InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

How AI has changed the way I think, build, and work. A day in the life of an Intigriti Engineer

by Koen Van Hauwe on 08/09/2026

When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI. That probably sounds a bit strange. And, depending on who you're asking, maybe a little unsettling too. But that's genuinely what my working day looks like now, and I think it' [...]

InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

How AI has changed the way I think, build, and work. A day in the life of an Intigriti Engineer

Glitching Old Trezor Wallets! #shorts

I Gave Claude 12 Years of my Bug Bounty Reports - Here's What I Learned

Automobile Camouflage to Hide from Flock Cameras

How To Start A Bug Bounty Program The Right Way

Teaching Fault Injection at DEF CON! #shorts

Black Hat & DEF CON Vlog #shorts

The Biggest Mistake In Bug Bounty Programs

How Security Researchers Should Use AI Responsibly

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage.

Using a VM to Contain an AI Agent

CTF Walkthrough: DEF CON Edition

Slack getting hacked on my way to Black Hat and DEF CON #shorts

Security Vulnerability in a Voting System

AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

AI Might Give You Malware

JHT Course Launch! Python for Cybersecurity

Researching Employment Scams

What Makes A Successful Bug Bounty Program Today

AI Agents Are Now Emailing Me with Their Security Concerns

Two Weeks of Black Hat & DEF CON (Vlog)

Wireless Routers as Motion Detectors

Hacking AI customer service agents

FBI Probes Service Selling 153M+ Drivers Licenses

Why AI Makes Bug Bounty Programs More Essential

What’s the Scam?

3 Cybersecurity Books to Read

Leaked Russian Cyber-Operations Training Materials

Why AI Can’t Replace Human Security Researchers

Reconnaissance unleashed: Meet CrowdRecon

Minecraft Malware Lab

Give Developers The Full Remediation Package.

18: Explicit IPv6 proxy zone ID silently ignored proxy credentials sent to wrong interface

33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Password spraying campaign targets AWS root user accounts across 150+ organizations

RatCTF.com - 26 OSCP machines, FREE memberships and FREE pwnbox - OSEP Path is now live

**Unauthenticated IDOR allows modification of payment customer billing information**

Phishing Panel Breadcrumbs

50: CMake `HTTP_ONLY` does not disable SSH backends SCP and SFTP remain usable

42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Offsec pricing is mental

How To Use AI To Become a KiLLER Hacker

Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

Author arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

Author stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records

node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely

Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

46: `--libcurl` output carries `--insecure` across `--next` boundaries

Why AI Can't Fix Vulnerabilities Alone.

28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

34: `curl_mprintf` reads `double` for documented `long double` conversions uninitialized value disclosure

--etag-save - truncates append-redirected stdout

Stacked --proto modifiers leave denied protocol enabled

Intigriti Bug Bytes #239 - August 2026 🚀

GitHub Hacker EXPOSED BY HIS CAT

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

False Positives Burn Developer Trust.

Unbound cross-peer HTTP Digest challenge state

ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)

Critical SQL Injection WDM API ()

Real Folks of Cyber | Joel Valenzuela | DITL

Device Code Phishing

VMs won't contain cyber-capable agents

Why Vulnerability Remediation Gets Blocked.

curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization

Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating

TLS session cache case-folds CA paths and bypasses the active trust profile

How to Build a Home Lab for Cheap!

libcurl Digest/NTLM authentication ignores an explicit Authorization header

Unauthenticated IDOR allows modification of payment customer billing information