Hey there! What an insane week.
Anthropic just released a new CVP with three tiers of cyber access, but the bug bounty community still hasn't been granted access. I actually got temporarily suspended when I tried to get in.
As mentioned last week, I started playing around with GLM 5.3, and my first impressions are that this model is seriously capable at black-box testing. It'll likely become my daily driver for most of my hackbot work moving forward. The Flash variant is surprisingly good as well (at roughly one-third of the inference cost), but it doesn't go quite as deep. I'll probably use Flash for broad investigation and recon work, while sticking to the full model for deeper exploitation and escalation.
The writing is on the wall: we need to find ways to keep running our stuff without being dependent on the frontier labs. Local models are probably the answer. I've seen a lot of people going the DGX Spark route, but I missed the boat, and now the only units I can find are going for $6–7k each. I think I'm going to hold out a couple more weeks and try to pick up a Mac Studio M5 Ultra when the 512GB version becomes available.
On a different note, there were a couple of conferences this week that I'm really bummed I couldn't make it to. Notably, Offensive AI Con (anybody go? You'll have to tell me how it was!) and Ekoparty in Argentina. Huge shout-out to Ariel Garcia, co-founder of the Bug Bounty Village, for giving a Hackbot talk at the Bug Bounty Girls Club at Ekoparty this week. Can't wait to hear how it went.
Anyway, let's dive in.
Nothing to promote. Just happy you’re here!
Anthropic Expands Its Cyber Verification Program With Tiered Model Access [📓 Blog]
by Anthropic (@AnthropicAI)
Anthropic expanded its Cyber Verification Program (CVP) into three tiers, offering vetted defenders reduced cyber-safety blocking and access to top models for approved security work. The announcement frames the change as a dual-use tradeoff: conservative defaults for general users, and relaxed safeguards for verified orgs/individuals doing defensive research and red-team activity.
The Model Isn't Cooperating [📓 Blog]
by PortSwigger
James Kettle reports on an experiment using autonomous agent swarms to run multi-step security research “cascades,” and why they often fail despite strong single-step performance. The post breaks down trace-level failure modes and the real operational cost of token/compute burn when trying to automate novel vulnerability discovery at scale.
Have something you want to Spotlight? Tell me.
HackerOne Security Research Report 2026 (10th Edition) [📓 Blog]
by HackerOne
HackerOne’s 2026 Security Research Report introduces “exposure debt”: the growing gap between vulnerability discovery and an org’s ability to validate, prioritize, and remediate. It includes platform stats (including payout totals and resolution-time trends) and frames CTEM-style programs as the way to keep backlog growth from turning into systemic risk.
Bugcrowd Updates Platform Triage Mechanics to Improve Signal Quality [📓 Blog]
by Bugcrowd
Bugcrowd announced changes to platform triage mechanics aimed at reducing low-signal submissions and preserving triage capacity across engagements. The update is positioned as an operational/process change rather than a technical feature release.
Pwn2Own Ireland 2026: Day 3 Results and Master of Pwn [📓 Blog]
by Zero Day Initiative (@thezdi)
ZDI’s final-day recap covers the biggest hits from Pwn2Own Ireland 2026, including Ikotas Labs taking Master of Pwn with a multi-bug chain against the Google Pixel 10. The post also tallies contest totals, with over $1.1M paid out for roughly 90 unique 0-days from 29 teams.
Ekoparty Live Hacking Finals: PyUs3r, bofill3, and tonysec Take the Podium [𝕏 Tweet]
by YesWeHack
YesWeHack shared the final results from the ekoparty live hacking event, highlighting the top finishers and podium placements. It’s a quick recap for anyone tracking competitive live hacking performance and standout researcher teams.
Did I miss an important update? Tell me.
PIChef: CyberChef-Inspired Workbench for Prompt Injection Payloads [📓 Blog]
by Sentry Security
Sentry’s PIChef is a browser-based workbench for composing and sharing prompt-injection payload “recipes,” with step-by-step transforms and intermediate output visibility. It bundles dozens of operations (encoding/obfuscation, framing/scaffolding, carrier formats like HTML/QR/RAG docs) and ships with presets based on prior research, aiming to make payload iteration reproducible rather than “one-off.”
Anthropic Releases OSS Scanner for Finding Vulnerabilities in Critical Repos [🛠️ Tool]
by Anthropic (@AnthropicAI)
A tweet highlights Anthropic’s OSS Scanner, a service focused on scanning critical open-source repositories for vulnerabilities, with code available on GitHub. The release targets teams looking to operationalize repo-scale scanning and review the implementation.
Cloudflare Security Audit Skill: Agent-Orchestrated Audits With Verifiable Findings [🛠️ Tool]
by Cloudflare (@cloudflare)
Cloudflare’s security-audit-skill repo defines a multi-phase audit workflow for coding agents, with schemas and validators to keep findings machine-readable and independently verifiable. It emphasizes separation between hunter and verifier agents, coverage ledgers, and target-neutral reporting to reduce false confirmation and stale evidence in automated audit pipelines.
