InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of
by Tim Erlin on 14/09/2026
Here's the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit trail, nobody who could tell you they existed until something broke. If that sentence made your stomach drop a little, good, because it should. It's the same blind spot most security teams are sitting on right now. They just haven' [...]
See full content
Using AI for Weapons Development
on 14/09/2026
Last week, Anthropic released a long and detailed document describing current misuses of their Claude models. I’m still reading it, but I wanted to flag this:
We identified a cell of threat actors based in northern Yemen running three weapons development programs: a guided rocket that used a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missi [...]
See full content
Our Booth at DEF CON! #shorts
on 14/09/2026
See full content
How PayPal Is Rethinking Security in the Age of AI
on 14/09/2026
See full content
Builders&Breakers | Building Hackbots: Models, Harnesses and Human Expertise with Hamid Kashfi
on 14/09/2026
See full content
Microsoft’s Patching
on 14/09/2026
Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record:
Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.
It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some [...]
See full content
Met Cosmodium Cybersecurity at DEF CON! #shorts
on 13/09/2026
See full content
Meeting Laurie Wired at Black Hat #shorts
on 12/09/2026
See full content
Minecraft Meets Security Research
on 12/09/2026
See full content
Friday Squid Blogging: Rotting Squid on a Beached California Boat
on 11/09/2026
Smells awful:
But an estimated 30 to 50 tons of dead squid remain inside the boat’s catch tank, where they have been decomposing for days. “That is nasty. I wouldn’t want to do that,” said commercial fisherman Dick Ogg of the Bodega Bay Fishermen’s Marketing Association.
Ogg said anyone familiar with the fishing industry understands what happens when a large catch si [...]
See full content
TryHackMe? Nah… HTB? Not even maybe - RatCTF.com - come hack this rat for free right now
on 11/09/2026
See full content
My Talk at DEF CON
on 11/09/2026
Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers. It’s a combination of the potentialities I raised in my 2022 book A Hacker’s Mind and the lessons we’re learning from current AI models engaging in hacking behavior. I’m really proud of the talk, and the fact that it gained over 100K views on YouTube in just a few days.
Also online is [...]
See full content
Google Bug Hunter Event at Caesars Palace! 🕵️♂️ #shorts
on 11/09/2026
See full content
Cliff Stoll’s DEF CON Talk
on 11/09/2026
In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago.
Great fun.
[...]
See full content
I am BACK rat pack!
on 10/09/2026
See full content
Let AI Build Tripwires
on 10/09/2026
See full content
Exhausted But Thrilled: Teaching Fault Injection at DEF CON! #shorts
on 10/09/2026
See full content
I Turned the Open Internet Into a Minecraft World
on 10/09/2026
See full content
AIs Compress Exploit Timeline
on 10/09/2026
Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it.
What’s worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we& [...]
See full content
Noob Village CTF Walkthrough | DEF CON | Cybersecurity AMA
on 10/09/2026
See full content
What AI Means For Bug Bounty Report Quality
on 09/09/2026
See full content
How MercadoLibre Secures A Constantly Moving Platform
on 09/09/2026
See full content
How AI Changed The Cyber Threat Landscape
on 09/09/2026
See full content
Black Hat Shows Why Security Teams Need Each Other
on 09/09/2026
See full content
Why Internal Security Teams Still Need External Researchers
on 09/09/2026
See full content
How AI Is Changing Web Security and Bug Bounty Programs with Manu Ovejas
on 09/09/2026
See full content
Driver’s License Data for Sale
on 09/09/2026
A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail.
[...]
See full content
Black Hat VIP Party! #shorts
on 09/09/2026
See full content
Claude Fable Solves a Historical Cipher
on 09/09/2026
Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes.
This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve lots of searching and testing.
EDITED TO ADD (9/14): I’m not sure if this result is correct. The blog comments have more discussion.
[...]
See full content
A “proof” of Fermat’s Last Theorem that fits the margin
on 09/09/2026
Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown belo [...]
See full content
Microsoft Plugs Nearly 1,000 Security Holes
by BrianKrebs on 08/09/2026
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and d [...]
See full content
We back.
on 08/09/2026
See full content
AIs as Modern Genies
on 08/09/2026
This essay was written with Barath Raghavan, and originally appeared in Lawfare.
In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test. Instead of staying in the isolated box the devel [...]
See full content
Is the OWASP Top 10 Still Relevant?
on 08/09/2026
See full content
Defcon Day 1! #shorts
on 08/09/2026
See full content
22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal
on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973143 [...]
See full content
Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client
on 08/09/2026
MariaDB disclosed a bug submitted by byteoverride: https://hackerone.com/reports/3788482 [...]
See full content
Stealing AI Reasoning Traces
on 08/09/2026
Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“:
Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the [...]
See full content
Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
on 08/09/2026
MariaDB disclosed a bug submitted by pinebudweiser: https://hackerone.com/reports/3897914 [...]
See full content
49: Cookie-jar save transfers group access to a different GID
on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973194 [...]
See full content
29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides
on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971518 [...]
See full content
08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path
on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973111 [...]
See full content
Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass
on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993850 [...]
See full content
HTTP Digest nonce reused across an httpshttp scheme change on the same handle
on 08/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993973 [...]
See full content
How AI has changed the way I think, build, and work. A day in the life of an Intigriti Engineer
by Koen Van Hauwe on 08/09/2026
When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI.
That probably sounds a bit strange. And, depending on who you're asking, maybe a little unsettling too. But that's genuinely what my working day looks like now, and I think it' [...]
See full content
54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)
on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973213 [...]
See full content
57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`
on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973219 [...]
See full content
43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect
on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972293 [...]
