InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

Researching Employment Scams

on 03/09/2026

Researchers built a fake company to study fake employee scams. [...]

AI Agents Are Now Emailing Me with Their Security Concerns

on 02/09/2026

I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans. Glad you’re still reading.) Dear Bruce Schneier [...]

InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

Researching Employment Scams

AI Agents Are Now Emailing Me with Their Security Concerns

Wireless Routers as Motion Detectors

Hacking AI customer service agents

FBI Probes Service Selling 153M+ Drivers Licenses

What’s the Scam?

Leaked Russian Cyber-Operations Training Materials

Rewiring Democracy Series on The Renovator

Reconnaissance unleashed: Meet CrowdRecon

Is Someone Hacking DoD Refrigerators?

Hiding Prompt Injection in Legal Filing

18: Explicit IPv6 proxy zone ID silently ignored proxy credentials sent to wrong interface

33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Password spraying campaign targets AWS root user accounts across 150+ organizations

**Unauthenticated IDOR allows modification of payment customer billing information**

50: CMake `HTTP_ONLY` does not disable SSH backends SCP and SFTP remain usable

42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Friday Squid Blogging: Truckload of Squid Spills in Rhode Island

Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

Author arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

Author stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records

node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely

Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

46: `--libcurl` output carries `--insecure` across `--next` boundaries

AI Doesn’t Mean the End of Mathematics—at Least Not Yet

28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

34: `curl_mprintf` reads `double` for documented `long double` conversions uninitialized value disclosure

--etag-save - truncates append-redirected stdout

Stacked --proto modifiers leave denied protocol enabled

Intigriti Bug Bytes #239 - August 2026 🚀

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Unbound cross-peer HTTP Digest challenge state

ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)

Critical SQL Injection WDM API ()

VMs won't contain cyber-capable agents

curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization

Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating

TLS session cache case-folds CA paths and bypasses the active trust profile

libcurl Digest/NTLM authentication ignores an explicit Authorization header

State divergence enables unauthorized access

@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)

RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0

URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag

Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider

When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS)

When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS)

Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

View-only offline transaction creation bypasses the long-payment-ID privacy block

HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution

monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode

Loss of multisig funds through single malicious participant's deliberate deception

DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

Stored HTML Injection (CWE-79) via Livechat Visitor Name

Web fuzzing for hackers

N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it

Putting models to the secure coding test: Plan vs default mode

Wallet RPC Restricted-Mode Policy Bypass

Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions

TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot

Windows SSPI connection-pool probe can reuse a connection under the wrong user

libcurl cache updates follow symlinks and truncate their targets

Who’s Tracking You? Use This New Service to Find Out

Cookie jar load skips public suffix check on PSL builds

Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption

JaaS: Unauthenticated, cross-tenant outbound SIP calling via JaaS SIP gateway (toll fraud + caller-ID spoofing)

Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research

Myndr CORS Misconfiguration

Unauthenticated IDOR allows modification of payment customer billing information