Request an evaluation

Attack scenarios

Attack scenarios

Each scenario shows the attack request, what Mikiri WAF detects in it, and the record it leaves in WMC. You can replay every one of them in your own environment during an evaluation.

PHP vulnerabilities

Well-known flaws, still exploited

PHP vulnerabilityCVE-2026-109618 · CVE-2026-109619PHP2Shell, code execution before the application runsA crafted form submission breaks PHP while it parses the request and runs a command without a login. Any PHP script is enough.Read the scenarioPHP vulnerabilityCVE-2024-4577PHP-CGI argument injection on WindowsA soft hyphen in the query string becomes a PHP command-line option and runs attacker code without a login.Read the scenario

Bot protection

Automated traffic posing as users

Bot protectionOAT-008 · OAT-011 · OAT-019Parasitic botsScrapers and password-guessing bots look like users, cost capacity and take over accounts.Read the scenario

API security

Data exposure through the API

API securityOWASP API1:2023Other users' data through the APIChanging one identifier in an API call returns someone else's record, then a script walks through all of them.Read the scenario

Replay these scenarios on your own traffic

Deploy Mikiri WAF on premises and run the requests from each scenario against your applications. Evaluation is free, and application traffic stays on premises.

Request an evaluation