InfoSec Planet

See full content

Article about the bigfin squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

See full content

Nextcloud disclosed a bug submitted by suul: https://hackerone.com/reports/3462991 [...]

See full content

See full content

Some AI-based video age-verification checks can be fooled with a fake mustache. [...]

See full content

See full content

See full content

See full content

This is a current list of where and when I am scheduled to speak: I’m giving a virtual talk on “The Security of Trust in the Age of AI,” hosted by the Financial Women’s Association of New York, at 6:00 PM ET on May 21, 2026. I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24–25, 2026, and my talk will be the [...]

See full content

Yuga Labs disclosed a bug submitted by r00tsid: https://hackerone.com/reports/1821085 - Bounty: $250 [...]

See full content

Last month, Anthropic made a remarkable announcement about its new model, Claude Mythos Preview: it was so good at finding security vulnerabilities in software that the company would not release it to the general public. Instead, it would only be available to a select group of companies to scan and fix their own software. The announcement requires context—but it contained an essential truth. [...]

See full content

See full content

curl disclosed a bug submitted by rootofpi_ramesh: https://hackerone.com/reports/3725659 [...]

See full content

See full content

We investigate how a coordinated supply chain campaign that compromised npm and PyPI packages also backdoored the official Cemu Nintendo Wii U emulator GitHub release, reaching nearly 20,000 Linux users. [...]

See full content

An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint. [...]

See full content

The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available. Here is the Institute’s evaluation of Mythos. And here is an analysis of a smaller, cheaper model. It requires more scaffolding from the prompter, but it is also just as good. [...]

See full content

A static analysis of the open-sourced Shai-Hulud offensive framework attributed to TeamPCP, covering its credential harvesting, supply chain poisoning, and exfiltration capabilities. [...]

See full content

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers — including Apple, Google, Microsoft, Mozilla and Oracle — fixing near record volumes of secu [...]

See full content

See full content

See full content

The Model Context Protocol (MCP) is a de facto standard for providing structured access to privileged systems for AI agents and external integrations. It acts as a USB-C port for AI, enabling faster innovation by allowing organizations to expose tools, resources, and workflows without the time-consuming work of building APIs.  Adoption has surged in recent months, and categories like payments, [...]

See full content

AWS VDP disclosed a bug submitted by jcow: https://hackerone.com/reports/3577145 [...]

See full content

Now that the dust has settled on Mythos dropping, there is space for more considered reflection on the direction of travel. Mythos wasn't a surprise; it's another data point on a trajectory that's bee [...]

See full content

See full content

This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to write four bytes at a time straight into the page cache of a file the attacker does not own. The exploit works unmodified across Ub [...]

See full content

Go’s native fuzzing is useful, but it stands far behind state-of-the-art tooling that the Rust, C, and C++ ecosystems offer with LibAFL and AFL++. Path constraints are hard to solve. Structured inputs usually need handmade parsing. It doesn’t even detect several common bug classes, such as integer overflows, goroutine leaks, data races, and execution timeouts. So to make it better, we built [...]

See full content

With the deadline passing for NIS2 compliance, many companies have shifted focus from becoming prepared to proving compliance. This post outlines the top 10 tasks for doing so and provides insights on how crowdsourced security platforms can assist in designing programs relevant to their circumstances and compliance requirements. The April NIS2 compliance deadline has come and gone, but where does [...]

See full content

See full content

See full content

See full content

Turns out that LLMs are really good at hiding text messages in other text messages. [...]

See full content

As founder and CEO of Intigriti, I've spent a long time around hackers, and one thing is clear. The best ones don't fear AI. They use it.   What they do fear, however, and what I take seriously as a founder, is a world where platforms quietly replace them under the banner of efficiency. Where their work trains models they don't benefit from, and where the economics of the craft erode while everyon [...]

See full content

Learn how malicious Claude Code skills can abuse dynamic context commands to execute before model-level prompt injection defenses can intervene. [...]

See full content

Liberapay disclosed a bug submitted by rox-11: https://hackerone.com/reports/3723002 [...]

See full content

Liberapay disclosed a bug submitted by rox-11: https://hackerone.com/reports/3721519 [...]

See full content

Evidence of them has been found by analyzing DNA in the seawater. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

See full content

Insider trading is rife on Polymarket: Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—­defined as wagers of $2,500 or more at odds of 35 percent or less—­on the platform had an average win rate of around 52 percent in markets on military and defense actions. That compares with a win rate of 25 percent across all poli [...]

See full content

Nextcloud disclosed a bug submitted by vidang04: https://hackerone.com/reports/3511998 - Bounty: $150 [...]

See full content

Nextcloud disclosed a bug submitted by 0x0doteth: https://hackerone.com/reports/3304830 [...]

See full content

Nextcloud disclosed a bug submitted by yoyomiski: https://hackerone.com/reports/3521434 [...]

See full content

An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions. A sc [...]

See full content

A look at how to secure Kubernetes secrets [...]

See full content

curl disclosed a bug submitted by shecantcode2: https://hackerone.com/reports/3717365 [...]

See full content

Ruby on Rails disclosed a bug submitted by ksw9722: https://hackerone.com/reports/3580511 [...]

See full content

See full content

ICE is developing its own version of smart glasses, with facial recognition tied to various databases. [...]

See full content

See full content

Monero disclosed a bug submitted by rorkh: https://hackerone.com/reports/3307874 [...]

See full content

Monero disclosed a bug submitted by yulge: https://hackerone.com/reports/3185083 [...]

