InfoSec Planet

curl disclosed a bug submitted by xkernel: https://hackerone.com/reports/3427670 [...]

See full content

Microsoft this week pushed security updates to fix more than 60 vulnerabilities in its Windows operating systems and supported software, including at least one zero-day bug that is already being exploited. Microsoft also fixed a glitch that prevented some Windows 10 users from taking advantage of an extra year of security updates, which is nice because the zero-day flaw and other critical weakness [...]

See full content

See full content

See full content

curl disclosed a bug submitted by pelioro: https://hackerone.com/reports/3427460 [...]

See full content

curl disclosed a bug submitted by pelioro: https://hackerone.com/reports/3427343 [...]

See full content

curl disclosed a bug submitted by djogho: https://hackerone.com/reports/3427194 [...]

See full content

See full content

See full content

We’re releasing Slither-MCP, a new tool that augments LLMs with Slither’s unmatched static analysis engine. Slither-MCP benefits virtually every use case for LLMs by exposing Slither’s static analysis API via tools, allowing LLMs to find critical code faster, navigate codebases more efficiently, and ultimately improve smart contract authoring and auditing performance. How Slither-MCP works Slither [...]

See full content

See full content

Short-finned pilot wales (Globicephala macrorhynchus) eat at lot of squid: To figure out a short-finned pilot whale’s caloric intake, Gough says, the team had to combine data from a variety of sources, including movement data from short-lasting tags, daily feeding rates from satellite tags, body measurements collected via aerial drones, and sifting through the stomachs of unfortunate whales [...]

See full content

AWS VDP disclosed a bug submitted by xtawb: https://hackerone.com/reports/3382796 [...]

See full content

See full content

This is a current list of where and when I am scheduled to speak: My coauthor Nathan E. Sanders and I are speaking at the Rayburn House Office Building in Washington, DC at noon ET on November 17, 2025. The event is hosted by the POPVOX Foundation and the topic is “AI and Congress: Practical Steps to Govern and Prepare.” I’m speaking on “Integrity and Trustworthy AI” at North Hennepin Community C [...]

See full content

lemlist disclosed a bug submitted by sle3pyhead: https://hackerone.com/reports/3419636 [...]

See full content

AI isn’t just reshaping cybersecurity - it’s challenging testers to rethink their entire playbook. In his latest article, “Hacking with Burp AI in the Chesspocalypse”, API expert Corey Ball draws less [...]

See full content

See full content

As AI capabilities grow, we must delineate the roles that should remain exclusively human. The line seems to be between fact-based decisions and judgment-based decisions. For example, in a medical context, if an AI was demonstrably better at reading a test result and diagnosing cancer than a human, you would take the AI in a second. You want the more accurate tool. But justice is harder because ju [...]

See full content

The Trail of Bits cryptography team is releasing our open-source pure Go implementations of ML-DSA (FIPS-204) and SLH-DSA (FIPS-205), two NIST-standardized post-quantum signature algorithms. These implementations have been engineered and reviewed by several of our cryptographers, so if you or your organization is looking to transition to post-quantum support for digital signatures, try them out! T [...]

See full content

See full content

See full content

Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster. The 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total [...]

See full content

Google is suing more than two dozen unnamed individuals allegedly involved in peddling a popular China-based mobile phishing service that helps scammers impersonate hundreds of trusted brands, blast out text message lures, and convert phished payment card data into mobile wallets from Apple and Google. In a lawsuit filed in the Southern District of New York on November 12, Google sued to unmask an [...]

See full content

See full content

See full content

The Business of Secrets: Adventures in Selling Encryption Around the World by Fred Kinch (May 24, 2024) From the vantage point of today, it’s surreal reading about the commercial cryptography business in the 1970s. Nobody knew anything. The manufacturers didn’t know whether the cryptography they sold was any good. The customers didn’t know whether the crypto they bought was any g [...]

See full content

Over the past few years, API security has gone from a relatively niche concern to a headline issue. A slew of high-profile breaches and compliance mandates like PCI DSS 4.0 have woken security teams up to the reality that APIs are the front door to their data, infrastructure, and revenue streams. OWASP recently published its first-ever Business Logic Abuse Top 10 List; a clear indication that [...]

See full content

Since its original release in 2009, checksec has become widely used in the software security community, proving useful in CTF challenges, security posturing, and general binary analysis. The tool inspects executables to determine which exploit mitigations (e.g., ASLR, DEP, stack canaries, etc.) are enabled, rapidly gauging a program’s defensive hardening. This success inspired numerous spinoffs: a [...]

See full content

See full content

See full content

Former DoJ attorney John Carlin writes about hackback, which he defines thus: “A hack back is a type of cyber response that incorporates a counterattack designed to proactively engage with, disable, or collect evidence about an attacker. Although hack backs can take on various forms, they are—­by definition­—not passive defensive measures.” His conclusion: As the law curren [...]

See full content

See full content

curl disclosed a bug submitted by ahn0x: https://hackerone.com/reports/3418861 [...]

See full content

curl disclosed a bug submitted by skymander: https://hackerone.com/reports/3419617 [...]

See full content

This is why AIs are not ready to be personal assistants: A new attack called ‘CometJacking’ exploits URL parameters to pass to Perplexity’s Comet AI browser hidden instructions that allow access to sensitive data from connected services, like email and calendar. In a realistic scenario, no credentials or user interaction are required and a threat actor can leverage the attack by [...]

See full content

Basecamp disclosed a bug submitted by fr4via: https://hackerone.com/reports/3079738 [...]

See full content

curl disclosed a bug submitted by tomar-re: https://hackerone.com/reports/3418760 [...]

See full content

curl disclosed a bug submitted by rootsecret3: https://hackerone.com/reports/3418776 [...]

