InfoSec Planet

curl disclosed a bug submitted by intrax: https://hackerone.com/reports/3645361 [...]

See full content

curl disclosed a bug submitted by rougerseven7: https://hackerone.com/reports/3648199 [...]

See full content

Here’s a fossil of a 150-million year old fish that choked to death on a belemnite rostrum: the hard, internal shell of an extinct, squid-like animal. Original paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

curl disclosed a bug submitted by intrax71: https://hackerone.com/reports/3640932 [...]

See full content

curl disclosed a bug submitted by calaba_zas: https://hackerone.com/reports/3641893 [...]

See full content

WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes (alternate link) the recordings. It doesn’t use the Zoom record feature, so Zoom can’t do anything about it. [...]

See full content

Mixed Boolean-Arithmetic (MBA) obfuscation disguises simple operations like x + y behind tangles of arithmetic and bitwise operators. Malware authors and software protectors rely on it because no standard simplification technique covers both domains simultaneously; algebraic simplifiers don’t understand bitwise logic, and Boolean minimizers can’t handle arithmetic. We’re releasing CoBRA, an [...]

See full content

This is for new routers; you don’t have to throw away your existing ones: The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U [...]

See full content

Posted by Adam Gavish, Google GenAI Security TeamIndirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This ma [...]

See full content

Wired writes (alternate source): Security researchers at Google on Tuesday released a report describing what they’re calling “Coruna,” a highly sophisticated iPhone hacking toolkit that includes five complete hacking techniques capable of bypassing all the defenses of an iPhone to silently install malware on a device when it visits a website containing the exploitation code. In t [...]

See full content

The 2026 US “Cyber Strategy for America” document is mostly the same thing we’ve seen out of the White House for over a decade, but with a more aggressive tone. But one sentence stood out: “We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities.” This sounds like a call for hackback: giv [...]

See full content

Code coverage is one of the most dangerous quality metrics in software testing. Many developers fail to realize that code coverage lies by omission: it measures execution, not verification. Test suites with high coverage can obfuscate the fact that critical functionality is untested as software develops over time. We saw this when mutation testing uncovered a high-severity Arkis protocol vulnerabi [...]

See full content

Last week, I listened to a fascinating talk by K. Melton on cognitive security, cognitive hacking, and reality pentesting. The slides from the talk are here, but—even better—Menton has a long essay laying out the basic concepts and ideas. The whole thing is important and well worth reading, and I hesitate to excerpt. Here’s a taste: The NeuroCompiler is where raw sensory data get [...]

See full content

In March 2026, we ran BugQuest, a 31-day campaign covering everything you need to know about finding and exploiting broken access control vulnerabilities. From understanding the basics of authentication and authorization to spotting subtle authorization bypasses in real code, we broke down one of the most critical vulnerability classes in modern web applications. Broken access controls have consis [...]

See full content

curl disclosed a bug submitted by whitehat411: https://hackerone.com/reports/3639277 [...]

See full content

curl disclosed a bug submitted by h3xb1tx: https://hackerone.com/reports/3638715 [...]

See full content

Posted by Dirk Göhmann, Tony Mendez, and the Vulnerability Rewards Program Team2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under [...]

See full content

Sony disclosed a bug submitted by resurrect20: https://hackerone.com/reports/3355766 [...]

See full content

Nextcloud disclosed a bug submitted by eclipse07077: https://hackerone.com/reports/3479692 [...]

See full content

Charles Bennett and Gilles Brassard have won the 2026 Turing Award for inventing quantum cryptography. I am incredibly pleased to see them get this recognition. I have always thought the technology to be fantastic, even though I think it’s largely unnecessary. I wrote up my thoughts back in 2008, in an essay titled “Quantum Cryptography: As Awesome As It Is Pointless.” Back then, [...]

