AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: “instant software.” Taken to an extreme, it might become easier for a user to have an AI write an application on demand—a spreadsheet, for example—and delete it when you’re done using it than to buy one commercially. Future systems could i [...]
Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code. Micros [...]
AWS VDP disclosed a bug submitted by misop00p: https://hackerone.com/reports/3620761 [...]
Nextcloud disclosed a bug submitted by shiva2550: https://hackerone.com/reports/3518758 [...]
More power for bug hunters An education-first approach to bug bounty Rewards on Meta's Bug Bounty Platform Our shared vision Ready to get started? We’re excited to announce a new partnership with Meta [...]
WhatsApp’s new “Private Inference” feature represents one of the most ambitious attempts to combine end-to-end encryption with AI-powered capabilities, such as message summarization. To make this possible, Meta built a system that processes encrypted user messages inside trusted execution environments (TEEs), secure hardware enclaves designed so that not even Meta can access the plaintext. Our now [...]
According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc.—even if you are just transiting the airport. In a security alert dated March 26, the U.S. Consulate General said that, on March 23, 2026, Hong Kong authorities changed the rules governing enforcement of the National Security Law. Under the revised fra [...]
curl disclosed a bug submitted by mzfr: https://hackerone.com/reports/3650443 [...]
curl disclosed a bug submitted by mzfr: https://hackerone.com/reports/3650473 [...]
curl disclosed a bug submitted by cutiapretaa: https://hackerone.com/reports/3650435 [...]
The content of the Cyber Security & Resilience Bill (CSRB) recently introduced to Parliament contained few surprises. Having spent a significant amount of time working with European cyber-security frameworks, particularly NIS2, I see the Bill as both a continuation of the trend towards common approaches, and a signal of how seriously governments now take cyber risk. From my perspective, there are [...]
Glassdoor disclosed a bug submitted by downgrade: https://hackerone.com/reports/2516237 [...]
Glassdoor disclosed a bug submitted by zorixu: https://hackerone.com/reports/2682538 [...]
Glassdoor disclosed a bug submitted by imtheking: https://hackerone.com/reports/1820146 [...]
Mike Masnick points out that the recent New Mexico court ruling against Meta has some bad implications for end-to-end encryption, and security in general: If the “design choices create liability” framework seems worrying in the abstract, the New Mexico case provides a concrete example of where it leads in practice. One of the key pieces of evidence the New Mexico attorney general used [...]
Monero disclosed a bug submitted by jehrenhofermagicgrants: https://hackerone.com/reports/3241102 [...]
Monero disclosed a bug submitted by jehrenhofermagicgrants: https://hackerone.com/reports/3240792 [...]
Glassdoor disclosed a bug submitted by avielt: https://hackerone.com/reports/881118 [...]
Google says that it will fully transition to post-quantum cryptography by 2029. I think this is a good move, not because I think we will have a useful quantum computer anywhere near that year, but because crypto-agility is always a good thing. Slashdot thread. [...]
curl disclosed a bug submitted by spiderchan26: https://hackerone.com/reports/3645415 [...]
curl disclosed a bug submitted by divsz: https://hackerone.com/reports/3651975 [...]
An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021. Shchukin was n [...]
curl disclosed a bug submitted by spichanlio76: https://hackerone.com/reports/3646914 [...]
curl disclosed a bug submitted by intrax: https://hackerone.com/reports/3645361 [...]
curl disclosed a bug submitted by rougerseven7: https://hackerone.com/reports/3648199 [...]
Here’s a fossil of a 150-million year old fish that choked to death on a belemnite rostrum: the hard, internal shell of an extinct, squid-like animal. Original paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
curl disclosed a bug submitted by intrax71: https://hackerone.com/reports/3640932 [...]
curl disclosed a bug submitted by calaba_zas: https://hackerone.com/reports/3641893 [...]
WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes (alternate link) the recordings. It doesn’t use the Zoom record feature, so Zoom can’t do anything about it. [...]
Mixed Boolean-Arithmetic (MBA) obfuscation disguises simple operations like x + y behind tangles of arithmetic and bitwise operators. Malware authors and software protectors rely on it because no standard simplification technique covers both domains simultaneously; algebraic simplifiers don’t understand bitwise logic, and Boolean minimizers can’t handle arithmetic. We’re releasing CoBRA, an [...]
This is for new routers; you don’t have to throw away your existing ones: The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U [...]
Posted by Adam Gavish, Google GenAI Security TeamIndirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This ma [...]
Wired writes (alternate source): Security researchers at Google on Tuesday released a report describing what they’re calling “Coruna,” a highly sophisticated iPhone hacking toolkit that includes five complete hacking techniques capable of bypassing all the defenses of an iPhone to silently install malware on a device when it visits a website containing the exploitation code. In t [...]