See full content
36: HTTP upload resume offset consumed twice after early 307/308 redirect
on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971706 [...]
See full content
11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first
on 07/09/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973121 [...]
See full content
MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover
on 07/09/2026
MariaDB disclosed a bug submitted by kevin_mizu: https://hackerone.com/reports/3876430 [...]
See full content
MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion
on 07/09/2026
MariaDB disclosed a bug submitted by v3rtical: https://hackerone.com/reports/3909248 [...]
See full content
KILL authorization trusts the presented login name instead of the authenticated anonymous account
on 07/09/2026
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3897588 [...]
See full content
ACL cache collision lets a role inherit privileges from a same-named socket user
on 07/09/2026
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3889667 [...]
See full content
Glitching Old Trezor Wallets! #shorts
on 07/09/2026
See full content
I Gave Claude 12 Years of my Bug Bounty Reports - Here's What I Learned
on 07/09/2026
See full content
How To Start A Bug Bounty Program The Right Way
on 06/09/2026
See full content
Teaching Fault Injection at DEF CON! #shorts
on 06/09/2026
See full content
Black Hat & DEF CON Vlog #shorts
on 05/09/2026
See full content
Unauthenticated testing endpoint of notify_push expose internal IP
on 05/09/2026
Nextcloud disclosed a bug submitted by chinnuy935336: https://hackerone.com/reports/3513471 - Bounty: $150 [...]
See full content
Email Enumeration via Password-Protected Share Identity Verification
on 05/09/2026
Nextcloud disclosed a bug submitted by cybershinu90: https://hackerone.com/reports/3507273 - Bounty: $100 [...]
See full content
Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app
on 05/09/2026
Nextcloud disclosed a bug submitted by nishantbaswal1996: https://hackerone.com/reports/3521639 [...]
See full content
Missing Duplicate Check allowing Multiple Retention Rules per System Tag
on 05/09/2026
Nextcloud disclosed a bug submitted by charankumar39: https://hackerone.com/reports/3521646 [...]
See full content
Activity app does not verify federated file activity received from remote servers
on 05/09/2026
Nextcloud disclosed a bug submitted by cyebrsunita: https://hackerone.com/reports/3534050 - Bounty: $150 [...]
See full content
The Biggest Mistake In Bug Bounty Programs
on 04/09/2026
See full content
How Security Researchers Should Use AI Responsibly
on 04/09/2026
See full content
Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
on 04/09/2026
Nextcloud disclosed a bug submitted by njh215: https://hackerone.com/reports/3617729 [...]
See full content
Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage.
by Tim Erlin on 04/09/2026
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what wo [...]
See full content
CTF Walkthrough: DEF CON Edition
on 04/09/2026
See full content
Slack getting hacked on my way to Black Hat and DEF CON #shorts
on 04/09/2026
See full content
API token sent to URL dictated by an untrusted project .weblate file
on 04/09/2026
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3825141 [...]
See full content
Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate
on 04/09/2026
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3898281 [...]
See full content
AI Might Give You Malware
on 03/09/2026
See full content
JHT Course Launch! Python for Cybersecurity
on 03/09/2026
See full content
What Makes A Successful Bug Bounty Program Today
on 02/09/2026
See full content
Two Weeks of Black Hat & DEF CON (Vlog)
on 02/09/2026
See full content
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be.
At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defender [...]
See full content
FBI Probes Service Selling 153M+ Drivers Licenses
by BrianKrebs on 01/09/2026
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity a [...]
See full content
Why AI Makes Bug Bounty Programs More Essential
on 01/09/2026
See full content
3 Cybersecurity Books to Read
on 01/09/2026
See full content
Why AI Can’t Replace Human Security Researchers
on 01/09/2026
See full content
Reconnaissance unleashed: Meet CrowdRecon
by Radu Voloaga on 01/09/2026
At Intigriti, we have been exploring a simple but important shift in security: the work that happens before a vulnerability report is often where the real signal begins. As vulnerability discovery accelerates, organizations need practical ways to identify and reduce risk before vulnerabilities are used in attacks.
In Reconnaissance for exposure management, I discussed how context turns scanning a [...]
See full content
Minecraft Malware Lab
on 31/08/2026
See full content
Give Developers The Full Remediation Package.
on 31/08/2026
See full content
18: Explicit IPv6 proxy zone ID silently ignored proxy credentials sent to wrong interface
on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973127 [...]
See full content
33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)
on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971585 [...]
See full content
41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body
on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973158 [...]
See full content
06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses
on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973093 [...]
See full content
Password spraying campaign targets AWS root user accounts across 150+ organizations
on 31/08/2026
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. [...]
See full content
RatCTF.com - 26 OSCP machines, FREE memberships and FREE pwnbox - OSEP Path is now live
on 30/08/2026
See full content
**Unauthenticated IDOR allows modification of payment customer billing information**
on 30/08/2026
Weblate disclosed a bug submitted by visionx7: https://hackerone.com/reports/3869124 [...]
See full content
Phishing Panel Breadcrumbs
on 29/08/2026
See full content
50: CMake `HTTP_ONLY` does not disable SSH backends SCP and SFTP remain usable
on 29/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973228 [...]
See full content
42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions
on 29/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973169 [...]
See full content
Offsec pricing is mental
on 29/08/2026
See full content
How To Use AI To Become a KiLLER Hacker
on 29/08/2026
See full content
Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint
on 28/08/2026
IBM disclosed a bug submitted by inventor0x01: https://hackerone.com/reports/3909372 [...]
See full content
Author arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`
on 28/08/2026
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931777 [...]
See full content
Author stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`
on 28/08/2026
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931771 [...]
See full content
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
on 28/08/2026
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3564941 [...]
See full content