InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
BIG DAY TODAY on 18/03/2026
BIG DAY TODAY on 18/03/2026
Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse on 18/03/2026
HackerOne disclosed a bug submitted by theokeen: https://hackerone.com/reports/3378540 [...]
Meta’s AI Glasses and Privacy on 18/03/2026
Surprising no one, Meta’s new AI glasses are a privacy disaster. I’m not sure what can be done here. This is a technology that will exist, whether we like it or not. Meanwhile, there is a new Android app that detects when there are smart glasses nearby. [...]
State of the Cybersecurity Workforce, JHT / WiCyS RSAC Preview on 17/03/2026
HSTS accepted from HTTP origin behind HTTPS proxy on 17/03/2026
curl disclosed a bug submitted by lg_oled77c5pua: https://hackerone.com/reports/3609505 [...]
The Importance of Forensic Soundness on 17/03/2026
can AI eat its own tail? 🤖 on 17/03/2026
Unescaped username in SASL DIGEST-MD5 response allows injection on 17/03/2026
curl disclosed a bug submitted by am-perip: https://hackerone.com/reports/3608522 [...]
South Korean Police Accidentally Post Cryptocurrency Wallet Password on 17/03/2026
An expensive mistake: Someone jumped at the opportunity to steal $4.4 million in crypto assets after South Korea’s National Tax Service exposed publicly the mnemonic recovery phrase of a seized cryptocurrency wallet. The funds were stored in a Ledger cold wallet seized in law enforcement raids at 124 high-value tax evaders that resulted in confiscating digital assets worth 8.1 billion won ( [...]
Session Cookie Leakage via Static Header Field in WebViewerFragment on 17/03/2026
LinkedIn disclosed a bug submitted by dphoeniixx: https://hackerone.com/reports/3475626 [...]
new phone who dis? on 17/03/2026
BECOMING AN AI HACKER (Episode 01) on 16/03/2026
Business Logic Bypass Allows Setting Read Access Role Without Pro Plan Subscription on 16/03/2026
Lovable VDP disclosed a bug submitted by ziadmomen: https://hackerone.com/reports/3591764 [...]
Possible New Result in Quantum Factorization on 16/03/2026
I’m skeptical about—and not qualified to review—this new result in factorization with a quantum computer, but if it’s true it’s a theoretical improvement in the speed of factoring large numbers with a quantum computer. [...]
SMB READ_ANDX DataOffset not validated on 16/03/2026
curl disclosed a bug submitted by tavro: https://hackerone.com/reports/3603300 [...]
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure on 16/03/2026
Basecamp disclosed a bug submitted by perxibes: https://hackerone.com/reports/3467641 - Bounty: $100 [...]
Upcoming Speaking Engagements on 14/03/2026
This is a current list of where and when I am scheduled to speak: I’m giving the Ross Anderson Lecture at the University of Cambridge’s Churchill College at 5:30 PM GMT on Thursday, March 19, 2026. I’m speaking at RSAC 2026 in San Francisco, California, USA, on Wednesday, March 25, 2026. I’m part of an event on “Canada and AI Sovereignty,” hosted by the University of Toronto’s Munk School of Glob [...]
Friday Squid Blogging: Increased Squid Population in the Falklands on 13/03/2026
Some good news: squid stocks seem to be recovering in the waters off the Falkland Islands. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
5 Cybersecurity Books That Made Me a Better Investigator on 13/03/2026
NahamSec Teaches Me Bug Bounty Basics on 13/03/2026
Academia and the “AI Brain Drain” on 13/03/2026
In 2025, Google, Amazon, Microsoft and Meta collectively spent US$380 billion on building artificial-intelligence tools. That number is expected to surge still higher this year, to $650 billion, to fund the building of physical infrastructure, such as data centers (see go.nature.com/3lzf79q). Moreover, these firms are spending lavishly on one particular segment: top technical talent. Meta reported [...]
HTTP/1.1 Must Die: Conquering the 0.CL Challenge on 13/03/2026
Note: This is a guest post by pentester Julen Garrido Estévez (@b3xal). 1. Acknowledgements 2. Intro 3. Required tools 4. Strategy to solve/exploit the lab 5. Detecting 0.CL 5.1. Practical confirmatio [...]
Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signing on 13/03/2026
Consensys disclosed a bug submitted by aszx87410: https://hackerone.com/reports/3507241 [...]
iPhones and iPads Approved for NATO Classified Data on 12/03/2026
Apple announcement: …iPhone and iPad are the first and only consumer devices in compliance with the information assurance requirements of NATO nations. This enables iPhone and iPad to be used with classified information up to the NATO restricted level without requiring special software or settings—a level of government certification no other consumer mobile device has met. This is out [...]
