InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)

on 09/07/2026

AWS VDP disclosed a bug submitted by mistercloudsec: https://hackerone.com/reports/3630605 [...]

The Language of AI Could Change How Humans Speak

on 09/07/2026

Because of the way they are trained, large language models capture only a slice of human language. They’re trained on the written word, from textbooks to social media posts, and our speech as captured in movies and on television. These models have minimal access to the unscripted conversations we have face to face or voice to voice. This is the vast majority of speech, and a vital component [...]

InfoSec Planet

A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.

Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)

The Language of AI Could Change How Humans Speak

Heading to Vegas? Meet PortSwigger at Black Hat, BSides, and DEF CON 34.

LIVE: 1 Million Subscribers | DEF CON/Summer Camp Giveaway

TeamPCP Attention

Welcome to the best security page ever.

Felons, Fraudsters Flog Offensive Cybersecurity Startup

Cybersecurity and the Gap Between Skill and Ability

Mutation testing comes to DAML

NEW AI Hacking Challenges with Andrew Bellini!

Coordinated GitHub API enumeration and access token abuse

Google Is Suing Chinese Scammers Who Are Using Gemini

OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)

Stop what you're doing

Open Source Malware

I Made an AI Agent That Reverses CVEs While I Sleep

France to Stop Certifying Non-Quantum-Safe Encryption

THE MOD WORKS! lets improve it

Entra Agent ID: Protect, detect, respond

the vibe continues

Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity

let's vibe

admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed

Are your employees using AI?

Flock Cameras Can Surveil Cars Without License Plates

FBI Seizes NetNut Proxy Platform, Popa Botnet

Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

We get this question a lot

jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing

jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`

Yelp for Business: locked Email field silently editable via API

Celebrating 1 Million Subscribers on July 8th!

Cybersecurity Mission Creep in the US

GPT-5.5-Cyber built a zlib fuzzing lab in a day

Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission

[Splatoon 3] Kick other players with NplnLogin message

Exceeding the maximum number of spaces allowed by exploiting a Race Condition in the Workspace creation process

Insecure Direct Object Reference (IDOR) allows creating folders.

Delete any folder for any user within the organization

Privilege Escalation Access to the Alert Subscribers page for users with low privileges

Improper Input Validation HTTP Response Parser Unconditionally Accepts Bare CR in Status Line

Beyond Usernames

Papa Johns Surveillance-Based Advertising

Backdoors & Breaches: New scenarios and adaptations

Beyond CTF Labs

heap-use-after-free in curl_easy_cleanup() called from callback

The Realities of AI Video Surveillance

setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse

Shipping post-quantum cryptography to Python

ssh_config_matches is dead code: unauthorized SSH key reuse

CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer

libcurl upload read callbacks miss recursive API guard, allowing prohibited multi API reentry and ASAN-confirmed UAF

Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint

Annual testing starts to look a little dusty when...

Inverted ternary in peerlist_manager::filter() allows unlimited whitelist entries per host via different ports

Remote node DOS

Factoring RSA Keys with Many Zeros

ConsentFix Exposed

Inside H1-813 Live Hacking Event with Salesforce in Tokyo

Robot Police Officers

Reconnaissance for exposure management: why context matters in the AI era

UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callback

Use-after-free in `mev_forget_socket` when `curl_easy_pause()` is called from a `CURL_POLL_REMOVE` socket callback (incomplete fix of CVE-2026-9080)

How to pentest - 101 [CNWPP] deliverables + basic network hacking

Exploiting insecure cookie policies

Security debt has a nasty interest rate.

Facebook Phishing Fails

Real Folks of Cyber | Pearce Barry | Day in the Life

mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0

CURLOPT_HAPROXY_CLIENT_IP lacks input validation, enabling HAProxy PROXY protocol injection

Intigriti Bug Bytes #237 - June 2026 🚀

Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more

Getting Started with the TCM Security Academy

Disable SmartScreen Fast

PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargeting

XMLRPC login leak exposes valid session ID enabling unauthorized API access

Reflected XSS via unsanitised refresh parameter in zone invocation tag

PHP code injection in delivery-limitation `logical` validation bypass