#SecurityResearch

Akamai researchers uncover vulnerabilities in three MCP servers. Learn about CVE-2025-66335 and how to secure your AI-to-backend connection.

Akamai researchers reveal how an incomplete patch for APT28's zero-day led to CVE-2026-32202, a zero-click vulnerability enabling NTLM authentication coercion.

Read about the active exploitation attempts of the D-Link command injection vulnerability CVE-2025-29635 discovered by the Akamai SIRT.

AI has put an end to the era of evaluating CVEs in isolation. The most critical risks now emerge when legacy state machines meet asynchronous execution.

A vulnerability in Adobe Commerce and Magento Open Source could lead to arbitrary code execution. Read how Akamai’s customers are protected from this threat.

Read how a Telnyx SDK on PyPI was compromised with a malicious payload via a supply chain attack campaign and get mitigation recommendations.

A high-severity vulnerability (CVE-2026-31979) impacts certain deployments of Himmelblau. Immediate action is recommended.

The U.S. DOJ recently disrupted several large and powerful DDoS botnets and shut down their related DDoS-for-hire services with Akamai’s help.

Learn why human oversight is crucial to the responsible use of AI systems in identifying security vulnerabilities and how to avoid false positives.

The use of Mirai continues. Read how the Akamai SIRT identified active exploitation of vulnerabilities in the n8n automation platform and Tenda AC1206 routers.

Read how Akamai eliminated a potential HTTP request smuggling vector due to a bug in the processing of custom hop-by-hop HTTP headers.

Read how PatchDiff-AI uncovered the root cause of CVE-2026-21513 — an actively exploited MSHTML vulnerability — and how APT28 leveraged it in real-world attacks.

A newly disclosed vulnerability that affects multiple React-based frameworks reveals a denial-of-service flaw.

Stay ahead with the latest on the Vivotek upload_map.cgi vulnerability, CVE-2026-22755, and protect your legacy firmware from command injection attacks.

A vulnerability in MongoDB zlib compression allows a remote, unauthenticated attacker to remotely leak unallocated heap memory.

Read how Akamai App & API Protector can help mitigate CVE-2025-66516, a new critical XML external entity (XXE) vulnerability in Apache Tika.

Akamai researchers discuss the security stories that stood out to them in 2025 and offer recommendations and predictions for 2026.

Read how Akamai App & API Protector can help mitigate new CVEs, CVE-2025-55183 and CVE-2025-55184, in React/Next.js.

PatchDiff-AI is a new AI-driven multi-agent system that ingests Patch Tuesday metadata and generates a fully automated root-cause analysis report.

Using PatchDiff-AI, we can quickly analyze the security patch that, according to the vendor advisory, fixes the vulnerability.