InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
Introducing the Wallarm AI Control Platform: One closed loop for AI security and API security. by Tim Erlin on 04/06/2026
TL;DR- AI deployment has outpaced AI governance. Most enterprises running AI on AWS cannot answer four basic security questions about what's running, what it's doing,how to stop it, and how to prove it's under control.- The Wallarm AI Control Platform closes this gap: one platform for Discover, Observe,Enforce, and Govern — running natively in your AWS environment.- Infrastructure Discovery maps [...]
Hacking Meta’s AI Chatbot on 04/06/2026
Hackers are convincing Meta’s AI support chatbot to let them take over other peoples’ accounts: A video posted on X showed the step-by-step process to hack someone’s Instagram account. The hacker allegedly used a VPN to spoof the targets’ presumed location to avoid triggering Instagram’s automated account protections. Then, the hacker opened a chat with Meta AI Suppor [...]
JHT Course Launch! Windows Maldev 6 on 04/06/2026
The AI Slop Era: Do Most Vulnerabilities Actually Matter? on 03/06/2026
Bugmageddon: When AI Breaks the Security Model | Live with Bugcrowd on 03/06/2026
Missing access control when linking banners or campaigns to zones on 03/06/2026
Revive Adserver disclosed a bug submitted by darky_os: https://hackerone.com/reports/3650504 [...]
Missing access control when linking trackers to campaigns on 03/06/2026
Revive Adserver disclosed a bug submitted by darky_os: https://hackerone.com/reports/3650582 [...]
Blind SQL injection via clientid parameter in zoneinclude.php on 03/06/2026
Revive Adserver disclosed a bug submitted by titanrain: https://hackerone.com/reports/3653196 [...]
Reflected XSS via clientid parameter in zoneinclude.php on 03/06/2026
Revive Adserver disclosed a bug submitted by titanrain: https://hackerone.com/reports/3653316 [...]
PHP code injection via delivery limitation logical on 03/06/2026
Revive Adserver disclosed a bug submitted by 0x4c616e: https://hackerone.com/reports/3656781 [...]
Stored XSS via Full Name field in userlog email entries on 03/06/2026
Revive Adserver disclosed a bug submitted by 3l4: https://hackerone.com/reports/3669623 [...]
Session ID reuse allowing XMLRPC API authentication bypass on 03/06/2026
Revive Adserver disclosed a bug submitted by 0x4c616e: https://hackerone.com/reports/3672641 [...]
Missing access control when modifying parent entities via XMLRPC on 03/06/2026
Revive Adserver disclosed a bug submitted by 3l4: https://hackerone.com/reports/3677576 [...]
Banner status override by advertiserlevel users on 03/06/2026
Revive Adserver disclosed a bug submitted by v3rtical: https://hackerone.com/reports/3678828 [...]
Stored XSS via malicious usernames in audit log details + Username validation bypass in XMLRPC addUser on 03/06/2026
Revive Adserver disclosed a bug submitted by 3l4: https://hackerone.com/reports/3680090 [...]
PHP code injection via unexpected delivery limitation parameter on 03/06/2026
Revive Adserver disclosed a bug submitted by rajib_mahmud: https://hackerone.com/reports/3744200 [...]
Are ANY hacking scenes actually good? on 03/06/2026
AI Used to Decrypt Medieval Ciphers on 03/06/2026
Researchers are using machine learning algorithms to decrypt historical pencil-and-paper ciphers. [...]
The sorry state of skill distribution on 03/06/2026
Public skill marketplaces are being flooded with malicious skills that steal credentials, exfiltrate data, and hijack agents. In response, a segment of the security industry released skill scanners, a new family of tools designed to detect malicious skills before they’re installed. But we tested them, and they don’t work. We recently bypassed ClawHub’s malicious skill detector, Cisco’s agent skill [...]
PRE_PROXY change leaks stale Proxy Digest state across proxy-chain boundary on 03/06/2026
curl disclosed a bug submitted by hungly09: https://hackerone.com/reports/3777381 [...]
curl/libcurl 8.20.0 NOPROXY bypass via uppercase-hex IPv4 aliases leaks off-proxy Basic credentials to the configured proxy on 03/06/2026
curl disclosed a bug submitted by arkss: https://hackerone.com/reports/3773293 [...]