See full content

This post is adapted from a talk I gave at [un]prompted, the AI security practitioner conference. Thanks to Gadi Evron for inviting me to speak. You can watch the recorded presentation below or download the slides. Most companies hand out ChatGPT licenses and wait for the productivity numbers to move. We built a system instead. A year ago, about 5% of Trail of Bits was on board with our AI initiat [...]

See full content

curl disclosed a bug submitted by ankitsingh131225: https://hackerone.com/reports/3636244 [...]

See full content

curl disclosed a bug submitted by m42kl33: https://hackerone.com/reports/3636044 [...]

See full content

curl disclosed a bug submitted by ok3y: https://hackerone.com/reports/3632427 [...]

See full content

arkadiyt-projects disclosed a bug submitted by tipsen: https://hackerone.com/reports/3634400 [...]

See full content

arkadiyt-projects disclosed a bug submitted by tipsen: https://hackerone.com/reports/3634571 [...]

See full content

An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. [...]

See full content

Node.js disclosed a bug submitted by sharp_edged: https://hackerone.com/reports/3511792 [...]

See full content

Node.js disclosed a bug submitted by stif: https://hackerone.com/reports/3480841 [...]

See full content

Node.js disclosed a bug submitted by x_probe: https://hackerone.com/reports/3533945 [...]

See full content

Node.js disclosed a bug submitted by xavlimsg: https://hackerone.com/reports/3559715 [...]

See full content

Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3560402 [...]

See full content

Node.js disclosed a bug submitted by wooseokdotkim: https://hackerone.com/reports/3449392 [...]

See full content

Node.js disclosed a bug submitted by galbarnahum: https://hackerone.com/reports/3531737 [...]

See full content

Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure.  Since then, he’s always worked in and around cybersecurity. He’s had roles as a computer science teacher, a technology manager, a [...]

See full content

A thoughtful review of Apple’s system to alert users that the camera is on. It’s really well-designed, and important in a world where malware could surreptitiously start recording. The reason it’s tempting to think that a dedicated camera indicator light is more secure than an on-display indicator is the fact that hardware is generally more secure than software, because it’ [...]

See full content

curl disclosed a bug submitted by sakthi02_sk: https://hackerone.com/reports/3633534 [...]

See full content

curl disclosed a bug submitted by xkiluar: https://hackerone.com/reports/3630310 [...]

See full content

The Hawaiian bobtail squid has bioluminescent bacteria. [...]

See full content

Tucows (VDP) disclosed a bug submitted by 2026: https://hackerone.com/reports/3523703 [...]

See full content

passhash disclosed a bug submitted by sinic: https://hackerone.com/reports/2441029 [...]

See full content

passhash disclosed a bug submitted by sinic: https://hackerone.com/reports/2439734 [...]

See full content

Hello hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring:   Earning $180K via SSRFs Free Burp Suite Pro licenses for top hackers  Bypassing tricky file upload restrictions Injecting malicious code into AI coding assistants And so much more! Let’s dive in! New: PortSwigger collaboration with Intigriti We've teamed up with PortSwigger to reward high-p [...]

See full content

A look at how Kubernetes CVE-2020-8561 works [...]

See full content

Node.js disclosed a bug submitted by rafaelgss: https://hackerone.com/reports/3546390 [...]

See full content

In December, the Trump administration signed an executive order that neutered states’ ability to regulate AI by ordering his administration to both sue and withhold funds from states that try to do so. This action pointedly supported industry lobbyists keen to avoid any constraints and consequences on their deployment of AI, while undermining the efforts of consumers, advocates, and industry [...]

See full content

RubyGems disclosed a bug submitted by 6b_jjj: https://hackerone.com/reports/3542546 [...]

See full content

curl disclosed a bug submitted by wizard021: https://hackerone.com/reports/3611825 [...]

See full content

curl disclosed a bug submitted by ankitsingh_76: https://hackerone.com/reports/3627638 [...]

See full content

curl disclosed a bug submitted by 3lcarry: https://hackerone.com/reports/3623064 [...]

See full content

Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider di [...]