The 2026 US “Cyber Strategy for America” document is mostly the same thing we’ve seen out of the White House for over a decade, but with a more aggressive tone. But one sentence stood out: “We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities.” This sounds like a call for hackback: giv [...]
Code coverage is one of the most dangerous quality metrics in software testing. Many developers fail to realize that code coverage lies by omission: it measures execution, not verification. Test suites with high coverage can obfuscate the fact that critical functionality is untested as software develops over time. We saw this when mutation testing uncovered a high-severity Arkis protocol vulnerabi [...]
Last week, I listened to a fascinating talk by K. Melton on cognitive security, cognitive hacking, and reality pentesting. The slides from the talk are here, but—even better—Menton has a long essay laying out the basic concepts and ideas. The whole thing is important and well worth reading, and I hesitate to excerpt. Here’s a taste: The NeuroCompiler is where raw sensory data get [...]
In March 2026, we ran BugQuest, a 31-day campaign covering everything you need to know about finding and exploiting broken access control vulnerabilities. From understanding the basics of authentication and authorization to spotting subtle authorization bypasses in real code, we broke down one of the most critical vulnerability classes in modern web applications. Broken access controls have consis [...]
curl disclosed a bug submitted by whitehat411: https://hackerone.com/reports/3639277 [...]
curl disclosed a bug submitted by h3xb1tx: https://hackerone.com/reports/3638715 [...]
Posted by Dirk Göhmann, Tony Mendez, and the Vulnerability Rewards Program Team2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under [...]
Sony disclosed a bug submitted by resurrect20: https://hackerone.com/reports/3355766 [...]
Nextcloud disclosed a bug submitted by eclipse07077: https://hackerone.com/reports/3479692 [...]
This post is adapted from a talk I gave at [un]prompted, the AI security practitioner conference. Thanks to Gadi Evron for inviting me to speak. You can watch the recorded presentation below or download the slides. Most companies hand out ChatGPT licenses and wait for the productivity numbers to move. We built a system instead. A year ago, about 5% of Trail of Bits was on board with our AI initiat [...]
curl disclosed a bug submitted by ankitsingh131225: https://hackerone.com/reports/3636244 [...]
curl disclosed a bug submitted by m42kl33: https://hackerone.com/reports/3636044 [...]
curl disclosed a bug submitted by ok3y: https://hackerone.com/reports/3632427 [...]
arkadiyt-projects disclosed a bug submitted by tipsen: https://hackerone.com/reports/3634400 [...]
arkadiyt-projects disclosed a bug submitted by tipsen: https://hackerone.com/reports/3634571 [...]
An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. [...]
Node.js disclosed a bug submitted by sharp_edged: https://hackerone.com/reports/3511792 [...]
Node.js disclosed a bug submitted by stif: https://hackerone.com/reports/3480841 [...]
Node.js disclosed a bug submitted by x_probe: https://hackerone.com/reports/3533945 [...]
Node.js disclosed a bug submitted by xavlimsg: https://hackerone.com/reports/3559715 [...]
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3560402 [...]
Node.js disclosed a bug submitted by wooseokdotkim: https://hackerone.com/reports/3449392 [...]
Node.js disclosed a bug submitted by galbarnahum: https://hackerone.com/reports/3531737 [...]
Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked in and around cybersecurity. He’s had roles as a computer science teacher, a technology manager, a [...]
curl disclosed a bug submitted by sakthi02_sk: https://hackerone.com/reports/3633534 [...]
curl disclosed a bug submitted by xkiluar: https://hackerone.com/reports/3630310 [...]
Tucows (VDP) disclosed a bug submitted by 2026: https://hackerone.com/reports/3523703 [...]
passhash disclosed a bug submitted by sinic: https://hackerone.com/reports/2441029 [...]
passhash disclosed a bug submitted by sinic: https://hackerone.com/reports/2439734 [...]
Hello hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring: Earning $180K via SSRFs Free Burp Suite Pro licenses for top hackers Bypassing tricky file upload restrictions Injecting malicious code into AI coding assistants And so much more! Let’s dive in! New: PortSwigger collaboration with Intigriti We've teamed up with PortSwigger to reward high-p [...]
A look at how Kubernetes CVE-2020-8561 works [...]
Node.js disclosed a bug submitted by rafaelgss: https://hackerone.com/reports/3546390 [...]
RubyGems disclosed a bug submitted by 6b_jjj: https://hackerone.com/reports/3542546 [...]
curl disclosed a bug submitted by wizard021: https://hackerone.com/reports/3611825 [...]
curl disclosed a bug submitted by ankitsingh_76: https://hackerone.com/reports/3627638 [...]
curl disclosed a bug submitted by 3lcarry: https://hackerone.com/reports/3623064 [...]
Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider di [...]
We’re releasing a new Claude plugin for developing and auditing code that implements dimensional analysis, a technique we explored in our most recent blog post. Most LLM-based security skills ask the model to find bugs. Our new dimensional-analysis plugin for Claude Code takes a different approach: it uses the LLM to annotate your codebase with dimensional types, then flags mismatches mechanically [...]
curl disclosed a bug submitted by tynus: https://hackerone.com/reports/3617719 [...]
At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security researcher community. This month's challenge, brought forward by Kulindu, presented us with a Secure Search Portal that, on the surface, appeared to be well protected. A strict Content Security Policy and DOMPurify sanitization gave the impression that this month's task of executing an XS [...]
IBM disclosed a bug submitted by bugmithalchemist: https://hackerone.com/reports/3592387 [...]
Using dimensional analysis, you can categorically rule out a whole category of logic and arithmetic bugs that plague DeFi formulas. No code changes required, just better reasoning! One of the first lessons in physics is learning to think in terms of dimensions. Physicists can often spot a flawed formula in seconds just by checking whether the dimensions make sense. I once had a teacher who even ke [...]
LinkedIn disclosed a bug submitted by riadalrashed: https://hackerone.com/reports/3604288 [...]
What you will learn How vulnerability disclosure applies specifically to AI safeguards and systems. The pros and cons of making AI disclosure programs more open/restricted. The kinds of incentives that motivate researchers. Which disclosure program structures can help organizations improve their AI security. In a recent NCSC blog post on adapting vulnerability disclosure for AI safeguards, [...]
On March 24 and 27, 2026, malicious PyPI releases of LiteLLM and Telnyx were published as part of the TeamPCP supply chain campaign. We trace the full campaign from Trivy through npm, Checkmarx, and into PyPI. [...]
A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time zone or have Farsi set as the default language. Experts say the wiper campaign against Iran materialized this past weekend and came from a relatively new cybercrime [...]
Python Cryptographic Authority disclosed a bug submitted by uv3doble: https://hackerone.com/reports/3558277 [...]
Mozilla disclosed a bug submitted by adilnbabras: https://hackerone.com/reports/3025797 [...]
curl disclosed a bug submitted by zoroo2: https://hackerone.com/reports/3612891 [...]
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named Aisuru, Kimwolf, JackSkid and Mossad — are responsible for a series of recent record-smashing [...]
Broken access control vulnerabilities have consistently remained at the top of the OWASP Top 10, and for a good reason. As web applications continue to grow in complexity, with the introduction of role-based access controls, multi-tenant support, and granular permission models, the likelihood of access control flaws increases significantly. Unlike other vulnerability classes that often rely on ins [...]
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3527771 [...]
GitHub disclosed a bug submitted by s3rdz0: https://hackerone.com/reports/3522254 [...]
HackerOne disclosed a bug submitted by theokeen: https://hackerone.com/reports/3378540 [...]
curl disclosed a bug submitted by lg_oled77c5pua: https://hackerone.com/reports/3609505 [...]
curl disclosed a bug submitted by am-perip: https://hackerone.com/reports/3608522 [...]
LinkedIn disclosed a bug submitted by dphoeniixx: https://hackerone.com/reports/3475626 [...]
Lovable VDP disclosed a bug submitted by ziadmomen: https://hackerone.com/reports/3591764 [...]
curl disclosed a bug submitted by tavro: https://hackerone.com/reports/3603300 [...]
Basecamp disclosed a bug submitted by perxibes: https://hackerone.com/reports/3467641 - Bounty: $100 [...]
Note: This is a guest post by pentester Julen Garrido Estévez (@b3xal). 1. Acknowledgements 2. Intro 3. Required tools 4. Strategy to solve/exploit the lab 5. Detecting 0.CL 5.1. Practical confirmatio [...]
Consensys disclosed a bug submitted by aszx87410: https://hackerone.com/reports/3507241 [...]
IBM disclosed a bug submitted by cr3ckerxploit: https://hackerone.com/reports/3578842 [...]
curl disclosed a bug submitted by henriqueg: https://hackerone.com/reports/3598444 [...]
curl disclosed a bug submitted by otiscui: https://hackerone.com/reports/3598358 [...]
Register for the webinar: Burp Suite DAST x Burp Suite Professional: Better Together (Thursday, March 19 2026 16:00 UTC) I'm a firm believer that if you want to understand how secure an application re [...]
Your board wants AI. Your developers are building with it. Your budget committee is asking for an ROI timeline. But as CISO, you're the one who has to answer when the inevitable question comes up: "How do we know this is secure?" If you're like most security leaders, you're caught between two impossible positions. Say yes to AI initiatives without proper security controls, and you're responsib [...]