SMTP connection reuse ignores --ssl-reqd / CURLOPT_USE_SSL and reuses a clear-text STARTTLS session on current master on 03/06/2026
curl disclosed a bug submitted by hualuo: https://hackerone.com/reports/3770979 [...]
Proxy CONNECT response poisoning via authentication retry in cf-h1-proxy.c (libcurl) on 03/06/2026
curl disclosed a bug submitted by lvtable: https://hackerone.com/reports/3767963 [...]
Top 5 Active Directory Pentesting Tools on 02/06/2026
Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injection on 02/06/2026
PortSwigger Web Security disclosed a bug submitted by hacker-kartel: https://hackerone.com/reports/3775183 [...]
A Hacker's Way of Thinking (with Ted Harrington) on 02/06/2026
H1 Platform: Agentic Continuous Threat Exposure Management That Closes the Discovery-Remediation Gap on 02/06/2026
The Intersection of Encryption and AI on 02/06/2026
As part of their 20th Anniversary celebration, Dark Reading asked five cybersecurity industry leaders who wrote blogs or columns for them over the years to select their favorite piece and share their reflections on the topic today. This is my section. Renowned technologist and author Bruce Schneier contributed a column on June 20, 2010, warning about cryptography’s inability to secure modern [...]
Microsoft Threatening Security Researcher on 02/06/2026
An anonymous security researcher called “Nightmare Eclipse” has been publishing a series of significant security exploits against Microsoft Windows—including one that breaks BitLocker. Microsoft has threatened legal action against the researcher. Lots of recriminations are being traded back and forth. [...]
page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise on 02/06/2026
LY Corporation disclosed a bug submitted by imnotr3al: https://hackerone.com/reports/3423013 - Bounty: $1000 [...]
The case for GitHub Actions security after recent supply chain attacks on 02/06/2026
GitHub Actions workflows are vulnerable to pwn requests, script injection, and compromised credentials. Here's what's going wrong and what's changing. [...]
Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template on 01/06/2026
Shopify disclosed a bug submitted by cipher-kid: https://hackerone.com/reports/3697491 [...]
Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts by BrianKrebs on 01/06/2026
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta’s “AI support assistant” bot into resetting account passwords. A screenshot from a video released on Telegram claiming to show h [...]
Vulnerability Disclosure in the Age of AI on 01/06/2026
New article: “Responsible Disclosure in the Age of AI: A Call for Urgent Action,” by Melissa Hathaway. Abstract: Artificial intelligence is fundamentally reshaping the balance between vulnerability discovery and remediation. Frontier AI models are now capable of autonomously identifying exploitable software vulnerabilities at unprecedented speed and scale. This development exposes deca [...]
A Linux Backdoor is For Sale on the Dark Web on 01/06/2026
How I Found My First $3,000 AI Vulnerability on 01/06/2026
Mentioned unites are at the same time .Then we have to increase the bounty. on 01/06/2026
curl disclosed a bug submitted by karthiktp1810: https://hackerone.com/reports/3761789 [...]
TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 ) on 01/06/2026
curl disclosed a bug submitted by fg0x0: https://hackerone.com/reports/3761647 [...]
lib/ldap.c follows attacker-controlled LDAP referrals and binds to a second server; WinLDAP builds leak current logon credentials (confirmed on Window on 01/06/2026
curl disclosed a bug submitted by tpfeng: https://hackerone.com/reports/3756699 [...]
Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree on 01/06/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3751701 [...]
Low priority HSTS bypass in curl_easy_duphandle() on 01/06/2026
curl disclosed a bug submitted by ajohnston3825: https://hackerone.com/reports/3769293 [...]
Marketer by day, bug hunter by night. Interview with Stefan Goossens (G0053) by Eleanor Barlow on 01/06/2026
Based in the Netherlands, Stefan Goossens, otherwise known as G0053, is both an independent security researcher and a partner for a marketing and web development company. As someone who loves nothing more than building and breaking web applications, Stefan is perfectly placed at the intersection of these two careers. While his day job is spent focusing on devising, guiding, and realizing user-frie [...]
Marketer by day, bug hunter by night. Interview with Stefan Goossens (G0053) by Eleanor Barlow on 01/06/2026
Based in the Netherlands, Stefan Goossens, otherwise known as G0053, is both an independent security researcher and a partner for a marketing and web development company. As someone who loves nothing more than building and breaking web applications, Stefan is perfectly placed at the intersection of these two careers. While his day job is spent focusing on devising, guiding, and realizing user-frie [...]
