Smells awful: But an estimated 30 to 50 tons of dead squid remain inside the boat’s catch tank, where they have been decomposing for days. “That is nasty. I wouldn’t want to do that,” said commercial fisherman Dick Ogg of the Bodega Bay Fishermen’s Marketing Association. Ogg said anyone familiar with the fishing industry understands what happens when a large catch si [...]
Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers. It’s a combination of the potentialities I raised in my 2022 book A Hacker’s Mind and the lessons we’re learning from current AI models engaging in hacking behavior. I’m really proud of the talk, and the fact that it gained over 100K views on YouTube in just a few days. Also online is [...]
In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago. Great fun. [...]
Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it. What’s worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we& [...]
A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail. [...]
Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve lots of searching and testing. [...]
Fermat famously claimed to have a âtruly marvelous proofâ of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown belo [...]
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and d [...]
This essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the companyâs database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test. Instead of staying in the isolated box the devel [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973143 [...]
MariaDB disclosed a bug submitted by byteoverride: https://hackerone.com/reports/3788482 [...]
Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“: Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the [...]
MariaDB disclosed a bug submitted by pinebudweiser: https://hackerone.com/reports/3897914 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973194 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971518 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973111 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993850 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3993973 [...]
When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI. That probably sounds a bit strange. And, depending on who you're asking, maybe a little unsettling too. But that's genuinely what my working day looks like now, and I think it' [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973213 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973219 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972293 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971706 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973121 [...]
MariaDB disclosed a bug submitted by kevin_mizu: https://hackerone.com/reports/3876430 [...]
MariaDB disclosed a bug submitted by v3rtical: https://hackerone.com/reports/3909248 [...]
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3897588 [...]
MariaDB disclosed a bug submitted by dogeshark: https://hackerone.com/reports/3889667 [...]
Not sure it’s practical, but it’s certainly striking. [...]
Nextcloud disclosed a bug submitted by chinnuy935336: https://hackerone.com/reports/3513471 - Bounty: $150 [...]
Nextcloud disclosed a bug submitted by cybershinu90: https://hackerone.com/reports/3507273 - Bounty: $100 [...]
Nextcloud disclosed a bug submitted by nishantbaswal1996: https://hackerone.com/reports/3521639 [...]
Nextcloud disclosed a bug submitted by charankumar39: https://hackerone.com/reports/3521646 [...]
Nextcloud disclosed a bug submitted by cyebrsunita: https://hackerone.com/reports/3534050 - Bounty: $150 [...]
Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Nextcloud disclosed a bug submitted by njh215: https://hackerone.com/reports/3617729 [...]
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what wo [...]
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3825141 [...]
Weblate disclosed a bug submitted by type5afe: https://hackerone.com/reports/3898281 [...]
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be. At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defender [...]
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity a [...]
At Intigriti, we have been exploring a simple but important shift in security: the work that happens before a vulnerability report is often where the real signal begins. As vulnerability discovery accelerates, organizations need practical ways to identify and reduce risk before vulnerabilities are used in attacks. In Reconnaissance for exposure management, I discussed how context turns scanning a [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973127 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971585 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973158 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973093 [...]
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. [...]
Weblate disclosed a bug submitted by visionx7: https://hackerone.com/reports/3869124 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973228 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973169 [...]
IBM disclosed a bug submitted by inventor0x01: https://hackerone.com/reports/3909372 [...]
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931777 [...]
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931771 [...]
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3564941 [...]
Node.js disclosed a bug submitted by byvini: https://hackerone.com/reports/3857258 [...]
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795657 [...]
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795900 [...]
Node.js disclosed a bug submitted by hahahkim: https://hackerone.com/reports/3833629 [...]
Node.js disclosed a bug submitted by leduckhuong: https://hackerone.com/reports/3846922 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972316 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971496 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972196 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970639 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970650 [...]
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside your email inbox AI doing novel security research: the HTTP Terminator 169 offensive recon skills in one AI-ready toolkit And so much more! Let's dive in! CrowdRecon is coming Most security teams [...]
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two men from Western Australia, aged 21 and 23, were arrested in connection with a “sophisticated cyberc [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968729 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968431 [...]
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3729501 [...]
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3778282 [...]
As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM Iâd normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs [...]
curl disclosed a bug submitted by k4rasu_s4ma: https://hackerone.com/reports/3955945 [...]
Discourse disclosed a bug submitted by ahpuh: https://hackerone.com/reports/3689633 [...]
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3527788 [...]
curl disclosed a bug submitted by 1rhino2: https://hackerone.com/reports/3966955 [...]
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963330 [...]
We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live [...]
8x8 disclosed a bug submitted by a3z4km3: https://hackerone.com/reports/3889473 [...]
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963494 [...]
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963725 [...]
Ruby on Rails disclosed a bug submitted by offsetmd: https://hackerone.com/reports/3727743 [...]