Disclosed. September 13, 2025. Nullcon LHE Winners, Bugcrowd’s $30K Showdown, AI Zero-Days, ChatGPT Email Exploit, and More

Rankings at TeamViewer Live Hacking Event [🔗 Tweet]
by YesWeHack

Nullcon Berlin 2025 Live Bug Bounty concluded with 39 reported bugs, including critical issues like path traversal, access control flaws, business logic errors, and LLM prompt injection. The top three winners were Aituglo (@aituglo) in 1st place, yassine_eal (@yassine_eal) in 2nd, and CMD - Constantin (@CMD_0_0) in 3rd.
Read the full tweet →

Bugcrowd Launches Hacker Showdown: The Mind Cathedral [🔗 Blog]
by Bugcrowd

Bugcrowd has kicked off its 2nd annual Hacker Showdown, themed The Mind Cathedral, where teams of 2–3 hackers compete across two rounds for a $30K grand prize and exclusive swag. Points are earned through valid, non-duplicate submissions (P1–P3), with the top 8 teams advancing after the first round, and applications closing on September 19, 2025.
Read more → 

Prompt. Scan. Exploit - Ai's Journey Through Zero-Days And A Thousand Bugs [🎥 Video]
by @BugBountyDEFCON

Two security researchers, Joel Noguera and Diego Jurado, recap how their AI-driven hacking system evolved from solving CTF-style labs to real-world bug bounties—achieving top HackerOne rankings in 2025, reporting ~1,600 vulnerabilities, and earning $150k with notable finds like XSS/XXE/RCE in major platforms. They detail the shift from DockerHub CVE hunting to black-box bounty targets, using an agent manager, strict scope/validation controls, target scoring and deduplication, and “alloy” (multi-model) LLMs—plus cost and scan-tuning lessons—to help others integrate AI into practical security workflows.
Watch video →

Exploiting ChatGPT to Access Private Email Data [🔗 Tweet]
by Eito Miyamura

This tweet exposes a method to leverage ChatGPT's new features to access and leak private email data using a victim's email address, highlighting significant concerns regarding user data security.
Read the full thread →

Have something you want to Spotlight? Tell me.

PortSwigger Partners with HackerOne for Milestone Rewards [🔗 Blog]
by PortSwigger x HackerOne

PortSwigger announces their collaboration with HackerOne to introduce the Hacker Milestone Rewards Program, incentivizing contributions to bug bounty programs.
Read the full blog →

Caido Launches Discounted Pricing for Indian Hackers [🔗 Tweet]
by Caido

Caido has reduced pricing for individual plans in India, making it more accessible for local hackers to participate in bug bounty activities.
Read the full thread →

Glass Firewall Conference for Women in Cybersecurity Returns [🔗 Tweet]
by HackerOne

The Glass Firewall Conference, a complimentary event for women in cybersecurity, is set to return on October 20, 2025, featuring hands-on workshops and panel discussions.
Read the full thread →

New Scope on Zoom’s Bug Bounty Program [🔗 Tweet]
by Roy Davis

An updated list of features available for testing in the Zoom bug bounty program has been shared, encouraging researchers to engage with the initiative.
Read the full thread →

YesWeHack Acquires French Cybersecurity Specialist Sekost [🔗 Tweet]
by YesWeHack

YesWeHack has completed its first-ever acquisition, purchasing French cybersecurity audit specialist Sekost, marking a strategic move to expand offerings for SMEs and strengthen its international reach. 

Read the full thread →

New Public Bug Bounty: Sportradar’s VAIX API [🔗 Tweet]
by Bugcrowd

Bugcrowd has announced a new public program for Sportradar’s VAIX API, which powers AI-driven wagers and bets in the iGaming industry. Hackers are invited to test this unique attack surface, uncover vulnerabilities, and help secure the platform.
Read the full thread →

Did I miss an important update? Tell me.

Nuclei Template for CVE-2024-46982 Next.js Web Cache Poisoning [🔗 Tweet]
by Nuclei by ProjectDiscovery

This tweet announces a new bug bounty issue for CVE-2024-46982, concerning a web cache poisoning vulnerability in Next.js and provides a link to the details.
Read the full thread →

Automated WHOIS Search Tool for Attack Surface Expansion [🔗 Tweet]
by Profundis.io

A new WHOIS search tool enables users to search across over 100 million domains, streamlining the discovery of related assets and connections without manual effort.
Read the full thread →

jxscout Enhances Next.js Support with New Features [🔗 Tweet]
by Francisco Neves

The latest release of jxscout automates detection of build manifests and lazy-loaded chunks for Next.js, alongside usability improvements in VSCode.
Read the full thread →

ParamSpider: Mining URLs from dark corners of Web Archives [📁 Tool]
by devanshbatham

ParamSpider extracts URLs from the Wayback Machine archives, filtering out less relevant results to focus on more significant links. It’s essential for bug hunting, enabling exploration of hidden or forgotten URLs that may pose vulnerabilities. The repository includes installation instructions and usage examples to aid penetration testing.
View the tool →

Have a favorite tool? Tell me.

