InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
What AI Means For Bug Bounty Report Quality on 09/09/2026
How MercadoLibre Secures A Constantly Moving Platform on 09/09/2026
How AI Changed The Cyber Threat Landscape on 09/09/2026
Black Hat Shows Why Security Teams Need Each Other on 09/09/2026
Why Internal Security Teams Still Need External Researchers on 09/09/2026
How AI Is Changing Web Security and Bug Bounty Programs with Manu Ovejas on 09/09/2026
Driver’s License Data for Sale on 09/09/2026
A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail. [...]
Black Hat VIP Party! #shorts on 09/09/2026
Claude Fable Solves a Historical Cipher on 09/09/2026
Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve lots of searching and testing. [...]
A “proof” of Fermat’s Last Theorem that fits the margin on 09/09/2026
Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown belo [...]
Microsoft Plugs Nearly 1,000 Security Holes by BrianKrebs on 08/09/2026
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and d [...]
We back. on 08/09/2026
AIs as Modern Genies on 08/09/2026
This essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test. Instead of staying in the isolated box the devel [...]
Is the OWASP Top 10 Still Relevant? on 08/09/2026
Defcon Day 1! #shorts on 08/09/2026
22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973143 [...]
Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client on 08/09/2026
MariaDB disclosed a bug submitted by byteoverride: https://hackerone.com/reports/3788482 [...]
Stealing AI Reasoning Traces on 08/09/2026
Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“: Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the [...]
Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking on 08/09/2026
MariaDB disclosed a bug submitted by pinebudweiser: https://hackerone.com/reports/3897914 [...]
49: Cookie-jar save transfers group access to a different GID on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973194 [...]
29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971518 [...]
08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973111 [...]
Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993850 [...]
HTTP Digest nonce reused across an httpshttp scheme change on the same handle on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993973 [...]
How AI has changed the way I think, build, and work. A day in the life of an Intigriti Engineer by Koen Van Hauwe on 08/09/2026
When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI. That probably sounds a bit strange. And, depending on who you're asking, maybe a little unsettling too. But that's genuinely what my working day looks like now, and I think it' [...]
54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free) on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973213 [...]
57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()` on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973219 [...]
43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972293 [...]
36: HTTP upload resume offset consumed twice after early 307/308 redirect on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971706 [...]
11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973121 [...]
MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover on 07/09/2026
MariaDB disclosed a bug submitted by kevin_mizu: https://hackerone.com/reports/3876430 [...]
MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion on 07/09/2026
MariaDB disclosed a bug submitted by v3rtical: https://hackerone.com/reports/3909248 [...]
KILL authorization trusts the presented login name instead of the authenticated anonymous account on 07/09/2026
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3897588 [...]
ACL cache collision lets a role inherit privileges from a same-named socket user on 07/09/2026
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3889667 [...]
Glitching Old Trezor Wallets! #shorts on 07/09/2026
I Gave Claude 12 Years of my Bug Bounty Reports - Here's What I Learned on 07/09/2026
Automobile Camouflage to Hide from Flock Cameras on 07/09/2026
Not sure it’s practical, but it’s certainly striking. [...]
How To Start A Bug Bounty Program The Right Way on 06/09/2026
Teaching Fault Injection at DEF CON! #shorts on 06/09/2026
Black Hat & DEF CON Vlog #shorts on 05/09/2026
Unauthenticated testing endpoint of notify_push expose internal IP on 05/09/2026
Nextcloud disclosed a bug submitted by chinnuy935336: https://hackerone.com/reports/3513471 - Bounty: $150 [...]
Email Enumeration via Password-Protected Share Identity Verification on 05/09/2026
Nextcloud disclosed a bug submitted by cybershinu90: https://hackerone.com/reports/3507273 - Bounty: $100 [...]
Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app on 05/09/2026
Nextcloud disclosed a bug submitted by nishantbaswal1996: https://hackerone.com/reports/3521639 [...]
Missing Duplicate Check allowing Multiple Retention Rules per System Tag on 05/09/2026
Nextcloud disclosed a bug submitted by charankumar39: https://hackerone.com/reports/3521646 [...]
Activity app does not verify federated file activity received from remote servers on 05/09/2026
Nextcloud disclosed a bug submitted by cyebrsunita: https://hackerone.com/reports/3534050 - Bounty: $150 [...]
The Biggest Mistake In Bug Bounty Programs on 04/09/2026
How Security Researchers Should Use AI Responsibly on 04/09/2026
Friday Squid Blogging: Squid on a Stick at the New York State Fair on 04/09/2026
Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope on 04/09/2026
Nextcloud disclosed a bug submitted by njh215: https://hackerone.com/reports/3617729 [...]
Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage. by Tim Erlin on 04/09/2026
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what wo [...]
Using a VM to Contain an AI Agent on 04/09/2026
It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features [...]
CTF Walkthrough: DEF CON Edition on 04/09/2026
Slack getting hacked on my way to Black Hat and DEF CON #shorts on 04/09/2026
Security Vulnerability in a Voting System on 04/09/2026
It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary. Notably, I never touched a voting machine, exploited a network, examine [...]
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks on 04/09/2026
We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code package [...]
API token sent to URL dictated by an untrusted project .weblate file on 04/09/2026
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3825141 [...]
Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate on 04/09/2026
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3898281 [...]
AI Might Give You Malware on 03/09/2026
JHT Course Launch! Python for Cybersecurity on 03/09/2026
Researching Employment Scams on 03/09/2026
Researchers built a fake company to study fake employee scams. [...]
What Makes A Successful Bug Bounty Program Today on 02/09/2026
Two Weeks of Black Hat & DEF CON (Vlog) on 02/09/2026
Hacking AI customer service agents by Ayoub and Inti De Ceukelaire on 02/09/2026
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be. At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defender [...]
FBI Probes Service Selling 153M+ Drivers Licenses by BrianKrebs on 01/09/2026
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity a [...]
Why AI Makes Bug Bounty Programs More Essential on 01/09/2026
3 Cybersecurity Books to Read on 01/09/2026
Why AI Can’t Replace Human Security Researchers on 01/09/2026
Reconnaissance unleashed: Meet CrowdRecon by Radu Voloaga on 01/09/2026
At Intigriti, we have been exploring a simple but important shift in security: the work that happens before a vulnerability report is often where the real signal begins. As vulnerability discovery accelerates, organizations need practical ways to identify and reduce risk before vulnerabilities are used in attacks. In Reconnaissance for exposure management, I discussed how context turns scanning a [...]
Minecraft Malware Lab on 31/08/2026
Give Developers The Full Remediation Package. on 31/08/2026
18: Explicit IPv6 proxy zone ID silently ignored proxy credentials sent to wrong interface on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973127 [...]
33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231) on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971585 [...]
41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973158 [...]
06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973093 [...]
Password spraying campaign targets AWS root user accounts across 150+ organizations on 31/08/2026
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. [...]
RatCTF.com - 26 OSCP machines, FREE memberships and FREE pwnbox - OSEP Path is now live on 30/08/2026
**Unauthenticated IDOR allows modification of payment customer billing information** on 30/08/2026
Weblate disclosed a bug submitted by visionx7: https://hackerone.com/reports/3869124 [...]
Phishing Panel Breadcrumbs on 29/08/2026
50: CMake `HTTP_ONLY` does not disable SSH backends SCP and SFTP remain usable on 29/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973228 [...]
42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions on 29/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973169 [...]
Offsec pricing is mental on 29/08/2026
How To Use AI To Become a KiLLER Hacker on 29/08/2026
Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint on 28/08/2026
IBM disclosed a bug submitted by inventor0x01: https://hackerone.com/reports/3909372 [...]
Author arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata` on 28/08/2026
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931777 [...]
Author stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()` on 28/08/2026
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931771 [...]
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser on 28/08/2026
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3564941 [...]
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) on 28/08/2026
Node.js disclosed a bug submitted by byvini: https://hackerone.com/reports/3857258 [...]
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records on 28/08/2026
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795657 [...]
node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely on 28/08/2026
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795900 [...]
Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 on 28/08/2026
Node.js disclosed a bug submitted by hahahkim: https://hackerone.com/reports/3833629 [...]
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion on 28/08/2026
Node.js disclosed a bug submitted by leduckhuong: https://hackerone.com/reports/3846922 [...]
46: `--libcurl` output carries `--insecure` across `--next` boundaries on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972316 [...]
Why AI Can't Fix Vulnerabilities Alone. on 28/08/2026
28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971496 [...]
34: `curl_mprintf` reads `double` for documented `long double` conversions uninitialized value disclosure on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972196 [...]
--etag-save - truncates append-redirected stdout on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970639 [...]
Stacked --proto modifiers leave denied protocol enabled on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970650 [...]
Intigriti Bug Bytes #239 - August 2026 🚀 by Ayoub on 28/08/2026
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside your email inbox AI doing novel security research: the HTTP Terminator 169 offensive recon skills in one AI-ready toolkit And so much more! Let's dive in! CrowdRecon is coming Most security teams [...]