shai-Hulud**, compromised over 500 npm packages. The attack leveraged a previous compromise of the `s1ngularity/nx` project, exploiting CI/CD pipeline credentials and propagating through both direct and indirect dependencies. Security researchers confirmed that attackers exfiltrated GitHub and npm tokens, enabling them to inject malicious code into widely used packages and potentially access internal networks, move laterally, or tamper with software releases. The incident highlighted the persistent risks associated with CI/CD pipeline security, as attackers exploited overlooked access to secrets such as API keys and deployment tokens. The scale of the attack forced engineering and security teams worldwide to spend significant resources cleaning compromised environments and assessing exposure, even though the direct financial impact was limited. The event underscored the need for enhanced runtime security monitoring, such as eBPF-based sensors, and stricter controls on package publishing and consumption to defend against similar threats in the future.
Jun 29, 2026