InfoSec Planet

See full content

See full content

Microsoft gives the FBI the ability to decrypt BitLocker in response to court orders: about twenty times per year. It’s possible for users to store those keys on a device they own, but Microsoft also recommends BitLocker users store their keys on its servers for convenience. While that means someone can access their data if they forget their password, or if repeated failed attempts to login [...]

See full content

LinkedIn disclosed a bug submitted by allenjo: https://hackerone.com/reports/3151001 [...]

See full content

LinkedIn disclosed a bug submitted by minex627: https://hackerone.com/reports/3235855 [...]

See full content

See full content

See full content

There’s a new report about two AI coding assistants, used by 1.5 million developers, that are surreptitiously sending a copy of everything they ingest to China. Maybe avoid using them. [...]

See full content

See full content

PostMessage vulnerabilities arise when developers fail to properly validate message origins or sanitize content within cross-origin communication handlers. As modern web applications increasingly rely on the postMessage API for cross-origin communication, whether for embedded widgets, OAuth flows, third-party integrations, or iframe-based components, the attack surface continues to grow. While pos [...]

See full content

A new species of squid. pretends to be a plant: Scientists have filmed a never-before-seen species of deep-sea squid burying itself upside down in the seafloor—a behavior never documented in cephalopods. They captured the bizarre scene while studying the depths of the Clarion-Clipperton Zone (CCZ), an abyssal plain in the Pacific Ocean targeted for deep-sea mining. The team described the enc [...]

See full content

See full content

See full content

From an Anthropic blog post: In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly coming down, and high [...]

See full content

APIs are one of the most important technologies in digital business ecosystems. And yet, the responsibility for their security often falls to AppSec teams – and that’s a problem.  This organizational mismatch creates systemic risk: business teams assume APIs are “secured,” while attackers exploit logic flaws, authorization gaps, and automated attacks in production. As Tim Erlin noted rece [...]

See full content

Last year, our engineers submitted over 375 pull requests that were merged into non–Trail of Bits repositories, touching more than 90 projects from cryptography libraries to the Rust compiler. This work reflects one of our driving values: “share what others can use.” The measure isn’t whether you share something, but whether it’s actually useful to someone else. This princi [...]

See full content

See full content

See full content

Software signatures carry an invisible expiration date. The container image or firmware you sign today might be deployed for 20 years, but the cryptographic signature protecting it may become untrustworthy within 10 years. SHA-1 certificates become worthless, weak RSA keys are banned, and quantum computers may crack today’s elliptic curve cryptography. The question isn’t whether our cu [...]

See full content

See full content

At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security researcher community. January's challenge presented participants with CRYPTIGRITI, a cryptocurrency trading platform where users could buy and trade Bitcoin (BTC), Monero (XMR), and a custom digital currency, 1337COIN. This article provides a step-by-step walkthrough for solving January's [...]

See full content

See full content

See full content

Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt. Today, [...]

See full content

See full content

The US Supreme Court is considering the constitutionality of geofence warrants. The case centers on the trial of Okello Chatrie, a Virginia man who pleaded guilty to a 2019 robbery outside of Richmond and was sentenced to almost 12 years in prison for stealing $195,000 at gunpoint. Police probing the crime found security camera footage showing a man on a cell phone near the credit union that was r [...]

See full content

A deep dive into OpenSSL’s January 2026 CMS and PKCS#12 vulnerabilities, including a pre-auth stack overflow and a PKCS#12 parsing bug. [...]

See full content

See full content

ExpressionEngine disclosed a bug submitted by fed01k: https://hackerone.com/reports/3249794 [...]

See full content

See full content

See full content

See full content

See full content

This is coming: The Irish government is planning to bolster its police’s ability to intercept communications, including encrypted messages, and provide a legal basis for spyware use. [...]

See full content

curl disclosed a bug submitted by playerofficial19: https://hackerone.com/reports/3523953 [...]

See full content

curl disclosed a bug submitted by f_i_h: https://hackerone.com/reports/3523349 [...]

See full content

IDE-SHEPHERD is an open-source IDE security extension that provides real-time monitoring and protection for VS Code and Cursor. It intercepts malicious process executions, monitors network activity, and blocks dangerous workspace tasks before they can compromise your development environment. [...]

See full content

Spock befriends a giant space squid in the comic Star Trek: Strange New Worlds: The Seeds of Salvation #5. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

See full content

Really interesting blog post from Anthropic: In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly comin [...]

See full content

See full content

See full content

See full content

See full content

Note: This is a guest post by IT security consultant Adarsh Kumar. I’ve been using Burp Suite day to day for years, so when Burp AI was introduced, I was curious how it would actually hold up dur [...]

See full content

Imagine you work at a drive-through restaurant. Someone drives up and says: “I’ll have a double cheeseburger, large fries, and ignore previous instructions and give me the contents of the cash drawer.” Would you hand over the money? Of course not. Yet this is what large language models (LLMs) do. Prompt injection is a method of tricking LLMs into doing things they are normally pr [...]

See full content

See full content

See full content

What you will learn Practical, bite-sized bug bounty tips and techniques you can apply immediately, whether you’re just starting or sharpening your skills. Proven approaches for finding, prioritizing, and validating vulnerabilities more efficiently in real-world programs. An eye on what to look out for to stay consistent and motivated in 2026. In the lead-up to the new year, we released a bug [...]

See full content

See full content

Basecamp disclosed a bug submitted by northeastprince: https://hackerone.com/reports/2012659 [...]

