Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and d [...]
This essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test. Instead of staying in the isolated box the devel [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973143 [...]
MariaDB disclosed a bug submitted by byteoverride: https://hackerone.com/reports/3788482 [...]
Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“: Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the [...]
MariaDB disclosed a bug submitted by pinebudweiser: https://hackerone.com/reports/3897914 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973194 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971518 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973111 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993850 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993973 [...]
When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI. That probably sounds a bit strange. And, depending on who you're asking, maybe a little unsettling too. But that's genuinely what my working day looks like now, and I think it' [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973213 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973219 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972293 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971706 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973121 [...]
MariaDB disclosed a bug submitted by kevin_mizu: https://hackerone.com/reports/3876430 [...]
MariaDB disclosed a bug submitted by v3rtical: https://hackerone.com/reports/3909248 [...]
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3897588 [...]
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3889667 [...]
Not sure it’s practical, but it’s certainly striking. [...]
Nextcloud disclosed a bug submitted by chinnuy935336: https://hackerone.com/reports/3513471 - Bounty: $150 [...]
Nextcloud disclosed a bug submitted by cybershinu90: https://hackerone.com/reports/3507273 - Bounty: $100 [...]
Nextcloud disclosed a bug submitted by nishantbaswal1996: https://hackerone.com/reports/3521639 [...]
Nextcloud disclosed a bug submitted by charankumar39: https://hackerone.com/reports/3521646 [...]
Nextcloud disclosed a bug submitted by cyebrsunita: https://hackerone.com/reports/3534050 - Bounty: $150 [...]
Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Nextcloud disclosed a bug submitted by njh215: https://hackerone.com/reports/3617729 [...]
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what wo [...]
It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features [...]
It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary. Notably, I never touched a voting machine, exploited a network, examine [...]
We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code package [...]
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3825141 [...]
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3898281 [...]
Researchers built a fake company to study fake employee scams. [...]
I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans. Glad you’re still reading.) Dear Bruce Schneier [...]
Comcast has added motion detection as a feature to its wireless routers: The feature sends push notifications to users when motion is detected near a connected device, such as a TV or printer. It has different settings for when people are home, asleep, or away. The Xfinity app also lets users see live motion activity and a feed of recent activity. Comcast acknowledges that the system has some limi [...]
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be. At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defender [...]
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity a [...]
At Intigriti, we have been exploring a simple but important shift in security: the work that happens before a vulnerability report is often where the real signal begins. As vulnerability discovery accelerates, organizations need practical ways to identify and reduce risk before vulnerabilities are used in attacks. In Reconnaissance for exposure management, I discussed how context turns scanning a [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973127 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971585 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973158 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973093 [...]
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. [...]
Weblate disclosed a bug submitted by visionx7: https://hackerone.com/reports/3869124 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973228 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973169 [...]
IBM disclosed a bug submitted by inventor0x01: https://hackerone.com/reports/3909372 [...]
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931777 [...]
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931771 [...]
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3564941 [...]
Node.js disclosed a bug submitted by byvini: https://hackerone.com/reports/3857258 [...]
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795657 [...]
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795900 [...]
Node.js disclosed a bug submitted by hahahkim: https://hackerone.com/reports/3833629 [...]
Node.js disclosed a bug submitted by leduckhuong: https://hackerone.com/reports/3846922 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972316 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971496 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972196 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970639 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970650 [...]
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside your email inbox AI doing novel security research: the HTTP Terminator 169 offensive recon skills in one AI-ready toolkit And so much more! Let's dive in! CrowdRecon is coming Most security teams [...]
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two men from Western Australia, aged 21 and 23, were arrested in connection with a “sophisticated cyberc [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968729 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968431 [...]
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3729501 [...]
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3778282 [...]
As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs [...]