InfoSec Planet
A collection of diverse security content from a curated list of sources. This website also serves as a demo for "worker-planet", the software that powers it.
How Security Researchers Should Use AI Responsibly on 04/09/2026
Friday Squid Blogging: Squid on a Stick at the New York State Fair on 04/09/2026
Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage. by Tim Erlin on 04/09/2026
The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what wo [...]
Using a VM to Contain an AI Agent on 04/09/2026
It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features [...]
CTF Walkthrough: DEF CON Edition on 04/09/2026
Slack getting hacked on my way to Black Hat and DEF CON #shorts on 04/09/2026
Security Vulnerability in a Voting System on 04/09/2026
It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary. Notably, I never touched a voting machine, exploited a network, examine [...]
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks on 04/09/2026
We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code package [...]
AI Might Give You Malware on 03/09/2026
JHT Course Launch! Python for Cybersecurity on 03/09/2026
Researching Employment Scams on 03/09/2026
Researchers built a fake company to study fake employee scams. [...]
What Makes A Successful Bug Bounty Program Today on 02/09/2026
AI Agents Are Now Emailing Me with Their Security Concerns on 02/09/2026
I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans. Glad you’re still reading.) Dear Bruce Schneier [...]
Teaching Hardware Hacking at Black Hat & DEF CON (Vlog) on 02/09/2026
Wireless Routers as Motion Detectors on 02/09/2026
Comcast has added motion detection as a feature to its wireless routers: The feature sends push notifications to users when motion is detected near a connected device, such as a TV or printer. It has different settings for when people are home, asleep, or away. The Xfinity app also lets users see live motion activity and a feed of recent activity. Comcast acknowledges that the system has some limi [...]
Hacking AI customer service agents by Ayoub and Inti De Ceukelaire on 02/09/2026
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be. At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defender [...]
FBI Probes Service Selling 153M+ Drivers Licenses by BrianKrebs on 01/09/2026
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity a [...]
Why AI Makes Bug Bounty Programs More Essential on 01/09/2026
What’s the Scam? on 01/09/2026
To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically generated email. This is, of course, to prevent people from subscribing addresses other than their own. Starting last weekend, I have been receiving a lot of individual responses to those emails. Always one line: Thank you for the positive impact your emails have had o [...]
3 Cybersecurity Books to Read on 01/09/2026
Leaked Russian Cyber-Operations Training Materials on 01/09/2026
This is interesting: The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational Directorate, and 8th Directorate, which is associated with protected communications, cryptography, and information security. […] The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as [...]
Why AI Can’t Replace Human Security Researchers on 01/09/2026
Rewiring Democracy Series on The Renovator on 01/09/2026
Nathan E. Sanders and I are writing a series of essays on real-world examples of democratic technologies for The Renovator. I haven’t been posting the full text on the blog because they’re a bit long, but here are links. Part 1 is about the Japanese digital democracy party, Team Mirai. Part 2 is about the Swiss Public AI model, Apertus. Part 3 is about the civic technologists of Open K [...]
Reconnaissance unleashed: Meet CrowdRecon by Radu Voloaga on 01/09/2026
At Intigriti, we have been exploring a simple but important shift in security: the work that happens before a vulnerability report is often where the real signal begins. As vulnerability discovery accelerates, organizations need practical ways to identify and reduce risk before vulnerabilities are used in attacks. In Reconnaissance for exposure management, I discussed how context turns scanning a [...]
Minecraft Malware Lab on 31/08/2026
Give Developers The Full Remediation Package. on 31/08/2026
18: Explicit IPv6 proxy zone ID silently ignored proxy credentials sent to wrong interface on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973127 [...]
33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231) on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971585 [...]
41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973158 [...]
06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses on 31/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973093 [...]
Password spraying campaign targets AWS root user accounts across 150+ organizations on 31/08/2026
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. [...]
RatCTF.com - 26 OSCP machines, FREE memberships and FREE pwnbox - OSEP Path is now live on 30/08/2026
**Unauthenticated IDOR allows modification of payment customer billing information** on 30/08/2026
Weblate disclosed a bug submitted by visionx7: https://hackerone.com/reports/3869124 [...]
Phishing Panel Breadcrumbs on 29/08/2026
50: CMake `HTTP_ONLY` does not disable SSH backends SCP and SFTP remain usable on 29/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973228 [...]
42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions on 29/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3973169 [...]
Offsec pricing is mental on 29/08/2026
How To Use AI To Become a KiLLER Hacker on 29/08/2026
Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint on 28/08/2026
IBM disclosed a bug submitted by inventor0x01: https://hackerone.com/reports/3909372 [...]
Author arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata` on 28/08/2026
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931777 [...]
Author stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()` on 28/08/2026
WordPress disclosed a bug submitted by jakubk: https://hackerone.com/reports/3931771 [...]
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) on 28/08/2026
Node.js disclosed a bug submitted by byvini: https://hackerone.com/reports/3857258 [...]
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser on 28/08/2026
Node.js disclosed a bug submitted by yushengchen: https://hackerone.com/reports/3564941 [...]
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records on 28/08/2026
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795657 [...]
node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely on 28/08/2026
Node.js disclosed a bug submitted by cantina-security: https://hackerone.com/reports/3795900 [...]
Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 on 28/08/2026
Node.js disclosed a bug submitted by hahahkim: https://hackerone.com/reports/3833629 [...]
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion on 28/08/2026
Node.js disclosed a bug submitted by leduckhuong: https://hackerone.com/reports/3846922 [...]
46: `--libcurl` output carries `--insecure` across `--next` boundaries on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972316 [...]
Why AI Can't Fix Vulnerabilities Alone. on 28/08/2026
28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3971496 [...]
