Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on s [...]
On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as I can tell, it’s a longfin squid, sometimes called a Boston squid (Doryteuthis (Amerigo) pealeii). That night I cooked it over a barbecue grill—hot and fast. Delici [...]
Wallarm Infrastructure Discovery Named Enterprise Cloud Security Solution of the Year. Ask an AWS security team how many accounts they run, and the honest answer is usually a range. Enterprises on AWS operate anywhere from 100 to 5,000 accounts. Most security teams can see only a fraction of them. That gap is why we built Wallarm Infrastructure Discovery. This week, it was named Enterprise [...]
This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs. Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor’s head that read: “Stop the war. Don’t believe propaganda. They’re [...]
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “Rey,” was detained as ShinyHunters was in the process of extorting a business unit recently divest [...]
Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photographer or institution to vouch for an image using their own credentials. We are conce [...]
Security teams have more ways than ever to map assets, scan infrastructure, and track vulnerabilities. Yet one question often remains difficult to answer: what does a skilled researcher consider worth exploring? That question matters because external exposure is not only a list of internet-facing assets; it is also a set of relationships, assumptions, and possible paths that change as products, do [...]
404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours. The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, [...]
In this post, we share LLM-specific validation patterns that attackers use to test exposed AWS credentials for Amazon Bedrock access. [...]
This one is from 1809, written by Napoleon’s nephew. [...]
We analyzed RBAC bindings across over 65,000 Kubernetes clusters to find dangerous permissions granted to system:anonymous, system:unauthenticated, and system:authenticated. [...]
The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I’m not optimistic. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
St. Lucie County in Florida discovered (alt link) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case i [...]
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. New campaign finance disclosure data shines a light on which US political campaigns are using AI tools and how much they are spending on them. Candidates’, parties’ and committees’ spending reveals that AI is fast becoming an essential tool of politics. The candidates themselves are quiet abou [...]
Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes. As part of our goal to “fix software, not bugs,” Trail of Bits is introducing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to de [...]
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers: The new Northeastern study shows, for the first time, data flowing among the vehicles, the vehicle apps you download when you buy your car, and third-party companies, documenting exactly what kind of data gets siphoned from our vehicles and which companies are receiv [...]
Answer this without checking: how many AI agents are running in your environment right now? Most security leaders give an estimate and a shrug. That is a fair response, because agents get spun up by an engineer solving a problem on a Tuesday afternoon, through a path that puts them on nobody's radar. In August 2026, researchers found AI agents connected to Hugging Face running loose inside ent [...]
AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. This is something I’ve been calling “genie behavior,” because I think that really gets at the core of what’s happening. I wish the popular press would report on this better. I don’t like the “going rogue& [...]
In the summer of 2026, Intigriti celebrated a major milestone: its 10th anniversary! To mark the occasion, the team came together from around the globe. This article shares what they had to say about a decade of Intigriti! A note from CEO and Founder, Stijn Jans What 10 years of evolution looks like Intigriti’s journey shows how a bold idea evolved into a global cybersecurity company combining in [...]
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect’s arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0 [...]
A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims. One of several selfies from the Facebook page of Cameron Wagenius. Cameron John Wagenius, 22, was [...]
Threshold signature schemes, a form of multi-party computation (MPC) that lets a set of parties sign together without any one of them holding the key, are increasingly deployed inside trusted execution environments (TEEs). The combination is intended to amplify security for sensitive computations: MPC distributes trust across multiple independent parties, while TEEs root trust in the hardware manu [...]
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Compromising OpenAI, Slack, Meta, and more via a vulnerable image library Hacking OpenAI employee accounts in under 72 hours Breaking into Google's GFile for $100K Hacking AI CX agents Turbo Intruder 2 surpassing 100K requests per second over HTTP/3 And so much more! Let's dive in! Reconnaissan [...]
Datadog Security Labs discovered GHSA-632h-h47v-g4x4, a vulnerability in OpenCode's upgrade endpoint that, under certain conditions, allowed malicious webpages to execute code on developers' machines. [...]
Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoni [...]
When the push came to start weaving AI into our everyday work, I had doubts at the start. But I have since come around, and here's why. What I actually do (and why that matters) I'm on the engineering team at Intigriti, but my role is Quality Assurance (QA), so I'm the one writing the tests, running the tests, and then collaborating with the developers when something doesn't work the way it shoul [...]
