Sen. Sanders Talks to Claude About AI and Privacy on 10/04/2026
Claude is actually pretty good on the issues. [...]
InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
Is ClaudeAI useful for bug bounty? on 10/04/2026
Open Redirect in Rocket.Chat on 10/04/2026
Rocket.Chat disclosed a bug submitted by soohyun: https://hackerone.com/reports/3418031 [...]
[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/] on 10/04/2026
Mozilla disclosed a bug submitted by adilnbabras: https://hackerone.com/reports/3020021 [...]
User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon on 10/04/2026
Mozilla disclosed a bug submitted by adilnbabras: https://hackerone.com/reports/3325582 [...]
Protecting Cookies with Device Bound Session Credentials on 09/04/2026
Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to co [...]
HUGE AI-powered Microsoft Account phishing campaign on 09/04/2026
How New AI Models Are Reshaping Cyber Risk at Scale on 09/04/2026
Memory leak in gem decode logic can allow attacker to take down Rubygems.org application on 09/04/2026
RubyGems disclosed a bug submitted by mclaren650sspider: https://hackerone.com/reports/3079931 [...]
What are WebSockets? on 09/04/2026
Master C and C++ with our new Testing Handbook chapter on 09/04/2026
We added a new chapter to our Testing Handbook: a comprehensive security checklist for C and C++ code. We’ve identified a broad range of common bug classes, known footguns, and API gotchas across C and C++ codebases and organized them into sections covering Linux, Windows, and seccomp. Whereas other handbook chapters focus on static and dynamic analysis, this chapter offers a strong basis for manu [...]
On Microsoft’s Lousy Cloud Security on 09/04/2026
ProPublica has a scoop: In late 2024, the federal government’s cybersecurity evaluators rendered a troubling verdict on one of Microsoft’s biggest cloud computing offerings. The tech giant’s “lack of proper detailed security documentation” left reviewers with a “lack of confidence in assessing the system’s overall security posture,” according to an i [...]
Is Cybersecurity Dead? Should You Start Bug Bounty? on 09/04/2026
libcurl: Integer truncation in curl_easy_ssls_import() causes TLS sessions to never expire on 09/04/2026
curl disclosed a bug submitted by adityasunny_06: https://hackerone.com/reports/3658049 [...]
Bye Bye Bellini! | Andrew Bellini's Farewell Stream | Cybersecurity | AMA on 09/04/2026
How Netwrix Scales Securely on AWS with Bugcrowd on 09/04/2026
Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8562 on 09/04/2026
A look at how Kubernetes CVE-2020-8562 allows attackers to bypass API server proxy protections using DNS rebinding [...]
wasResumeUsed on /api-internal/api.htm endpoint leaking other user's resume usage status on 08/04/2026
Glassdoor disclosed a bug submitted by auxilus: https://hackerone.com/reports/909084 [...]
Account Takeover on 08/04/2026
Glassdoor disclosed a bug submitted by amakki: https://hackerone.com/reports/970763 [...]
Open Redirect on 08/04/2026
Glassdoor disclosed a bug submitted by z3ron3: https://hackerone.com/reports/818094 [...]
robots take over the world or something i guess idk on 08/04/2026
How Teenage Hackers Hijack the Internet (with Joe Tidy!) on 08/04/2026
Python Supply-Chain Compromise on 08/04/2026
This is news: A malicious supply chain compromise has been identified in the Python Package Index package litellm version 1.82.8. The published wheel contains a malicious .pth file (litellm_init.pth, 34,628 bytes) which is automatically executed by the Python interpreter on every startup, without requiring any explicit import of the litellm module. There are a lot of really boring things we need t [...]
Cybersecurity in the Age of Instant Software on 07/04/2026
AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: “instant software.” Taken to an extreme, it might become easier for a user to have an AI write an application on demand—a spreadsheet, for example—and delete it when you’re done using it than to buy one commercially. Future systems could i [...]
Russia Hacked Routers to Steal Microsoft Office Tokens by BrianKrebs on 07/04/2026
Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code. Micros [...]
