Good report: Executive Summary: Let’s say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don’t actually work for measuring AI capabilities (even when they are NOT emergent systemic properties like security). So let’s take a step back: how do you measure security in the first plac [...]
CoinMate.io disclosed a bug submitted by glferreira-devsecops: https://hackerone.com/reports/3676308 [...]
CoinMate.io disclosed a bug submitted by glferreira-devsecops: https://hackerone.com/reports/3670955 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734947 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734992 [...]
curl disclosed a bug submitted by 7omoo: https://hackerone.com/reports/3741135 [...]
curl disclosed a bug submitted by hexproof: https://hackerone.com/reports/3739561 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3735179 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3735276 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734095 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734020 [...]
Not by name, but Laurie Anderson quotes me in one of the tracks of her new album: My favorite quote is from a cryptologist who said “If you think technology will solve your problems, you don’t understand technology and you don’t understand your problems.” Also in interviews: “Of course, it’s ridiculous, outrageous, blah, blah, blah,” Anderson says about th [...]
GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/3560256 [...]
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it rep [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3733934 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3735238 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3735080 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734935 [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3733984 [...]
It’s nasty, but it requires physical access to the computer: The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a [...]
Editor's note: This article was originally published by Craig Riddell on LinkedIn. It has been republished here with the author's permission. Boards are giving AI security more airtime than ever. What they're not giving is the right framing. A year or two ago, AI was mostly a question of experimentation risk. Today, it's tied directly to revenue, customer experience, operational efficiency, [...]
Enjin disclosed a bug submitted by ph0r3nsic: https://hackerone.com/reports/3589247 [...]
Rocket.Chat disclosed a bug submitted by josan_george: https://hackerone.com/reports/3713682 [...]
As part of our AI series, I recently released a blog on the topic of keeping the human layer sacred in the AI era. There, I shared my thoughts on where human intelligence fits, the decisions I believe companies will face in the next 3 to 5 years, and explored what I deem to be the beating heart of the Bug Bounty industry. Considering that discussion, I want to continue the conversation regarding [...]
Introducing Pathfinding Labs, a collection of intentionally vulnerable AWS environments for red teamers and blue teamers to deploy, exploit, and use for detection validation. [...]
curl disclosed a bug submitted by giant_anteater: https://hackerone.com/reports/3734921 [...]
curl disclosed a bug submitted by mulan_dh: https://hackerone.com/reports/3736234 [...]
Article about the bigfin squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. [...]
Nextcloud disclosed a bug submitted by suul: https://hackerone.com/reports/3462991 [...]
Some AI-based video age-verification checks can be fooled with a fake mustache. [...]
This is a current list of where and when I am scheduled to speak: I’m giving a virtual talk on “The Security of Trust in the Age of AI,” hosted by the Financial Women’s Association of New York, at 6:00 PM ET on May 21, 2026. I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24–25, 2026, and my talk will be the [...]
Yuga Labs disclosed a bug submitted by r00tsid: https://hackerone.com/reports/1821085 - Bounty: $250 [...]
Last month, Anthropic made a remarkable announcement about its new model, Claude Mythos Preview: it was so good at finding security vulnerabilities in software that the company would not release it to the general public. Instead, it would only be available to a select group of companies to scan and fix their own software. The announcement requires context—but it contained an essential truth. [...]
curl disclosed a bug submitted by rootofpi_ramesh: https://hackerone.com/reports/3725659 [...]
We investigate how a coordinated supply chain campaign that compromised npm and PyPI packages also backdoored the official Cemu Nintendo Wii U emulator GitHub release, reaching nearly 20,000 Linux users. [...]
An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint. [...]
The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available. Here is the Institute’s evaluation of Mythos. And here is an analysis of a smaller, cheaper model. It requires more scaffolding from the prompter, but it is also just as good. [...]
A static analysis of the open-sourced Shai-Hulud offensive framework attributed to TeamPCP, covering its credential harvesting, supply chain poisoning, and exfiltration capabilities. [...]
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers — including Apple, Google, Microsoft, Mozilla and Oracle — fixing near record volumes of secu [...]
The Model Context Protocol (MCP) is a de facto standard for providing structured access to privileged systems for AI agents and external integrations. It acts as a USB-C port for AI, enabling faster innovation by allowing organizations to expose tools, resources, and workflows without the time-consuming work of building APIs. Adoption has surged in recent months, and categories like payments, [...]
