News
OpenWAF Egress: an open-source gateway that keeps provider keys out of your AI agents
LiteLLM 1.107.0 supply chain compromise: what to check, what to rotate and the 2026 CVEs
Railway security incident: environment variables may be exposed. A practical secret rotation guide
PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch, what to check and how a WAF helps
MCP Shield: the OpenWAF edge now reads MCP, tool calls and tool results included
Put the OpenWAF edge in front of your own MCP server. It checks which methods and tools are called, inspects tool arguments and tool results for prompt injection and leaked credentials, limits requests per token, and starts in log mode.
OpenWAF Egress: an open-source gateway that keeps provider keys out of your AI agents
We open-sourced the gateway we put between AI agents and model providers. Agents keep a placeholder token; the real key is injected from OpenBao or Vault only after the request passes 27 prompt-injection detectors, data-leak patterns and an SSRF check.
LiteLLM 1.107.0 supply chain compromise: what to check, what to rotate and the 2026 CVEs
On 21 October a hijacked release pipeline pushed a credential stealer as LiteLLM 1.107.0 to PyPI and Docker. Here is how to tell if you ran it, what to rotate, the IOCs, and every LiteLLM CVE of 2026 in one table.
Railway security incident: environment variables may be exposed. A practical secret rotation guide
Railway says an intruder queried customer environment variables and decrypted some of them, hunting for AI provider keys. What we know, and a practical guide to rotating secrets in the right order and spotting misuse.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch, what to check and how a WAF helps
Two critical PHP flaws allow unauthenticated remote code execution. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, turn off session upload progress, and check your logs for the signs we list here.
MCP Shield: the OpenWAF edge now reads MCP, tool calls and tool results included
OpenWAF Egress: an open-source gateway that keeps provider keys out of your AI agents
LiteLLM 1.107.0 supply chain compromise: what to check, what to rotate and the 2026 CVEs
Railway security incident: environment variables may be exposed. A practical secret rotation guide
PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch, what to check and how a WAF helps