Issue 280: Solar device ATO attacks, Smart TVs & Dumb APIs, Password-reset & API bugs, 2025 Developer Survey
Brief
This week, we examine an industry report uncovering critical API vulnerabilities in solar power devices, and a recent case of API directory traversal flaws affecting LG Smart TVs. We also look at common weaknesses in the APIs for password-reset services, and finally review insights from the latest Stack Overflow Developer Survey on what developers are saying about AI.
Vulnerability: Major API Flaws in Solar Power Systems
Many API incidents that we cover in this newsletter involve traditional clients like business apps and SaaS platforms using broken or vulnerable APIs. But APIs now underpin integrations and connectivity for everything from industrial power plants to smart home devices. As a result, API vulnerabilities are surfacing across more industries, though often in very similar ways.
Forescout’s report on solar power platforms is an eye-opening example.