SQL Injection vulnerability found on ibm.com endpoint on 12/03/2026
IBM disclosed a bug submitted by cr3ckerxploit: https://hackerone.com/reports/3578842 [...]
Curl_compareheader() fails to match multi-value HTTP headers on 12/03/2026
curl disclosed a bug submitted by henriqueg: https://hackerone.com/reports/3598444 [...]
urlapi: off-by-one in custom scheme validation skips last character on 12/03/2026
curl disclosed a bug submitted by otiscui: https://hackerone.com/reports/3598358 [...]
Automation without alignment: The hidden cost of modern DAST on 12/03/2026
Register for the webinar: Burp Suite DAST x Burp Suite Professional: Better Together (Thursday, March 19 2026 16:00 UTC) I'm a firm believer that if you want to understand how secure an application re [...]
The CISO’s Dilemma: How To Scale AI Securely by Tim Erlin on 12/03/2026
Your board wants AI. Your developers are building with it. Your budget committee is asking for an ROI timeline. But as CISO, you're the one who has to answer when the inevitable question comes up: "How do we know this is secure?" If you're like most security leaders, you're caught between two impossible positions. Say yes to AI initiatives without proper security controls, and you're responsib [...]
Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameter on 12/03/2026
Lovable VDP disclosed a bug submitted by marioniangi: https://hackerone.com/reports/3599248 [...]
LIVE: On-Stream GIVEAWAY! | CTF Launch | AMA on 12/03/2026
Hacking with permission: the rules that make it ethical by Eleanor Barlow on 12/03/2026
Ethical hacking, often via Bug Bounty Programs or VDPs, operates within defined frameworks. These include a community Code of Conduct (CoC), setting program Rules of Engagement (RoE), and clarifying platform Terms of Service (ToS). Companies that invest in proactive security need to understand what these terms mean and the function they play in maintaining a secure and compliant program. The chall [...]
NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statement on 11/03/2026
curl disclosed a bug submitted by m777m0: https://hackerone.com/reports/3597359 [...]
Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker by BrianKrebs on 11/03/2026
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker’s main U. [...]
GraphSpy: Hacker's Tooling Deep Dive (w/ creator @RedByte1337!) on 11/03/2026
Agent-to-Agent Attacks Are Coming: What API Security Teaches Us About Securing AI Systems by Tim Erlin on 11/03/2026
AI systems are no longer just isolated models responding to human prompts. In modern production environments, they are increasingly chained together – delegating tasks, calling tools, and coordinating decisions with limited or no human oversight. Almost all that communication happens through APIs. This shift offers enormous productivity benefits. But it has also complicated secu [...]
Canada Needs Nationalized, Public AI on 11/03/2026
Canada has a choice to make about its artificial intelligence future. The Carney administration is investing $2-billion over five years in its Sovereign AI Compute Strategy. Will any value generated by “sovereign AI” be captured in Canada, making a difference in the lives of Canadians, or is this just a passthrough to investment in American Big Tech? Forcing the question is OpenAI, the [...]
Six mistakes in ERC-4337 smart accounts on 11/03/2026
Account abstraction transforms fixed “private key can do anything” models into programmable systems that enable batching, recovery and spending limits, and flexible gas payment. But that programmability introduces risks: a single bug can be as catastrophic as leaking a private key. After auditing dozens of ERC‑4337 smart accounts, we’ve identified six vulnerability patterns that frequently appear. [...]
PortSwigger X Intigriti: Burp Suite Professional licenses up for grabs with this new collaboration on 11/03/2026
At PortSwigger, we’re always looking for ways to enable the world to secure the web, and today we’re excited to take that mission a step further. We’re pleased to announce a new collaboration bringing [...]
CVE-2026-3805: use after free in SMB connection reuse on 11/03/2026
curl disclosed a bug submitted by rat5ak: https://hackerone.com/reports/3591944 [...]
CVE-2026-3784: wrong proxy connection reuse with credentials on 11/03/2026
curl disclosed a bug submitted by nobcoder: https://hackerone.com/reports/3584903 [...]
CVE-2026-3783: token leak with redirect and netrc on 11/03/2026
curl disclosed a bug submitted by spectreglobalsec: https://hackerone.com/reports/3583983 [...]
Microsoft Patch Tuesday, March 2026 Edition by BrianKrebs on 11/03/2026
Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tue [...]