See full content

We’re releasing a new Claude plugin for developing and auditing code that implements dimensional analysis, a technique we explored in our most recent blog post. Most LLM-based security skills ask the model to find bugs. Our new dimensional-analysis plugin for Claude Code takes a different approach: it uses the LLM to annotate your codebase with dimensional types, then flags mismatches mechanically [...]

See full content

curl disclosed a bug submitted by tynus: https://hackerone.com/reports/3617719 [...]

See full content

At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security researcher community. This month's challenge, brought forward by Kulindu, presented us with a Secure Search Portal that, on the surface, appeared to be well protected. A strict Content Security Policy and DOMPurify sanitization gave the impression that this month's task of executing an XS [...]

See full content

IBM disclosed a bug submitted by bugmithalchemist: https://hackerone.com/reports/3592387 [...]

See full content

Using dimensional analysis, you can categorically rule out a whole category of logic and arithmetic bugs that plague DeFi formulas. No code changes required, just better reasoning! One of the first lessons in physics is learning to think in terms of dimensions. Physicists can often spot a flawed formula in seconds just by checking whether the dimensions make sense. I once had a teacher who even ke [...]

See full content

LinkedIn disclosed a bug submitted by riadalrashed: https://hackerone.com/reports/3604288 [...]

See full content

What you will learn How vulnerability disclosure applies specifically to AI safeguards and systems. The pros and cons of making AI disclosure programs more open/restricted. The kinds of incentives that motivate researchers. Which disclosure program structures can help organizations improve their AI security. In a recent NCSC blog post on adapting vulnerability disclosure for AI safeguards, [...]

See full content

On March 24 and 27, 2026, malicious PyPI releases of LiteLLM and Telnyx were published as part of the TeamPCP supply chain campaign. We trace the full campaign from Trivy through npm, Checkmarx, and into PyPI. [...]

See full content

A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time zone or have Farsi set as the default language. Experts say the wiper campaign against Iran materialized this past weekend and came from a relatively new cybercrime [...]

See full content

Python Cryptographic Authority disclosed a bug submitted by uv3doble: https://hackerone.com/reports/3558277 [...]

See full content

Mozilla disclosed a bug submitted by adilnbabras: https://hackerone.com/reports/3025797 [...]

See full content

curl disclosed a bug submitted by zoroo2: https://hackerone.com/reports/3612891 [...]

See full content

The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named Aisuru, Kimwolf, JackSkid and Mossad — are responsible for a series of recent record-smashing [...]

See full content

Broken access control vulnerabilities have consistently remained at the top of the OWASP Top 10, and for a good reason. As web applications continue to grow in complexity, with the introduction of role-based access controls, multi-tenant support, and granular permission models, the likelihood of access control flaws increases significantly. Unlike other vulnerability classes that often rely on ins [...]

See full content

GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3527771 [...]

See full content

GitHub disclosed a bug submitted by s3rdz0: https://hackerone.com/reports/3522254 [...]

See full content

HackerOne disclosed a bug submitted by theokeen: https://hackerone.com/reports/3378540 [...]

See full content

curl disclosed a bug submitted by lg_oled77c5pua: https://hackerone.com/reports/3609505 [...]

See full content

curl disclosed a bug submitted by am-perip: https://hackerone.com/reports/3608522 [...]

See full content

LinkedIn disclosed a bug submitted by dphoeniixx: https://hackerone.com/reports/3475626 [...]

See full content

Lovable VDP disclosed a bug submitted by ziadmomen: https://hackerone.com/reports/3591764 [...]

See full content

curl disclosed a bug submitted by tavro: https://hackerone.com/reports/3603300 [...]

See full content

Basecamp disclosed a bug submitted by perxibes: https://hackerone.com/reports/3467641 - Bounty: $100 [...]

See full content

Note: This is a guest post by pentester Julen Garrido Estévez (@b3xal). 1. Acknowledgements 2. Intro 3. Required tools 4. Strategy to solve/exploit the lab 5. Detecting 0.CL 5.1. Practical confirmatio [...]