Blind POST SSRF via Web Push Notification Endpoint on 30/05/2026
phpBB disclosed a bug submitted by misop00p: https://hackerone.com/reports/3608558 [...]
ContinuumCon Teaser: solst/ice, Zack Korman, & Spencer Alessi!! on 30/05/2026
Intigriti Bug Bytes #236 - May 2026 🚀 by Ayoub on 30/05/2026
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Earning $148K via RCE in Google Cloud How public Google API keys became Gemini credentials Our first official Burp Suite extension Two new bypasses for Chrome's Sanitizer API One-click account takeover from a sanitized name field And so much more! Let's dive in! CEO insights: beyond the AI mode [...]
Friday Squid Blogging: Another Squid on 29/05/2026
Someone named “Squid” seems to be a “West Country legend.” As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
AI is changing how fast security issues can be discovered on 29/05/2026
Chilling Effects on 29/05/2026
Younger Americans have soured on the second Donald Trump presidency, but they are not protesting it. Despite an unpopular Iran war and an even more unpopular Trump administration, college campus protests nationwide have gone silent. And at many schools, student activism is virtually nonexistent. This silence comes in the wake of a relentless Trump administration war on campus speech that has invol [...]
Payload Podcast 007 with Andy Piazza (klrgrz) on 29/05/2026
V1Plugin.Decrypt panics on empty ciphertext (Remote DoS) on 28/05/2026
AWS VDP disclosed a bug submitted by misop00p: https://hackerone.com/reports/3620748 [...]
V2Plugin.Decrypt panics on empty ciphertext (Remote DoS) on 28/05/2026
AWS VDP disclosed a bug submitted by misop00p: https://hackerone.com/reports/3620753 [...]
iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private Tabs on 28/05/2026
Brave Software disclosed a bug submitted by aaront: https://hackerone.com/reports/3693295 [...]
Real Folks of Cyber | Dan Berger | Day in the Life on 28/05/2026
Introducing Insights: self-serve reporting for security teams by Andrea Meza on 28/05/2026
Security teams running Bug Bounty programs often require similar insights and reporting to prove the value and ROSI for security initiatives, and often ask questions such as: What changed? Where are we spending? Are we improving? What needs attention right now? Until now, answering those questions often meant exporting data, stitching together spreadsheets, or pulling screenshots from [...]
From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents on 28/05/2026
CVE-2026-31431 (Copy Fail) lets any unprivileged user corrupt the Linux page cache via AF_ALG sockets to escalate privileges. This post covers the exploit mechanics and how Datadog Security Research used coding agents to ship a detection content pack in a single session. [...]
FBI’s 2025 Internet Crime Report on 27/05/2026
The 2025 Internet Crime Report was published a few weeks ago, but I only just saw it. Lots of interesting statistics. Press release. News articles. [...]
Frontier AI teams are leveling up their models with Bugcrowd’s new RLE on 27/05/2026
Google served me Malware on 27/05/2026
Fast Code. Zero Security. Real Problem. on 27/05/2026
Payload Podcast 007 with Andy Piazza (klrgrz) on 26/05/2026
Identifying People Using Wi-Fi Routers on 26/05/2026
Not identifying people based on their use of Wi-Fi routers, but identifying people using Wi-Fi signals. This is accomplished through what is known as WiFi sensing, or the use of WiFi signals to infer information about a physical environment. When radio signals like WiFi travel through a space, they interact with the objects and people around them. Those signals can be reflected, scattered, or abso [...]
You're Fixing the Wrong Vulnerabilities. on 26/05/2026
CEO insights: holding on to the human line in the age of AI adoption by Stijn Jans on 26/05/2026
As part of our recent AI series, I’ve been sharing my insights on the key topics, questions, and debates currently shaping the industry. I have covered my opinions regarding holding the human layer sacred in the AI era, where I explored what I deem is the beating heart of the Bug Bounty industry, AI strengths and weaknesses, where human hackers fit in, and what businesses will face in the next 3 t [...]
Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow on 25/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3751715 [...]
curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authentication on 25/05/2026
curl disclosed a bug submitted by jingzhou: https://hackerone.com/reports/3752567 [...]
Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access Check on 25/05/2026
Rocket.Chat disclosed a bug submitted by deprrous: https://hackerone.com/reports/3734326 [...]
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks by BrianKrebs on 25/05/2026
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure o [...]
Your CISO Can't See the Risk. on 25/05/2026
RatCTF - Uncle Rat HACKS @NullSecurityX 's Box on 24/05/2026
☔️🌅 on 23/05/2026
NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset on 23/05/2026
Node.js disclosed a bug submitted by junius: https://hackerone.com/reports/3736889 [...]
Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`) on 23/05/2026
Node.js disclosed a bug submitted by v1ct0rv0nd00m: https://hackerone.com/reports/3752489 [...]
BSides Dublin 2026 Talk Slides on 23/05/2026
🦗 There hasn’t been a post here in years and I really should do something about this, but in the meantime here are my slides for my BSides Dublin 2026 talk Fighting Fire with Fire: Using AI to Scale Your Product Security Team https://docs.google.com/presentation/d/1zuB920nmw4UtKP3ZsHoUT9Eqi04NVLD7upWK6C9Vmhg I will update this post when the recording is posted on YouTube. [...]
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific on 22/05/2026
The South Pacific Regional Fisheries Management Organization (SPRFMO) needs to regulate squid fishing in the South Pacific. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Lawmakers Demand Answers as CISA Tries to Contain Data Leak by BrianKrebs on 22/05/2026
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked [...]
Soft Skills for the Job Market: Communication on 22/05/2026
We hardened zizmor's GitHub Actions static analyzer on 22/05/2026
In March 2026, attackers exploited a pull_request_target misconfiguration in the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy’s post-mortem for the full timeline). zizmor is a static analyzer that GitHub Actions users run to catch exactly these misconfigurations before they ship. [...]
Your Security Stack Is Already Obsolete. on 22/05/2026
The harsh reality of cybersecurity on 21/05/2026
Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId) on 21/05/2026
Nextcloud disclosed a bug submitted by msatz: https://hackerone.com/reports/3572848 [...]
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada by BrianKrebs on 21/05/2026
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, [...]
One Dev Just Broke Your Security. on 21/05/2026
Vibe Coding, AppSec, and the New Threat Surface on 21/05/2026
How Triage Assist is raising the bar in crowdsourced security by Stijn Bogaerts on 21/05/2026
AI is changing the volume and accelerating the pace of vulnerability submissions. If you've been following our recent AI series, you already know that submission growth isn't a quality problem; it's a coordination problem. As Head of Triage, Lennaert Oudshoorn, outlines in his recent post, ‘The AI impact: A triager’s perspective’, the security industry is experiencing a surge in vulnerability disc [...]
Unpatchable Vulnerabilities of Kubernetes: CVE-2021-25740 on 21/05/2026
A look at how Kubernetes CVE-2021-25740 allows users with EndpointSlice access to redirect traffic via shared ingress and load balancer services. [...]
curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write on 20/05/2026
curl disclosed a bug submitted by sdjasj: https://hackerone.com/reports/3747959 [...]
Credentials forwarded to HTTP after HTTPSHTTP same-port redirect url_set_data_creds uses scheme-blind comparator on 20/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3733946 [...]
Building Secure AI Systems: What Security Leaders Know That Builders Don't | HumanX 2026 on 20/05/2026
POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint) on 20/05/2026
CoinMate.io disclosed a bug submitted by glferreira-devsecops: https://hackerone.com/reports/3676308 [...]
HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API on 20/05/2026
CoinMate.io disclosed a bug submitted by glferreira-devsecops: https://hackerone.com/reports/3670955 [...]
Busy submitting P1s on 19/05/2026
HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB on 19/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734947 [...]
Schannel custom-CA path skips Extended Key Usage enforcement on 19/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734992 [...]
Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers on 19/05/2026
curl disclosed a bug submitted by 7omoo: https://hackerone.com/reports/3741135 [...]
SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's session on 19/05/2026
curl disclosed a bug submitted by hexproof: https://hackerone.com/reports/3739561 [...]
CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds on 19/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3735179 [...]
TLS peer-verification bypass via mid-transfer ssl_config mutation on 19/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3735276 [...]
TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0 on 19/05/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734095 [...]