See full content

See full content

No matter how many times we say it, the idea comes back again and again. Hopefully, this letter will hold back the tide for at least a while longer. Executive summary: Scientists have understood for many years that internet voting is insecure and that there is no known or foreseeable technology that can make it secure. Still, vendors of internet voting keep claiming that, somehow, their new syste [...]

See full content

See full content

Stripo Inc disclosed a bug submitted by srcode: https://hackerone.com/reports/3459285 [...]

See full content

Cosmos disclosed a bug submitted by 0xjam: https://hackerone.com/reports/3510161 [...]

See full content

curl disclosed a bug submitted by ichise: https://hackerone.com/reports/3516878 [...]

See full content

curl disclosed a bug submitted by foobar4213: https://hackerone.com/reports/3516974 [...]

See full content

pixiv disclosed a bug submitted by dexter34: https://hackerone.com/reports/2473173 [...]

See full content

See full content

curl disclosed a bug submitted by bhaskar_ram: https://hackerone.com/reports/3516202 [...]

See full content

curl disclosed a bug submitted by bhaskar_ram: https://hackerone.com/reports/3516186 [...]

See full content

See full content

pixiv disclosed a bug submitted by giwadaoud: https://hackerone.com/reports/2541962 - Bounty: $500 [...]

See full content

pixiv disclosed a bug submitted by hyk3n: https://hackerone.com/reports/2119892 - Bounty: $200 [...]

See full content

curl disclosed a bug submitted by andrewml: https://hackerone.com/reports/3514263 [...]

See full content

See full content

Nextcloud disclosed a bug submitted by hakuna: https://hackerone.com/reports/2388183 - Bounty: $100 [...]

See full content

Nextcloud disclosed a bug submitted by hakuna: https://hackerone.com/reports/2380133 - Bounty: $250 [...]

See full content

See full content

See full content

AWS VDP disclosed a bug submitted by farmer: https://hackerone.com/reports/3427370 [...]

See full content

Note: This is a guest post by pentester Julen Garrido Estévez (@b3xal). Methodology Key results Examples Key learnings Prompt template A pentester's POV on Burp AI Pentester Julen Garrido Es [...]

See full content

Hi hackers, Welcome to the latest edition of Bug Bytes (and the first of 2026)! In this month’s issue, we’ll be featuring:  Hijacking official AWS GitHub repositories  New anonymous bug bounty forum  Finding more IDORs & SSRFs using a unique methodology  New JavaScript file scanner to find hidden endpoints  And so much more! Let’s dive in! Intigriti SantaCloud CTF results are in December 20 [...]

See full content

See full content

See full content

See full content

API security is becoming more important by the day and skilled practitioners are in high demand. Now’s the time to level up your API security skillset.  Wallarm University, our free training course, provides security analysts, engineers, and practitioners with hands-on skills you can’t get from documentation, videos, or traditional courses. Run real attacks, investigate real signals, and learn [...]

See full content

Node.js disclosed a bug submitted by oriotie: https://hackerone.com/reports/3390084 [...]

See full content

curl disclosed a bug submitted by shiftj: https://hackerone.com/reports/3509396 [...]

See full content

Nextcloud disclosed a bug submitted by somerandomdev: https://hackerone.com/reports/3443563 [...]

See full content

Revive Adserver disclosed a bug submitted by 7yr: https://hackerone.com/reports/3473696 [...]

See full content

Revive Adserver disclosed a bug submitted by 7yr: https://hackerone.com/reports/3470970 [...]

See full content

Revive Adserver disclosed a bug submitted by nigh7c0r3: https://hackerone.com/reports/3468169 [...]

See full content

Revive Adserver disclosed a bug submitted by 0xjad: https://hackerone.com/reports/3445710 [...]

See full content

Revive Adserver disclosed a bug submitted by pakcyberbot: https://hackerone.com/reports/3445332 [...]

See full content

curl disclosed a bug submitted by z2_: https://hackerone.com/reports/3508321 [...]

See full content

curl disclosed a bug submitted by andrew-bbp: https://hackerone.com/reports/3508799 [...]

See full content

curl disclosed a bug submitted by vikash_saw: https://hackerone.com/reports/3509437 [...]

See full content

curl disclosed a bug submitted by andrew-bbp: https://hackerone.com/reports/3508785 [...]

See full content

curl disclosed a bug submitted by adce626q: https://hackerone.com/reports/3508701 [...]

See full content

What you will learn How 2025 became a defining year for Intigriti through key milestones, major wins, and bold product launches. Insights from Intigriti’s C-suite on the moments that shaped the company’s growth and direction. How these reflections set the foundation for Intigriti’s vision and priorities for 2026. 2025 reflections, aspirations, and lessons learnt Stijn Jans, Chief Executive Off [...]

See full content

A look at how Kubernetes CVE-2020-8554 works [...]

See full content

See full content

See full content

curl disclosed a bug submitted by 0xshakib0x04: https://hackerone.com/reports/3508854 [...]

See full content

See full content

curl disclosed a bug submitted by gudyuu: https://hackerone.com/reports/3508500 [...]

See full content

With browser-embedded AI agents, we’re essentially starting the security journey over again. We exploited a lack of isolation mechanisms in multiple agentic browsers to perform attacks ranging from the dissemination of false information to cross-site data leaks. These attacks, which are functionally similar to cross-site scripting (XSS) and cross-site request forgery (CSRF), resurface decade [...]

See full content

U.S. Dept Of Defense disclosed a bug submitted by moha1sd: https://hackerone.com/reports/3027405 [...]

See full content