See full content

curl disclosed a bug submitted by p4p3r_hak: https://hackerone.com/reports/3708482 [...]

See full content

See full content

See full content

PortSwigger Web Security disclosed a bug submitted by bereza4321: https://hackerone.com/reports/3625600 - Bounty: $200 [...]

See full content

We recently added a C/C++ security checklist to the Testing Handbook and challenged readers to spot the bugs in two code samples: a deceptively simple Linux ping program and a Windows driver registry handler. If you found the inet_ntoa global buffer gotcha or the missing RTL_QUERY_REGISTRY_TYPECHECK flag, nice work. If not, here’s a full walkthrough of both challenges, plus a deep dive into [...]

See full content

curl disclosed a bug submitted by ravindrasl2026: https://hackerone.com/reports/3710209 [...]

See full content

curl disclosed a bug submitted by codexxxx: https://hackerone.com/reports/3707747 [...]

See full content

curl disclosed a bug submitted by orelbn7: https://hackerone.com/reports/3712343 [...]

See full content

As part of our recent AI blog series, and in addition to content on ‘How AI is leveraged to enhance the Intigriti platform’, we have provided multiple insights from the Intigriti team on the development and future of AI, how it impacts programs, and the Bug Bounty community. So far, we have explored:   ‘How AI is changing vulnerability discovery’, with COO, Ed Parsons. ‘Common AI misconceptions [...]

See full content

See full content

See full content

See full content

See full content

See full content

As API and AI adoption grows across the Middle East, so do the expectations around how data is handled. For many organizations operating in this region, it’s not just about securing applications. It’s about doing it in a way that keeps data in-country and aligned with local requirements. Today, we’re introducing the Wallarm Middle East Cloud Point of Presence (POP), giving organizations a n [...]

See full content

See full content

See full content

See full content

Nextcloud disclosed a bug submitted by khoof: https://hackerone.com/reports/3399016 [...]

See full content

See full content

Senior pentesters have a deeply refined intuition about what is vulnerable in an environment. The problem? That expertise is often siloed with an individual and trapped in their notes or Python scripts. [...]

See full content

PlayStation disclosed a bug submitted by slidybat: https://hackerone.com/reports/3320669 - Bounty: $10000 [...]

See full content

See full content

A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm’s chief executive says the malicious activity resulted from a security breach and was likely the work of a compet [...]

See full content

See full content

See full content

See full content

Most assume that SQL injection is a solved problem in today's application landscape, especially with increased awareness of secure coding practices (such as resorting to prepared statements or parameterized queries) and the widespread adoption of NoSQL databases. However, in practice, SQLi vulnerabilities continue to surface in modern applications, often hiding in legacy code components, custom qu [...]

See full content

curl disclosed a bug submitted by fxv_ray_st: https://hackerone.com/reports/3702718 [...]

See full content

LibAFL is all the rage in the fuzzing community these days, especially with LLVM’s libFuzzer being placed in maintenance mode. Written in Rust, LibAFL claims improved performance, modularity, state-of-the-art fuzzing techniques, and libFuzzer compatibility. For these reasons, I set out to add LibAFL support to Ruzzy, our coverage-guided fuzzer for pure Ruby code and Ruby C extensions. This gives R [...]

See full content

See full content

curl disclosed a bug submitted by nadsec42: https://hackerone.com/reports/3591956 [...]

See full content

curl disclosed a bug submitted by anonymous_237: https://hackerone.com/reports/3646072 [...]

See full content

curl disclosed a bug submitted by sdainard: https://hackerone.com/reports/3666576 [...]

See full content

curl disclosed a bug submitted by xkilua: https://hackerone.com/reports/3697719 [...]

See full content

curl disclosed a bug submitted by 3lcarry: https://hackerone.com/reports/3694390 [...]

See full content

curl disclosed a bug submitted by joesephdiver: https://hackerone.com/reports/3669637 [...]

See full content

curl disclosed a bug submitted by quaccws: https://hackerone.com/reports/3642555 [...]

See full content

curl disclosed a bug submitted by arkss: https://hackerone.com/reports/3671818 [...]

See full content

curl disclosed a bug submitted by nobcoderr: https://hackerone.com/reports/3677759 [...]

See full content

curl disclosed a bug submitted by bonaire: https://hackerone.com/reports/3621851 [...]

See full content

curl disclosed a bug submitted by osama-hamad: https://hackerone.com/reports/3650689 [...]

See full content

curl disclosed a bug submitted by m1llie: https://hackerone.com/reports/3682666 [...]

See full content

curl disclosed a bug submitted by h3zh3z: https://hackerone.com/reports/3684614 [...]

See full content

curl disclosed a bug submitted by wi110w: https://hackerone.com/reports/3684603 [...]

See full content

PlayStation disclosed a bug submitted by gezine: https://hackerone.com/reports/3452696 - Bounty: $2500 [...]

See full content

Most organizations treating AI security as a model problem are defending the wrong layer. Security teams filter prompts, patch jailbreaks, and tune model behavior, which is all necessary work, while the actual attack surface sits largely unexamined underneath. That surface is the API layer: the endpoints AI systems use to retrieve data, call tools, and take action on behalf of users. This isn' [...]

See full content

We’re proud to announce that PortSwigger recently won the Overall Judges’ Award at the Northern Tech Awards 2026. The Northern Tech Awards are run by GP Bullhound, the tech advisory and investment fir [...]

See full content