InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

AI Control Platform vs. AI Firewall vs. AI Gateway: Clearing Up The Terminology

by Tim Erlin on 13/07/2026

Editor's note: This article was originally published by Tim Erlin on LinkedIn. It has been republished here with the author's permission. https://www.linkedin.com/pulse/ai-control-platform-vs-firewall-gateway-clearing-up-tim-erlin-ypodc It seems like every security vendor now sells "AI security." The WAF companies, the API gateway companies, the cloud platforms, the proxy startups: all of them [...]

InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

AI Control Platform vs. AI Firewall vs. AI Gateway: Clearing Up The Terminology

SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server

Lessons Learned from CISA’s Recent GitHub Leak

Payload Podcast 009 - Steven Flores

This Hacker Made $8,000 Hacking a Major Retailer's AI Chatbot Over DNS (Live Demo!)

AI Data Centers and the Concentration of Wealth

Rust-proof your code with our new Testing Handbook chapter

NEW AI Hacking Challenges with Andrew Bellini!

Friday Squid Blogging: “Squidbleed” Vulnerability

Soft Skills for the Job Market: Applying for Jobs

The most severe exposure lives in the quiet overlap between tech, people, and process. ♾️

Fake Microsoft Installer

AI Surveillance and Social Progress

See you at Black Hat USA 2026!

Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)

The Language of AI Could Change How Humans Speak

Heading to Vegas? Meet PortSwigger at Black Hat, BSides, and DEF CON 34.

Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor

LIVE: 1 Million Subscribers | DEF CON/Summer Camp Giveaway

TeamPCP Attention

Welcome to the best security page ever.

Felons, Fraudsters Flog Offensive Cybersecurity Startup

Cybersecurity and the Gap Between Skill and Ability

Mutation testing comes to DAML

Coordinated GitHub API enumeration and access token abuse

Google Is Suing Chinese Scammers Who Are Using Gemini

OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)

Stop what you're doing

Open Source Malware

I Made an AI Agent That Reverses CVEs While I Sleep

France to Stop Certifying Non-Quantum-Safe Encryption

THE MOD WORKS! lets improve it

Entra Agent ID: Protect, detect, respond

the vibe continues

Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity

let's vibe

admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed

Are your employees using AI?

Flock Cameras Can Surveil Cars Without License Plates

FBI Seizes NetNut Proxy Platform, Popa Botnet

Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

We get this question a lot

jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing

jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`

Yelp for Business: locked Email field silently editable via API

Celebrating 1 Million Subscribers on July 8th!

Cybersecurity Mission Creep in the US

GPT-5.5-Cyber built a zlib fuzzing lab in a day

Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission

[Splatoon 3] Kick other players with NplnLogin message

Exceeding the maximum number of spaces allowed by exploiting a Race Condition in the Workspace creation process

Insecure Direct Object Reference (IDOR) allows creating folders.

Delete any folder for any user within the organization

Privilege Escalation Access to the Alert Subscribers page for users with low privileges

Improper Input Validation HTTP Response Parser Unconditionally Accepts Bare CR in Status Line

Beyond Usernames

Papa Johns Surveillance-Based Advertising

Backdoors & Breaches: New scenarios and adaptations

Beyond CTF Labs

heap-use-after-free in curl_easy_cleanup() called from callback

setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse

Shipping post-quantum cryptography to Python

ssh_config_matches is dead code: unauthorized SSH key reuse

CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer

libcurl upload read callbacks miss recursive API guard, allowing prohibited multi API reentry and ASAN-confirmed UAF

Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint

Annual testing starts to look a little dusty when...

Inverted ternary in peerlist_manager::filter() allows unlimited whitelist entries per host via different ports

Remote node DOS

ConsentFix Exposed

Inside H1-813 Live Hacking Event with Salesforce in Tokyo

Reconnaissance for exposure management: why context matters in the AI era

UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callback

Use-after-free in `mev_forget_socket` when `curl_easy_pause()` is called from a `CURL_POLL_REMOVE` socket callback (incomplete fix of CVE-2026-9080)

How to pentest - 101 [CNWPP] deliverables + basic network hacking

Exploiting insecure cookie policies

Security debt has a nasty interest rate.

Facebook Phishing Fails