Health check errors silently dropped when channel buffer full on 07/04/2026
AWS VDP disclosed a bug submitted by misop00p: https://hackerone.com/reports/3620761 [...]
Hackers make FAKE notifications on 07/04/2026
IDOR on via direct photo URL leads to unauthorized access to deleted and other users' photos on 07/04/2026
Nextcloud disclosed a bug submitted by shiva2550: https://hackerone.com/reports/3518758 [...]
PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses on 07/04/2026
More power for bug hunters An education-first approach to bug bounty Rewards on Meta's Bug Bounty Platform Our shared vision Ready to get started? We’re excited to announce a new partnership with Meta [...]
What we learned about TEE security from auditing WhatsApp's Private Inference on 07/04/2026
WhatsApp’s new “Private Inference” feature represents one of the most ambitious attempts to combine end-to-end encryption with AI-powered capabilities, such as message summarization. To make this possible, Meta built a system that processes encrypted user messages inside trusted execution environments (TEEs), secure hardware enclaves designed so that not even Meta can access the plaintext. Our now [...]
Hong Kong Police Can Force You to Reveal Your Encryption Keys on 07/04/2026
According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc.—even if you are just transiting the airport. In a security alert dated March 26, the U.S. Consulate General said that, on March 23, 2026, Hong Kong authorities changed the rules governing enforcement of the National Security Law. Under the revised fra [...]
no_proxy IDN mismatch: Unicode hostnames bypass proxy exclusion list on 07/04/2026
curl disclosed a bug submitted by mzfr: https://hackerone.com/reports/3650443 [...]
FTP entrypath accepts 0xFF (Telnet IAC) through incomplete ISCNTRL filter, sent on wire via CWD on connection reuse on 07/04/2026
curl disclosed a bug submitted by mzfr: https://hackerone.com/reports/3650473 [...]
Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurl on 07/04/2026
curl disclosed a bug submitted by cutiapretaa: https://hackerone.com/reports/3650435 [...]
Five key takeaways from the UK’s new Cyber Security & Resilience Bill by Ed Parsons on 07/04/2026
The content of the Cyber Security & Resilience Bill (CSRB) recently introduced to Parliament contained few surprises. Having spent a significant amount of time working with European cyber-security frameworks, particularly NIS2, I see the Bill as both a continuation of the trend towards common approaches, and a signal of how seriously governments now take cyber risk. From my perspective, there are [...]
Cross-Site Leakage of Review Ownership via Navigation Detection on 06/04/2026
Glassdoor disclosed a bug submitted by downgrade: https://hackerone.com/reports/2516237 [...]
eflected Vulnerability in Glassdoor Blog earch on 06/04/2026
Glassdoor disclosed a bug submitted by zorixu: https://hackerone.com/reports/2682538 [...]
Full account takeover without user Interaction on 06/04/2026
Glassdoor disclosed a bug submitted by imtheking: https://hackerone.com/reports/1820146 [...]
New Mexico’s Meta Ruling and Encryption on 06/04/2026
Mike Masnick points out that the recent New Mexico court ruling against Meta has some bad implications for end-to-end encryption, and security in general: If the “design choices create liability” framework seems worrying in the abstract, the New Mexico case provides a concrete example of where it leads in practice. One of the key pieces of evidence the New Mexico attorney general used [...]
Reported Denial of Service on 06/04/2026
Monero disclosed a bug submitted by jehrenhofermagicgrants: https://hackerone.com/reports/3241102 [...]
Reported RPC Overflow on 06/04/2026
Monero disclosed a bug submitted by jehrenhofermagicgrants: https://hackerone.com/reports/3240792 [...]
Unauthorized usage of External API Key (Usage of Google Maps API Key ==> $$$ on 06/04/2026
Glassdoor disclosed a bug submitted by avielt: https://hackerone.com/reports/881118 [...]