34: `curl_mprintf` reads `double` for documented `long double` conversions uninitialized value disclosure on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3972196 [...]
--etag-save - truncates append-redirected stdout on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970639 [...]
Stacked --proto modifiers leave denied protocol enabled on 28/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3970650 [...]
Intigriti Bug Bytes #239 - August 2026 🚀 by Ayoub on 28/08/2026
Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside your email inbox AI doing novel security research: the HTTP Terminator 169 offensive recon skills in one AI-ready toolkit And so much more! Let's dive in! CrowdRecon is coming Most security teams [...]
GitHub Hacker EXPOSED BY HIS CAT on 27/08/2026
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia by BrianKrebs on 27/08/2026
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two men from Western Australia, aged 21 and 23, were arrested in connection with a “sophisticated cyberc [...]
False Positives Burn Developer Trust. on 27/08/2026
Unbound cross-peer HTTP Digest challenge state on 27/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968729 [...]
ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds on 27/08/2026
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3968431 [...]
Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit) on 27/08/2026
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3729501 [...]
Critical SQL Injection WDM API () on 27/08/2026
Essity disclosed a bug submitted by matty69v: https://hackerone.com/reports/3778282 [...]
Real Folks of Cyber | Joel Valenzuela | DITL on 27/08/2026
Device Code Phishing on 26/08/2026
VMs won't contain cyber-capable agents on 26/08/2026
As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs [...]
Why Vulnerability Remediation Gets Blocked. on 26/08/2026
curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack on 26/08/2026
curl disclosed a bug submitted by k4rasu_s4ma: https://hackerone.com/reports/3955945 [...]
Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization on 26/08/2026
Discourse disclosed a bug submitted by ahpuh: https://hackerone.com/reports/3689633 [...]
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating on 25/08/2026
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3527788 [...]
TLS session cache case-folds CA paths and bypasses the active trust profile on 25/08/2026
curl disclosed a bug submitted by 1rhino2: https://hackerone.com/reports/3966955 [...]
How to Build a Home Lab for Cheap! on 25/08/2026
libcurl Digest/NTLM authentication ignores an explicit Authorization header on 25/08/2026
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963330 [...]
State divergence enables unauthorized access on 25/08/2026
We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live [...]
Your Vulnerability Backlog Is The Risk. on 25/08/2026
Why Vulnerability Backlogs Keep Growing (And How AI Remediation Fixes It) on 25/08/2026
@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration) on 25/08/2026
8x8 disclosed a bug submitted by a3z4km3: https://hackerone.com/reports/3889473 [...]
RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions on 24/08/2026
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963494 [...]
wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0 on 24/08/2026
curl disclosed a bug submitted by subadevan: https://hackerone.com/reports/3963725 [...]
URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag on 24/08/2026
Ruby on Rails disclosed a bug submitted by offsetmd: https://hackerone.com/reports/3727743 [...]
Inventory The Entire Host on 24/08/2026
This Word Document Steals Your Password From Microsoft Copilot (+ LIVE DEMO) on 24/08/2026
Attackers Win When Research Stays Private. on 24/08/2026
Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider on 24/08/2026
Nextcloud disclosed a bug submitted by mirachael: https://hackerone.com/reports/3696266 [...]
When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS) by Eleanor Barlow on 24/08/2026
Ryan Bonner, also known as Roll4CombatUS, is a respected Bug Bounty hunter, consultant, speaker, and Intigriti Hacker Ambassador based in the United States. In today’s interview, we discuss his journey into bug hunting, his recommended tools and techniques, and share advice for hunters just getting started. Ryan, how did you get started? To put it frankly, I got fired from my first pentesting jo [...]
When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS) by Eleanor Barlow on 24/08/2026
Ryan Bonner, also known as Roll4CombatUS, is a respected Bug Bounty hunter, consultant, speaker, and Intigriti Hacker Ambassador based in the United States. In today’s interview, we discuss his journey into bug hunting, his recommended tools and techniques, and share advice for hunters just getting started. Ryan, how did you get started? To put it frankly, I got fired from my first pentesting jo [...]
My Life, AI and the Future of LiveOverflow on 23/08/2026
Vanta vs. Drata: The 10 Questions Our CISO Asks GRC Vendors on 21/08/2026
Canary Tokens, Meet AI on 21/08/2026
How To Shut Down CSS Attacks. on 21/08/2026
Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts on 21/08/2026
curl disclosed a bug submitted by accl: https://hackerone.com/reports/3952619 [...]
Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field on 20/08/2026
Monero disclosed a bug submitted by lilpeko: https://hackerone.com/reports/3819475 [...]
View-only offline transaction creation bypasses the long-payment-ID privacy block on 20/08/2026
Monero disclosed a bug submitted by qttps: https://hackerone.com/reports/3686283 [...]
HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer on 20/08/2026
Monero disclosed a bug submitted by fg0x0: https://hackerone.com/reports/3679471 [...]
Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution on 20/08/2026
Monero disclosed a bug submitted by qttps: https://hackerone.com/reports/3619409 [...]
monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode on 20/08/2026
Monero disclosed a bug submitted by qttps: https://hackerone.com/reports/3648638 [...]
Loss of multisig funds through single malicious participant's deliberate deception on 20/08/2026
Monero disclosed a bug submitted by k-privacy-enjoyer: https://hackerone.com/reports/3515557 [...]
DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767) on 20/08/2026
Rocket.Chat disclosed a bug submitted by iamaangx028: https://hackerone.com/reports/3852135 [...]
Stored HTML Injection (CWE-79) via Livechat Visitor Name on 20/08/2026
Rocket.Chat disclosed a bug submitted by hillng: https://hackerone.com/reports/3872858 [...]