AWS VDP disclosed a bug submitted by jcow: https://hackerone.com/reports/3577145 [...]
Now that the dust has settled on Mythos dropping, there is space for more considered reflection on the direction of travel. Mythos wasn't a surprise; it's another data point on a trajectory that's bee [...]
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to write four bytes at a time straight into the page cache of a file the attacker does not own. The exploit works unmodified across Ub [...]
Go’s native fuzzing is useful, but it stands far behind state-of-the-art tooling that the Rust, C, and C++ ecosystems offer with LibAFL and AFL++. Path constraints are hard to solve. Structured inputs usually need handmade parsing. It doesn’t even detect several common bug classes, such as integer overflows, goroutine leaks, data races, and execution timeouts. So to make it better, we built [...]
With the deadline passing for NIS2 compliance, many companies have shifted focus from becoming prepared to proving compliance. This post outlines the top 10 tasks for doing so and provides insights on how crowdsourced security platforms can assist in designing programs relevant to their circumstances and compliance requirements. The April NIS2 compliance deadline has come and gone, but where does [...]
Turns out that LLMs are really good at hiding text messages in other text messages. [...]
As founder and CEO of Intigriti, I've spent a long time around hackers, and one thing is clear. The best ones don't fear AI. They use it. What they do fear, however, and what I take seriously as a founder, is a world where platforms quietly replace them under the banner of efficiency. Where their work trains models they don't benefit from, and where the economics of the craft erode while everyon [...]
Learn how malicious Claude Code skills can abuse dynamic context commands to execute before model-level prompt injection defenses can intervene. [...]
Liberapay disclosed a bug submitted by rox-11: https://hackerone.com/reports/3723002 [...]
Liberapay disclosed a bug submitted by rox-11: https://hackerone.com/reports/3721519 [...]
Nextcloud disclosed a bug submitted by vidang04: https://hackerone.com/reports/3511998 - Bounty: $150 [...]
Nextcloud disclosed a bug submitted by 0x0doteth: https://hackerone.com/reports/3304830 [...]
Nextcloud disclosed a bug submitted by yoyomiski: https://hackerone.com/reports/3521434 [...]
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions. A sc [...]
A look at how to secure Kubernetes secrets [...]
curl disclosed a bug submitted by shecantcode2: https://hackerone.com/reports/3717365 [...]
Ruby on Rails disclosed a bug submitted by ksw9722: https://hackerone.com/reports/3580511 [...]
Monero disclosed a bug submitted by rorkh: https://hackerone.com/reports/3307874 [...]
Monero disclosed a bug submitted by yulge: https://hackerone.com/reports/3185083 [...]
curl disclosed a bug submitted by p4p3r_hak: https://hackerone.com/reports/3708482 [...]
PortSwigger Web Security disclosed a bug submitted by bereza4321: https://hackerone.com/reports/3625600 - Bounty: $200 [...]
We recently added a C/C++ security checklist to the Testing Handbook and challenged readers to spot the bugs in two code samples: a deceptively simple Linux ping program and a Windows driver registry handler. If you found the inet_ntoa global buffer gotcha or the missing RTL_QUERY_REGISTRY_TYPECHECK flag, nice work. If not, here’s a full walkthrough of both challenges, plus a deep dive into [...]
curl disclosed a bug submitted by ravindrasl2026: https://hackerone.com/reports/3710209 [...]
curl disclosed a bug submitted by codexxxx: https://hackerone.com/reports/3707747 [...]
curl disclosed a bug submitted by orelbn7: https://hackerone.com/reports/3712343 [...]
As part of our recent AI blog series, and in addition to content on ‘How AI is leveraged to enhance the Intigriti platform’, we have provided multiple insights from the Intigriti team on the development and future of AI, how it impacts programs, and the Bug Bounty community. So far, we have explored: ‘How AI is changing vulnerability discovery’, with COO, Ed Parsons. ‘Common AI misconceptions [...]
As API and AI adoption grows across the Middle East, so do the expectations around how data is handled. For many organizations operating in this region, it’s not just about securing applications. It’s about doing it in a way that keeps data in-country and aligned with local requirements. Today, we’re introducing the Wallarm Middle East Cloud Point of Presence (POP), giving organizations a n [...]