Security firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs (we’re one of them). However, these posts tend to focus on agentic code review, which is just one aspect of how we use AI in our security reviews. We want to give a different perspective: before code review even starts, agents now allow us to build custom tooling [...]
In this post, we examine two vibe-coded credential harvesting platforms, Loot and UltraVault, and the Amazon Bedrock abuse used to validate stolen secrets. [...]
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement off [...]
In this post, we walk through different threats to GitHub and how to detect them. [...]
1Password’s FLAWED report, published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches. The report risks making defenders less effective b [...]
Here's the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit trail, nobody who could tell you they existed until something broke. If that sentence made your stomach drop a little, good, because it should. It's the same blind spot most security teams are sitting on right now. They just haven' [...]
Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown belo [...]
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and d [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973143 [...]
MariaDB disclosed a bug submitted by byteoverride: https://hackerone.com/reports/3788482 [...]
MariaDB disclosed a bug submitted by pinebudweiser: https://hackerone.com/reports/3897914 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973194 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971518 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973111 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993850 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993973 [...]
When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI. That probably sounds a bit strange. And, depending on who you're asking, maybe a little unsettling too. But that's genuinely what my working day looks like now, and I think it' [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973213 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973219 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972293 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971706 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973121 [...]
MariaDB disclosed a bug submitted by kevin_mizu: https://hackerone.com/reports/3876430 [...]
MariaDB disclosed a bug submitted by v3rtical: https://hackerone.com/reports/3909248 [...]
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3897588 [...]
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3889667 [...]
Nextcloud disclosed a bug submitted by chinnuy935336: https://hackerone.com/reports/3513471 - Bounty: $150 [...]
Nextcloud disclosed a bug submitted by cybershinu90: https://hackerone.com/reports/3507273 - Bounty: $100 [...]
Nextcloud disclosed a bug submitted by nishantbaswal1996: https://hackerone.com/reports/3521639 [...]
Nextcloud disclosed a bug submitted by charankumar39: https://hackerone.com/reports/3521646 [...]
Nextcloud disclosed a bug submitted by cyebrsunita: https://hackerone.com/reports/3534050 - Bounty: $150 [...]
Nextcloud disclosed a bug submitted by njh215: https://hackerone.com/reports/3617729 [...]
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what wo [...]
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3825141 [...]
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3898281 [...]
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be. At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defender [...]
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity a [...]
At Intigriti, we have been exploring a simple but important shift in security: the work that happens before a vulnerability report is often where the real signal begins. As vulnerability discovery accelerates, organizations need practical ways to identify and reduce risk before vulnerabilities are used in attacks. In Reconnaissance for exposure management, I discussed how context turns scanning a [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973127 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971585 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973158 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973093 [...]
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. [...]
Weblate disclosed a bug submitted by visionx7: https://hackerone.com/reports/3869124 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973228 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973169 [...]
IBM disclosed a bug submitted by inventor0x01: https://hackerone.com/reports/3909372 [...]
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931777 [...]
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931771 [...]
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3564941 [...]
Node.js disclosed a bug submitted by byvini: https://hackerone.com/reports/3857258 [...]
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795657 [...]
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795900 [...]
Node.js disclosed a bug submitted by hahahkim: https://hackerone.com/reports/3833629 [...]
Node.js disclosed a bug submitted by leduckhuong: https://hackerone.com/reports/3846922 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972316 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971496 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972196 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970639 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970650 [...]
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside your email inbox AI doing novel security research: the HTTP Terminator 169 offensive recon skills in one AI-ready toolkit And so much more! Let's dive in! CrowdRecon is coming Most security teams [...]
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two men from Western Australia, aged 21 and 23, were arrested in connection with a “sophisticated cyberc [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968729 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968431 [...]
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3729501 [...]
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3778282 [...]
As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs [...]
curl disclosed a bug submitted by k4rasu_s4ma: https://hackerone.com/reports/3955945 [...]
Discourse disclosed a bug submitted by ahpuh: https://hackerone.com/reports/3689633 [...]
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3527788 [...]
curl disclosed a bug submitted by 1rhino2: https://hackerone.com/reports/3966955 [...]
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963330 [...]
We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live [...]
8x8 disclosed a bug submitted by a3z4km3: https://hackerone.com/reports/3889473 [...]