InfoSec Planet

See full content

See full content

See full content

Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is [...]

See full content

Researchers set up a fake start-up company to study fraudulent North Korean IT workers. [...]

See full content

See full content

Large language models (LLMs) are quickly becoming a standard component of any modern web application nowadays, powering everything from customer support chatbots to internal knowledge assistants. For us, security researchers, this opens a whole new attack surface to explore. In this article, we'll focus specifically on prompt injection, one of the most impactful vulnerability classes targeting LLM [...]

See full content

See full content

See full content

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural ne [...]

See full content

See full content

See full content

See full content

See full content

Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it. One word tilts the code against Americans. Ask fo [...]

See full content

This post breaks down essential code security terms and tools so that you can build safely from the start. [...]

See full content

See full content

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

See full content

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons [...]

See full content

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, diff [...]

See full content

See full content

Brookings and the World Economic Forum say agent governance must be continuous, scoped in advance, evidenced, and monitored at runtime. We think that bar is correct, and that most organizations are nowhere near it. Most of what companies call AI agent governance today is paperwork. A review board approves the use case. A policy document says agents must follow least privilege. A risk assess [...]

See full content

See full content

See full content

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consi [...]

See full content

See full content

PHP remains one of the most widely deployed server-side languages on the web. Estimates suggest it powers close to 70% of all websites, from small personal blogs to large-scale government services, banking platforms, and e-commerce applications. With such huge presence, any vulnerability in PHP's core engine carries the potential to affect a significant portion of the web. On October 21st, 2026, t [...]

See full content

Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild. Image: Shutterstock.com, Sashkin. The flaws at i [...]

See full content

Today we’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents. Our patching-bugs plugin reproduces reported bugs, develops fixes, and tests them. The regression-hunt plugin checks whether any changes break previously working and supported behavior. Engineers can direct the work and review their results; maintaine [...]

See full content

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s fun to reread my 2002 essay on the economics of information security. [...]

See full content

Why the latest Intigriti platform data challenges the notion that AI could replace bug bounty. How researchers are moving from single prompts to multi-agent, always-on workflows. Why AI raises the baseline for vulnerability discovery while the crowd expands its upper limit. What CrowdRecon is teaching us about the coverage already created by hacker reconnaissance. Why coordination, validation, and [...]

See full content

Malicious releases of LiteLLM v1.107.0 were published to PyPI and container registries following multiple maintainer account compromises. [...]

See full content

Learn about the two critical vulnerabilities in PHP dubbed PHP2Shell. [...]

See full content

See full content

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026. […] According to Cellebrite, AU: is a “next-generation AFU [...]

See full content

See full content

Introducing pathrunner, a modular, cloud-native offensive security framework that automates the exploitation of AWS IAM privilege escalation paths. [...]

See full content

See full content

See full content

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters op [...]

See full content

See full content

Interesting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were [...]

See full content

We tested Sonnet 5, Composer 2.5, and GPT 5.5 using set security rules to see whether using them produces measurably more secure code. [...]

See full content

See full content

See full content

New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]

See full content

See full content

See full content

See full content

See full content

See full content

See full content

Launch Burp AT now               Find out more about Burp AT Since we launched Burp AT at Black Hat USA, it's been great to s [...]

See full content

See full content

See full content

Across the bug bounty ecosystem, providers are moving ID verification on platforms earlier in the researcher journey. This is an industry-wide change. ID verification was historically a payout requirement, but it has now shifted to a submission requirement for programs that offer monetary rewards. Researchers who have completed ID verification tend to produce a higher signal ratio than researchers [...]

See full content

We evaluate Jev's prompt injection detection and show how counterfeit classification policies can steer its decisions and bypass LangChain's tool-risk gating. [...]

See full content

See full content

See full content

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, t [...]

See full content

I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed1, fewer than half used lockfiles that checked for tam [...]

See full content

See full content

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond. Just one of the weaknesses patched this week is considered a “zero day,” or already exploit [...]

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on s [...]

See full content

See full content

See full content

See full content

See full content

See full content

Wallarm Infrastructure Discovery Named Enterprise Cloud Security Solution of the Year. Ask an AWS security team how many accounts they run, and the honest answer is usually a range. Enterprises on AWS operate anywhere from 100 to 5,000 accounts. Most security teams can see only a fraction of them. That gap is why we built Wallarm Infrastructure Discovery. This week, it was named Enterprise [...]

See full content

A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “Rey,” was detained as ShinyHunters was in the process of extorting a business unit recently divest [...]

See full content

Security teams have more ways than ever to map assets, scan infrastructure, and track vulnerabilities. Yet one question often remains difficult to answer: what does a skilled researcher consider worth exploring? That question matters because external exposure is not only a list of internet-facing assets; it is also a set of relationships, assumptions, and possible paths that change as products, do [...]

See full content

See full content

In this post, we share LLM-specific validation patterns that attackers use to test exposed AWS credentials for Amazon Bedrock access. [...]

See full content

See full content

See full content

See full content

We analyzed RBAC bindings across over 65,000 Kubernetes clusters to find dangerous permissions granted to system:anonymous, system:unauthenticated, and system:authenticated. [...]

See full content