See full content

Traditional cross-site scripting (XSS) vulnerabilities were prevalent when server-side rendering (with languages like PHP, JSP, and ASP) was the norm. However, as applications become more complex and developers continue to shift application logic to the client-side, more complex client-side vulnerabilities are expected to arise. In this article, we will cover what DOM-based cross-site scripting (X [...]

See full content

curl disclosed a bug submitted by rootsecret3: https://hackerone.com/reports/3418646 [...]

See full content

curl disclosed a bug submitted by haider790h: https://hackerone.com/reports/3418616 [...]

See full content

curl disclosed a bug submitted by jiyong: https://hackerone.com/reports/3417428 [...]

See full content

curl disclosed a bug submitted by biswarup_das: https://hackerone.com/reports/3418528 [...]

See full content

See full content

Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I’ve written about this before: Almost all cloud services have to perform some computation on our data. Even the simplest storage provider has code to copy bytes from an internal storage system and deliver them to the user. End-to-end encryption is sufficient in such a [...]

See full content

curl disclosed a bug submitted by bau1u: https://hackerone.com/reports/3414088 [...]

See full content

A 2025 look at real-world Kubernetes version adoption [...]

See full content

The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems, a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China than any specific technical threats, much of the rest of the industry servin [...]

See full content

See full content

See full content

See full content

See full content

.content img { border: 1px solid black; } TL;DR The root cause of the hack was a rounding direction issue that had been present in the code for many years. When the bug was first introduced, the threat landscape of the blockchain ecosystem was significantly different, and arithmetic issues in particular were not widely considered likely vectors for exploitation. As low-hanging attack paths hav [...]

See full content

The second season of the Netflix reality competition show Squid Game: The Challenge has dropped. (Too many links to pick a few—search for it.) As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

See full content

See full content

See full content

Over the past few decades, it’s become easier and easier to create fake receipts. Decades ago, it required special paper and printers—I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required some artistic skills to make the page look realistic. Now, AI can do it all: Several receipts [...]

See full content

lemlist disclosed a bug submitted by mcdave: https://hackerone.com/reports/3378635 [...]

See full content

Lovable VDP disclosed a bug submitted by anxioussick: https://hackerone.com/reports/3369843 [...]

See full content

Before JSON Web Tokens (JWTs) became popular in today's app development landscape, web applications predominantly used server-side sessions, which presented horizontal scalability issues. JWTs solved this by moving authentication data from the server to the token itself. They are self-contained, stateless and cryptographically signed, checking all the boxes for any use case in application developm [...]

See full content

Django disclosed a bug submitted by cyberstan: https://hackerone.com/reports/3335709 [...]

See full content

See full content

The Department of Justice has indicted thirty-one people over the high-tech rigging of high-stakes poker games. In a typical legitimate poker game, a dealer uses a shuffling machine to shuffle the cards randomly before dealing them to all the players in a particular order. As set forth in the indictment, the rigged games used altered shuffling machines that contained hidden technology allowing th [...]

See full content

See full content

See full content

See full content

For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon, Apple, Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at Cloudflare says Aisuru’s overlords are using the botnet to boost their malicio [...]

See full content

Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages [...]

See full content

curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3355218 [...]

See full content

Detecting software supply chain attacks through runtime security. [...]

See full content

Lovable VDP disclosed a bug submitted by d0maxploit: https://hackerone.com/reports/3371448 [...]

See full content

Lovable VDP disclosed a bug submitted by d0maxploit: https://hackerone.com/reports/3371414 [...]

See full content

See full content

See full content

See full content

Mozilla disclosed a bug submitted by xhacking_z: https://hackerone.com/reports/3243860 - Bounty: $200 [...]

See full content

curl disclosed a bug submitted by hackerpllim: https://hackerone.com/reports/3409193 [...]

See full content

curl disclosed a bug submitted by hackerpllim: https://hackerone.com/reports/3409186 [...]

See full content

You asked, and we answered.   At Intigriti, we’ve been paying close attention to the questions most frequently asked by those with a bug bounty program in place. That’s why we’ve launched this blog series dedicated to answering the most frequently asked questions, diving into hot topics, and sharing practical and expert-backed strategies to help you maximize your bug bounty success.  So far in thi [...]

See full content

A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States, KrebsOnSecurity has learned. Sources close to the investigation say Yuriy Igorevich Rybtsov, a 41-year-old from the Russia-controlled city of Donetsk, Ukraine, was previously referenced in U.S. fede [...]

See full content

curl disclosed a bug submitted by oliverkremer: https://hackerone.com/reports/3408126 [...]

See full content

See full content

See full content

See full content

Hiro disclosed a bug submitted by craxermgr: https://hackerone.com/reports/268221 [...]

See full content

Hiro disclosed a bug submitted by craxermgr: https://hackerone.com/reports/268224 [...]

See full content

Hiro disclosed a bug submitted by vyshnav_nk: https://hackerone.com/reports/300164 [...]

See full content

Hiro disclosed a bug submitted by myskar: https://hackerone.com/reports/304073 [...]

See full content

Hiro disclosed a bug submitted by myskar: https://hackerone.com/reports/377565 [...]

See full content

Hiro disclosed a bug submitted by droop3r: https://hackerone.com/reports/716647 [...]

See full content

Hiro disclosed a bug submitted by 0x1_aulia: https://hackerone.com/reports/910732 [...]

See full content

Hiro disclosed a bug submitted by frozensolid: https://hackerone.com/reports/541760 [...]

See full content

Hiro disclosed a bug submitted by anonymous--1000: https://hackerone.com/reports/3062299 - Bounty: $150 [...]

See full content

See full content

See full content

See full content

See full content

curl disclosed a bug submitted by sagorhawlader: https://hackerone.com/reports/3406123 [...]

See full content