Intigriti collaborates with PortSwigger to support ethical hacking excellence by Eleanor Barlow on 11/03/2026
Intigriti and PortSwigger collaborate to reward hard-working hackers Best known as the creator of Burp Suite, the industry-standard toolkit for manual web application security testing, PortSwigger is a UK-based cybersecurity company on a mission to help the world secure the web. Today, their tools are trusted by over 20,000 organizations worldwide to detect and prevent cyber threats. To further su [...]
Project Helix Blue Team CTF Teaser - Coming Wednesday! on 10/03/2026
What turns a good hacker into a great hunter on 10/03/2026
Connection Reuse Ignores OAuth Bearer Token Mismatch on 10/03/2026
curl disclosed a bug submitted by sabari_n: https://hackerone.com/reports/3595753 [...]
Jailbreaking the F-35 Fighter Jet on 10/03/2026
Countries around the world are becoming increasingly concerned about their dependencies on the US. If you’ve purchase US-made F-35 fighter jets, you are dependent on the US for software maintenance. The Dutch Defense Secretary recently said that he could jailbreak the planes to accept third-party software. [...]
CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap on 10/03/2026
curl disclosed a bug submitted by sabari_n: https://hackerone.com/reports/3595764 [...]
Uncovering agent logging gaps in Copilot Studio on 10/03/2026
During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not log certain administrative actions related to sharing, authentication, logging, and publication of Copilot Studio agents. [...]
Arbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` Namespace on 09/03/2026
AWS VDP disclosed a bug submitted by locus-x64: https://hackerone.com/reports/3557138 [...]
Users can change project visibility which requires high subscription by just changing request body on 09/03/2026
Lovable VDP disclosed a bug submitted by hossam25: https://hackerone.com/reports/3370430 [...]
An Interview with Allie Mellen (author: CODE WAR) on 09/03/2026
LM Challenge-Response Hash Always Sent in SMB Authentication on 09/03/2026
curl disclosed a bug submitted by brewm4ster: https://hackerone.com/reports/3584491 [...]
New Attack Against Wi-Fi on 09/03/2026
It’s called AirSnitch: Unlike previous Wi-Fi attacks, AirSnitch exploits core features in Layers 1 and 2 and the failure to bind and synchronize a client across these and higher layers, other nodes, and other network names such as SSIDs (Service Set Identifiers). This cross-layer identity desynchronization is the key driver of AirSnitch attacks. The most powerful such attack is a full, bidir [...]
Was This Vulnerability Worth $15,000? on 09/03/2026
Behind the console: Active phishing campaign targeting AWS console credentials on 09/03/2026
Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Console credentials via typosquatted domains that mimic AWS infrastructure. [...]
How AI Assistants are Moving the Security Goalposts by BrianKrebs on 08/03/2026
AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priori [...]
In curl's SASL OAUTHBEARER authentication, including the SOH character (0x01) in the username corrupts the message structure. on 08/03/2026
curl disclosed a bug submitted by y_security: https://hackerone.com/reports/3584865 [...]
What is inter tenant IDOR and why bug bounty hunters should care on 08/03/2026
Injection in path parameter of Ingress-nginx on 07/03/2026
Kubernetes disclosed a bug submitted by fisjkars: https://hackerone.com/reports/2701701 [...]
Hardware Hacking 101: with a custom physical kit! on 07/03/2026
The Payload Podcast #003 on 06/03/2026
Catch us chillin' at The Hive during RSA. 🐝 on 06/03/2026
IDOR to make someone attend or leave an event on 06/03/2026
LinkedIn disclosed a bug submitted by safehacker_2715: https://hackerone.com/reports/1734639 [...]
Blocking a company page admin prevents him from delete paid media admin or edit his roles on 05/03/2026
LinkedIn disclosed a bug submitted by riadalrashed: https://hackerone.com/reports/2339192 [...]
Open Redirect on lovable.dev via redirect parameter leads to phishing attacks on 05/03/2026
Lovable VDP disclosed a bug submitted by jdc94: https://hackerone.com/reports/3581815 [...]
DoS via Unbounded Memory Allocation in sendWebStream on Fastify v5.7.0+ leads to OOM crash when backpressure is ignored on 05/03/2026
Fastify disclosed a bug submitted by onlybugs05: https://hackerone.com/reports/3524779 [...]
LIVE: 🕵️ Memory Forensics | Blue Cape | Cybersecurity on 05/03/2026
Missing Access Control in MigrationFile allows attacker to upload files to any Migration on 05/03/2026
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3506183 [...]