Meta’s $111,750 Bug: Chaining Path Traversal to RCE [📝 Writeup]
by Abhishek meena

The blog details a critical vulnerability in Facebook Messenger for Windows, highlighting the exploitation of both path traversal and DLL hijacking to achieve remote code execution. Key insights stress the need for robust client-side validation.
Read more →

WAF Bypass SSRF:  A Unique Way of Reading Internal Files. [📝 Writeup]
by Basavaraj Banakar

This blog outlines a novel approach for exploiting SSRF vulnerabilities while bypassing WAF, including a real-world scenario to access sensitive internal files. Emphasizing proactive security assessments, it calls for a focus on the risks posed by SSRF vulnerabilities.
Read more →

How two dollars and one zip file let me read the server files - Bergee's Stories on Bug Hunting [📝 Writeup]
by @_bergee_

This blog recounts the discovery of an arbitrary file read vulnerability via a zip symlink attack, yielding content from the server’s /etc/passwd file. The author discusses investment in features that facilitate deeper testing and reflects on the importance of prompt reporting.
Read more →

$1,000 Critical Bug: Unauthorized Access Leading to Support Admin Panel Takeover [📝 Writeup]
by V3D

This write-up details a critical vulnerability discovered in a private bug bounty program, highlighting a method for unauthorized access to sensitive support documentation. The author shares steps for reproducing the exploit and discusses the payout process, underscoring the importance of proper communication with bug bounty programs.
Read more →

How a Weak State Parameter Led to Full Integration Hijack [📝 Writeup]
by @yassenAlsayed1

The write-up focuses on an OAuth misconfiguration that allowed account hijacking through a predictable state parameter. The author covers specific exploitation steps and the broader implications for developers and managers, calling attention to the need for secure integration practices.
Read more →

How I Discovered a PII Leak in a Developer Platform [📝 Writeup]
by Medusa

This post shares the author’s experience in identifying an Excessive Data Exposure vulnerability in a developer platform's API. It provides practical methods for utilizing tools like Burp Suite for data leak assessments.
Read more →

Did I miss an important update? Tell me.

The Desync Endgame with James Kettle [🎙️ Podcast]
by Critical Thinking Bug Bounty Podcast

This episode features James Kettle of PortSwigger, exploring his groundbreaking research on request smuggling, cache poisoning, and desync vulnerabilities. He shares insights on methodology, avoiding burnout, and how AI and curiosity fuel long-term security research.
Watch video →

AWS S3 Bucket Hacking Explained (Bug Bounty Hunters Must Watch) [🎥 Video]
by Medusa

This video covers AWS S3 bucket misconfigurations, demonstrating how ethical hackers can identify vulnerabilities through precise commands and best practices.
Watch video →

Why Do We Reject Some Vulnerability Submissions? (Bug Bounty Basics) [🎥 Video]
by Wordfence

This video explains the common reasons behind vulnerability submission rejections in bug bounty programs, offering insights for researchers.
Watch video →

El Mago x YesWeHack #3: Live Recon on ATG Bug Bounty Program [🎥 Video]
by YesWeHack

In this episode of Hacking Nights, El Mago returns for a collaboration with YesWeHack, exploring live reconnaissance strategies (in Spanish).
Watch video →

Exploiting CVE-2025-4123: Grafana SSRF and Account Takeover Explained [🎥 Video]
by Alvaro Balada

This video provides a detailed explanation of exploiting CVE-2025-4123, a complex open redirect leading to SSRF and account takeover.
Watch Video →

Five Essential Linux Commands for Bug Bounty Recon [🎥 Video]
by Ben Sadeghipour (Nahamsec)

This video walks through five powerful Linux commands—like curl, xargs, grep, and jq—that streamline recon and exploitation for bug bounty hunting. It shows how combining these basics into custom workflows can filter data, manipulate requests, and save hours during recon.
Watch video →

Did I miss something? Tell me.