See full content

Consensys disclosed a bug submitted by aszx87410: https://hackerone.com/reports/3507241 [...]

See full content

IBM disclosed a bug submitted by cr3ckerxploit: https://hackerone.com/reports/3578842 [...]

See full content

curl disclosed a bug submitted by henriqueg: https://hackerone.com/reports/3598444 [...]

See full content

curl disclosed a bug submitted by otiscui: https://hackerone.com/reports/3598358 [...]

See full content

Register for the webinar: Burp Suite DAST x Burp Suite Professional: Better Together (Thursday, March 19 2026 16:00 UTC) I'm a firm believer that if you want to understand how secure an application re [...]

See full content

Your board wants AI. Your developers are building with it. Your budget committee is asking for an ROI timeline. But as CISO, you're the one who has to answer when the inevitable question comes up: "How do we know this is secure?" If you're like most security leaders, you're caught between two impossible positions. Say yes to AI initiatives without proper security controls, and you're responsib [...]

See full content

Lovable VDP disclosed a bug submitted by marioniangi: https://hackerone.com/reports/3599248 [...]

See full content

Ethical hacking, often via Bug Bounty Programs or VDPs, operates within defined frameworks. These include a community Code of Conduct (CoC), setting program Rules of Engagement (RoE), and clarifying platform Terms of Service (ToS). Companies that invest in proactive security need to understand what these terms mean and the function they play in maintaining a secure and compliant program. The chall [...]

See full content

curl disclosed a bug submitted by m777m0: https://hackerone.com/reports/3597359 [...]

See full content

A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker’s main U. [...]

See full content

AI systems are no longer just isolated models responding to human prompts.  In modern production environments, they are increasingly chained together – delegating tasks, calling tools, and coordinating decisions with limited or no human oversight. Almost all that communication happens through APIs.  This shift offers enormous productivity benefits. But it has also complicated secu [...]

See full content

Account abstraction transforms fixed “private key can do anything” models into programmable systems that enable batching, recovery and spending limits, and flexible gas payment. But that programmability introduces risks: a single bug can be as catastrophic as leaking a private key. After auditing dozens of ERC‑4337 smart accounts, we’ve identified six vulnerability patterns that frequently appear. [...]

See full content

At PortSwigger, we’re always looking for ways to enable the world to secure the web, and today we’re excited to take that mission a step further. We’re pleased to announce a new collaboration bringing [...]

See full content

curl disclosed a bug submitted by rat5ak: https://hackerone.com/reports/3591944 [...]

See full content

curl disclosed a bug submitted by nobcoder: https://hackerone.com/reports/3584903 [...]

See full content

curl disclosed a bug submitted by spectreglobalsec: https://hackerone.com/reports/3583983 [...]

See full content

Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tue [...]

See full content

Intigriti and PortSwigger collaborate to reward hard-working hackers Best known as the creator of Burp Suite, the industry-standard toolkit for manual web application security testing, PortSwigger is a UK-based cybersecurity company on a mission to help the world secure the web. Today, their tools are trusted by over 20,000 organizations worldwide to detect and prevent cyber threats. To further su [...]

See full content

curl disclosed a bug submitted by sabari_n: https://hackerone.com/reports/3595753 [...]

See full content

curl disclosed a bug submitted by sabari_n: https://hackerone.com/reports/3595764 [...]

See full content

During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not log certain administrative actions related to sharing, authentication, logging, and publication of Copilot Studio agents. [...]

See full content

AWS VDP disclosed a bug submitted by locus-x64: https://hackerone.com/reports/3557138 [...]

See full content

Lovable VDP disclosed a bug submitted by hossam25: https://hackerone.com/reports/3370430 [...]

See full content

curl disclosed a bug submitted by brewm4ster: https://hackerone.com/reports/3584491 [...]

See full content

Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Console credentials via typosquatted domains that mimic AWS infrastructure. [...]

See full content