100 criticals in one week? Great news. Also… a lot 😅 on 06/04/2026
AI Chatbots Can Hijack Accounts: The New XSS Threat on 06/04/2026
Markdown Image Vulnerability Quick Security Test on 06/04/2026
An AI Hacker Showed Me How to Exfil Data in Zero Clicks on 06/04/2026
Google Wants to Transition to Post-Quantum Cryptography by 2029 on 06/04/2026
Google says that it will fully transition to post-quantum cryptography by 2029. I think this is a good move, not because I think we will have a useful quantum computer anywhere near that year, but because crypto-agility is always a good thing. Slashdot thread. [...]
Capie is 1 euro on 06/04/2026
# SCURLOPT_SSH_KNOWNHOSTS and host fingerprint pins are silently bypassed when an SSH connection is reused from the connection pool on 06/04/2026
curl disclosed a bug submitted by spiderchan26: https://hackerone.com/reports/3645415 [...]
SMTP Command Injection via CRLF in libcurl MAIL_FROM / MAIL_RCPT (lib/smtp.c) on 06/04/2026
curl disclosed a bug submitted by divsz: https://hackerone.com/reports/3651975 [...]
Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab by BrianKrebs on 06/04/2026
An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021. Shchukin was n [...]
ignoring 'options' when doing connection reuse on 05/04/2026
curl disclosed a bug submitted by spichanlio76: https://hackerone.com/reports/3646914 [...]
Exploiting XSS Via Markdown - Medium Reading on 04/04/2026
Data race in Curl_dnscache_add_negative() corrupts shared DNS cache heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNS on 04/04/2026
curl disclosed a bug submitted by intrax: https://hackerone.com/reports/3645361 [...]
AI Cyber Defense Ops Course Launch! on 04/04/2026
Internal application wrapper or script using curl on 03/04/2026
curl disclosed a bug submitted by rougerseven7: https://hackerone.com/reports/3648199 [...]
Friday Squid Blogging: Jurassic Fish Chokes on Squid on 03/04/2026
Here’s a fossil of a 150-million year old fish that choked to death on a belemnite rostrum: the hard, internal shell of an extinct, squid-like animal. Original paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Getting Started With The Windows Registry on 03/04/2026
Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoning on 03/04/2026
curl disclosed a bug submitted by intrax71: https://hackerone.com/reports/3640932 [...]
Cookie attribute TAB injection regression in Set-Cookie parsing on 03/04/2026
curl disclosed a bug submitted by calaba_zas: https://hackerone.com/reports/3641893 [...]
Extremely Easy Identity Management (with Authentik!) on 03/04/2026
Company that Secretly Records and Publishes Zoom Meetings on 03/04/2026
WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes (alternate link) the recordings. It doesn’t use the Zoom record feature, so Zoom can’t do anything about it. [...]
Simplifying MBA obfuscation with CoBRA on 03/04/2026
Mixed Boolean-Arithmetic (MBA) obfuscation disguises simple operations like x + y behind tangles of arithmetic and bitwise operators. Malware authors and software protectors rely on it because no standard simplification technique covers both domains simultaneously; algebraic simplifiers don’t understand bitwise logic, and Boolean minimizers can’t handle arithmetic. We’re releasing CoBRA, an [...]
The Payload Podcast #005 - AI with Shane Caldwell on 03/04/2026
US Bans All Foreign-Made Consumer Routers on 02/04/2026
This is for new routers; you don’t have to throw away your existing ones: The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U [...]
Google Workspace’s continuous approach to mitigating indirect prompt injections on 02/04/2026
Posted by Adam Gavish, Google GenAI Security TeamIndirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This ma [...]
OWASP Salem XSS talk on 02/04/2026
Mutation testing for the agentic era on 01/04/2026
Code coverage is one of the most dangerous quality metrics in software testing. Many developers fail to realize that code coverage lies by omission: it measures execution, not verification. Test suites with high coverage can obfuscate the fact that critical functionality is untested as software develops over time. We saw this when mutation testing uncovered a high-severity Arkis protocol vulnerabi [...]
BugQuest 2026: 31 Days of Broken Access Control by Ayoub on 01/04/2026
In March 2026, we ran BugQuest, a 31-day campaign covering everything you need to know about finding and exploiting broken access control vulnerabilities. From understanding the basics of authentication and authorization to spotting subtle authorization bypasses in real code, we broke down one of the most critical vulnerability classes in modern web applications. Broken access controls have consis [...]
Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurl on 31/03/2026
curl disclosed a bug submitted by whitehat411: https://hackerone.com/reports/3639277 [...]
Use-After-Free race condition in url_move_hostname() via shared connection pool on 31/03/2026
curl disclosed a bug submitted by h3xb1tx: https://hackerone.com/reports/3638715 [...]
VRP 2025 Year in Review on 31/03/2026
Posted by Dirk Göhmann, Tony Mendez, and the Vulnerability Rewards Program Team2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under [...]
Subscraper - the tool you have been missing on 31/03/2026
Endless bundle sales on 31/03/2026
Fomo is a real thing 😝 on 31/03/2026
DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version) on 31/03/2026
Sony disclosed a bug submitted by resurrect20: https://hackerone.com/reports/3355766 [...]
How Digital Forensics Caught the BTK Killer on 31/03/2026
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass on 31/03/2026
Nextcloud disclosed a bug submitted by eclipse07077: https://hackerone.com/reports/3479692 [...]
How we made Trail of Bits AI-native (so far) on 31/03/2026
This post is adapted from a talk I gave at [un]prompted, the AI security practitioner conference. Thanks to Gadi Evron for inviting me to speak. You can watch the recorded presentation below or download the slides. Most companies hand out ChatGPT licenses and wait for the productivity numbers to move. We built a system instead. A year ago, about 5% of Trail of Bits was on board with our AI initiat [...]
HUGE npm axios supply chain attack on 31/03/2026
HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection Reuse on 31/03/2026
curl disclosed a bug submitted by ankitsingh131225: https://hackerone.com/reports/3636244 [...]
HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89) on 31/03/2026
curl disclosed a bug submitted by m42kl33: https://hackerone.com/reports/3636044 [...]
Unbounded GZIP Decompression Leading to Event-Loop Starvation on 31/03/2026
curl disclosed a bug submitted by ok3y: https://hackerone.com/reports/3632427 [...]
🚨 NPM axios Supply Chain Attack 🚨 on 31/03/2026
SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48) on 31/03/2026
arkadiyt-projects disclosed a bug submitted by tipsen: https://hackerone.com/reports/3634400 [...]
Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes on 31/03/2026
arkadiyt-projects disclosed a bug submitted by tipsen: https://hackerone.com/reports/3634571 [...]
Compromised axios npm package delivers cross-platform RAT on 31/03/2026
An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. [...]
HashDoS in V8 on 30/03/2026
Node.js disclosed a bug submitted by sharp_edged: https://hackerone.com/reports/3511792 [...]
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure on 30/03/2026
Node.js disclosed a bug submitted by stif: https://hackerone.com/reports/3480841 [...]
Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery on 30/03/2026
Node.js disclosed a bug submitted by x_probe: https://hackerone.com/reports/3533945 [...]
Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net` on 30/03/2026
Node.js disclosed a bug submitted by xavlimsg: https://hackerone.com/reports/3559715 [...]
Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) on 30/03/2026
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3560402 [...]
CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown on 30/03/2026
Node.js disclosed a bug submitted by wooseokdotkim: https://hackerone.com/reports/3449392 [...]
Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion on 30/03/2026
Node.js disclosed a bug submitted by galbarnahum: https://hackerone.com/reports/3531737 [...]
I Earned $2M Hacking. Here's Everything I Know on 30/03/2026
CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First by Tim Erlin on 30/03/2026
Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked in and around cybersecurity. He’s had roles as a computer science teacher, a technology manager, a [...]
CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injection on 30/03/2026
curl disclosed a bug submitted by sakthi02_sk: https://hackerone.com/reports/3633534 [...]
HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoning on 29/03/2026
curl disclosed a bug submitted by xkiluar: https://hackerone.com/reports/3630310 [...]
Password Strength Policy Bypass via Server-Side Validation Flaw on 27/03/2026
Tucows (VDP) disclosed a bug submitted by 2026: https://hackerone.com/reports/3523703 [...]