The Bug Bounty guide to exploiting CSRF vulnerabilities [📝 Writeup]
by YesWeHack

This guide explores Cross-Site Request Forgery (CSRF) vulnerabilities and methods of exploitation, detailing effective prevention strategies and practical examples for bug bounty hunters.
Read more →

Exploring Prompt Injection Vulnerabilities in AI Systems [🔗 Tweet]
by Mike Takahashi

This tweet outlines various avenues for prompt injection attacks within AI systems, shedding light on the critical nature of understanding AI vulnerabilities.
Read the full thread →

Clever Payload Splitting Techniques to Bypass WAFs [🔗 Tweet]
by André Baptista (0xacb)

This tweet presents techniques for using clever payload splitting to bypass Web Application Firewalls, highlighting evolving challenges in evasion tactics.
Read the full thread →

Finding and Exploiting Blind XSS Vulnerabilities [🔗 Tweet]
by Intigriti

This tweet shares a technical article detailing methodologies for identifying blind XSS vulnerabilities and provides sample payloads for practical testing.
Read the full thread →

Top 5 Archived Bug Bounty Write-Ups to Learn From [🔗 Tweet]
by Intigriti

This tweet links to five archived bug bounty write-ups that remain relevant, likely offering insights from experienced hackers for learning.
Read the full thread →

how I made 6 figures in my first year in bug bounty: my experiences [📝 Writeup]
by furkan

Furkan recounts his journey to earning six figures in his first year of bug bounty hunting, sharing strategies for focusing on individual programs and learning from feedback to improve skills.
Read more →

Did I miss something? Tell me.

Essential Life Lessons for Bug Bounty Hunters [🔗 Tweet]
by Stealthy

This tweet emphasizes the need for maintaining mental and physical health, alongside effective targeting strategies in bug bounty hunting.
Read the full thread →

Understanding Application Flows for Effective Bug Bounty Hunting [🔗 Tweet]
by Behi

This tweet highlights the importance of viewing applications as interaction flows, indicating vulnerability points at each step.
Read the full thread →

Discovering Regex Bugs Leads to $4k in Bounties [🔗 Tweet]
by Mat Rollings

The author shares two regex-based unauthenticated XSS vulnerabilities discovered, resulting in $4k in bounties, advocating the learning of regex for bug bounty hunting.
Read the full thread →

Extract URL Components Using Unfurl Tool [🔗 Tweet]
by bugcrowd

This tweet showcases the 'unfurl' tool by @tomnomnom for extracting URL components, useful in security analysis.
Read the full thread →

Bypassing Email Verification with HTTP Request Manipulation [🔗 Tweet]
by khan mamun

The tweet outlays a method for bypassing email verification through HTTP request manipulation, highlighting a potential security flaw.
Read the full thread →

Critical Adobe Commerce Update Patches RCE and ATO Vulnerabilities [🔗 Tweet]
by Blaklis

This tweet announces a patch for RCE and ATO vulnerabilities in Adobe Commerce and Magento, urging immediate updates to mitigate risks.
Read the full thread →

Chaining Small Bugs into Big Exploits in Bug Bounty Hunting [🔗 Tweet]
by bugcrowd

This tweet discusses the strategy of chaining small vulnerabilities, referred to as gadgets, for impact in exploits, underlining the importance of knowledge about the target.
Read the full thread →

Maximize Earnings by Exploiting Race Conditions [🔗 Tweet]
by Sir. Zeus

The tweet discusses exploiting race conditions using parallel requests, particularly on creation endpoints for vulnerability discovery.
Read the full thread →

Identify Web Technologies Using 404 Error Page Insights [🔗 Tweet]
by ReconOne

This tweet shares a resource for identifying web technologies based on analyzing 404 error pages, aiding reconnaissance during bug bounty hunting.
Read the full thread →

Open Source Software Tactics for Bug Bounty Hunters [🔗 Tweet]
by Behi

The tweet suggests that bug bounty hunters should verify whether unfamiliar software is open source and check GitHub issues for potential underlying vulnerabilities.
Read the full thread →

Testing Outdated Swagger Instances for XSS Vulnerabilities [🔗 Tweet]
by VIEH Group

This tweet advises researchers to test outdated Swagger instances for XSS vulnerabilities, sharing payload ideas for quicker bounties.
Read the full thread →

Did I miss something? Tell me.

Because Disclosure Matters: This newsletter was produced with the assistance of AI. While I strive for accuracy and quality, not all content has been independently vetted or fact-checked. Please allow for a reasonable margin of error. The views expressed are my own and do not reflect those of my employer.