Security-driven Rapid Release - Pwn2Own Documentary (Part 4) on 04/03/2026
crypto scammers phish with physical mail on 04/03/2026
SSTI leads to Command injection on 04/03/2026
curl disclosed a bug submitted by errorbehavior200: https://hackerone.com/reports/3584149 [...]
Intigriti launches new global Hacker Ambassador Program by Eleanor Barlow on 04/03/2026
What you will learn What the Intigriti Ambassador Program is and how it works. What are the key benefits and rewards of participation? Who should apply and why it matters. How to apply and next steps. What the global hacking community means to Intigriti The global hacking community has never been more important. From students discovering their first bug to seasoned hackers uncovering flaws in [...]
This is the Fastest Growing Cybersecurity Field for 2026! on 03/03/2026
Use after free in hyperfifo example on 03/03/2026
curl disclosed a bug submitted by deepbluev7: https://hackerone.com/reports/3580247 [...]
What would you do for a P1? on 02/03/2026
Everyone Knows About Broken Authorization – So Why Does It Still Work for Attackers? by Tim Erlin on 02/03/2026
Broken authorization is one of the most widely known API vulnerabilities. It features in the OWASP Top 10, AppSec conversations, and secure coding guidelines. Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) account for hundreds of API vulnerabilities every quarter. According to the 2026 API ThreatStats report, authorization issues ranked ninth i [...]
Firefox JIT Bug - Pwn2Own Documentary (Part 3) on 01/03/2026
2FA requirement bypass when inviting team members on 28/02/2026
Omise disclosed a bug submitted by 0x7ashish: https://hackerone.com/reports/3356149 [...]
Who is the Kimwolf Botmaster “Dort”? by BrianKrebs on 28/02/2026
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against th [...]
ContinuumCon Prep (with Greg Ake!) on 28/02/2026
Cultivating a robust and efficient quantum-safe HTTPS on 27/02/2026
Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography intro [...]
The Dangers Of Cheap Smart Camera on 27/02/2026
This Burp Suite Extension Can Supercharge Your Bug Bounty Hunt For BAC on 27/02/2026
h?ckers a[r]e gl*bbing on 27/02/2026
Hook, line, and vault: A technical deep dive into the 1Phish kit on 27/02/2026
We analyze the evolution of the 1Phish phishing kit from a basic credential harvester into an MFA-aware, multi-stage phishing kit targeting 1Password users. [...]
Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy Violation on 26/02/2026
AWS VDP disclosed a bug submitted by h0ne_analyst_94cm4n1: https://hackerone.com/reports/3514122 [...]
Oh okay on 26/02/2026
Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer Overflow on 26/02/2026
curl disclosed a bug submitted by knickers: https://hackerone.com/reports/3575245 [...]
RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload) on 26/02/2026
curl disclosed a bug submitted by davkor: https://hackerone.com/reports/3575250 [...]
AI Playground XSS to steal user-chat messages and access to connected MCP Server on 26/02/2026
Cloudflare Public Bug Bounty disclosed a bug submitted by matured_kazama: https://hackerone.com/reports/3424998 [...]
Able to bypass HSTS using trailing dot on 26/02/2026
curl disclosed a bug submitted by shan_nandi: https://hackerone.com/reports/3574928 [...]
thousands of Google API keys exposed on 26/02/2026
Curl Telnet Handler Buffer Overflow on 26/02/2026
curl disclosed a bug submitted by pelioro: https://hackerone.com/reports/3575475 [...]
HTML Injection in DAST Trial Request Form Confirmation Email PortSwigger on 26/02/2026
PortSwigger Web Security disclosed a bug submitted by zorixu: https://hackerone.com/reports/3556892 - Bounty: $200 [...]
From curiosity to critical bugs: Interview with Marc-Oliver Munz (c1phy) by Eleanor Barlow on 26/02/2026
Security is built by people. At Intigriti, we don’t just help organizations stay secure; we shine a light on the ethical hackers making a difference. Through our Hacker Spotlight series, we celebrate the talent, curiosity, and impact of the community driving safer digital experiences worldwide. We recently spoke with Marc-Oliver Munz, an ethical hacker from Germany with a global reach. In this Q& [...]
From curiosity to critical bugs: Interview with Marc-Oliver Munz (c1phy) by Eleanor Barlow on 26/02/2026
Security is built by people. At Intigriti, we don’t just help organizations stay secure; we shine a light on the ethical hackers making a difference. Through our Hacker Spotlight series, we celebrate the talent, curiosity, and impact of the community driving safer digital experiences worldwide. We recently spoke with Marc-Oliver Munz, an ethical hacker from Germany with a global reach. In this Q& [...]