Bug Bounty Hunting Prompts: Evidence-First, Phase-Based Workflow Pack [🛠️ Tool]
by Marius du Preez (@mdp_sec)
This repo publishes reusable prompt “phase files” for structuring an evidence-first bug bounty workflow, from recon through verification, escalation, and deduping. It’s designed for adaptation to private tooling/integrations, with explicit focus on handoffs, validation discipline, and safe operation on authorized targets.
Have a favorite tool? Tell me.
A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline [📓 Blog]
by Searchlight Cyber (@SLCyberSec)
Kévin Gervot details two default-config Discourse vulns: an HTML injection path that can be chained into sitewide stored XSS despite a strict-dynamic CSP, and a permissive ImageMagick/Ghostscript pipeline combined with tempfile extension handling and a TOCTOU race. The write-up includes end-to-end chains, code pointers, and why common Docker deployments are exposed.
Smashing the Token Limit With Overlapping Fragments [📓 Blog]
by PortSwigger · research by Alex Craig
Alex Craig, building on Gareth Heyes’ earlier research, introduces a CSS exfil technique that reconstructs long secrets by collecting overlapping fragments and stitching them back together, avoiding recursive stylesheet imports. The post quantifies recovery rates under realistic selector budgets and includes a Burp extension plus labs to reproduce the approach.
Claude Code Worktree Sandbox Escape (CVE-2026-55607) [🛠️ Tool]
by v_metnew
This write-up repo documents a Claude Code CLI sandbox escape via a prompt-injected malicious repo abusing git worktree handling to overwrite ~/.zshenv and break out of macOS seatbelt constraints. It includes a full PoC bundle, artifacts, and notes on the mitigation (blocking .git as a worktree name) and affected versions.
DeepSeek-Reasonix: How a Poisoned Git Config Can Hijack an AI Coding Agent [📓 Blog]
by GitLab (@gitlab) · research by Abisheik Magesh and Daniel Abeles
GitLab’s Threat Research Group details a command-execution issue in DeepSeek-Reasonix Studio where viewing diffs can trigger attacker-controlled commands via git’s filter.<driver>.clean selected by .gitattributes. The post explains why common hardening flags don’t stop the clean filter, then lays out mitigations (fixed versions, overriding git keys per invocation, and safer diff strategies).
How Abliterated Models Can Get You Pwned [📓 Blog]
by ProjectDiscovery · research by Prince Chaddha
ProjectDiscovery demonstrates how weight-edited (“abliterated”) open models can hide phrase-triggered backdoors that issue tool calls leading to command execution and exfiltration in coding-agent setups. The research walks through a QLoRA-based poisoning workflow, shows high trigger reliability with minimal poison, and argues defenses should prioritize runtime sandboxing and strict trust boundaries for third-party weights.
Adminer 0-days: Pre-auth RCE, Stored XSS, and Root RCE [📓 Blog]
by Voorivex Team (@voorivexAcademy) · research by Yashar Shahinzadeh and Amirmohammad Safari
A tweet thread points to Voorivex research on multiple Adminer issues, including a pre-auth RCE via MSSQL DSN injection, a stored XSS leading to session compromise, and an authenticated SQLite VACUUM INTO path that can reach root-level impact. The disclosure references fixes in Adminer 5.4.3+.
Death by a Thousand PaperCuts: PaperCut Pre-auth RCE Chain and Patch Bypasses [📓 Blog]
by watchTowr (@watchtowrcyber) · research by Piotr Bazydlo
watchTowr analyzes an in-the-wild PaperCut exploitation chain and subsequent patch-bypass iterations, showing how attackers moved from auth bypass to pre-auth RCE across multiple CVEs. The post focuses on Apache Tapestry invocation patterns and incomplete authorization checks, with concrete request sequences that illustrate how “fixed” paths can remain reachable via alternate framework flows.
AgentCorruption: Prompt-Only Compromise of AWS Bedrock AgentCore via IMDS Access [📓 Blog]
by Zenity Labs (@zenitysec_labs) · research by Tamir Ishay Sharbat
Zenity Labs reports that AWS Bedrock AgentCore agents could reach the instance metadata service (IMDS), allowing an attacker with only chat access to extract credentials and pivot across agents in the same account/region. The write-up covers blast radius (conversation access, memory poisoning, secret theft) and frames the root issue as cloud isolation boundaries failing around agent processes.
Did I miss something? Tell me.
Subdomain Takeover Escalation: From Dangling CNAME to Parent-Domain Cookie Control [📓 Blog]
by Synack · research by Plamen Dimitrov (Synack Red Team)
Synack’s Exploits Explained shows how a dangling CNAME takeover can be escalated into parent-domain cookie control using a third-party portal feature that permits custom JS/CSS. The piece focuses on demonstrating real impact (cookie tossing/session fixation risk across subdomains) and highlights mitigations like eliminating stale DNS targets and avoiding overly broad cookie domains (e.g., using __Host-).
Guide: Discovering and Testing API Endpoints Effectively [𝕏 Tweet]
by Bugcrowd
Bugcrowd shared a short guide covering practical techniques for API endpoint discovery and testing. It’s framed as workflow advice (discovery sources, test strategy, and tooling) rather than a deep technical write-up.
HackerNotes Ep. 195: Frans Rosen on AI Dupes, Impact Bumping, and Staying Close to the Bug [📓 Blog]
by Critical Thinking Podcast · written by Aituglo
This episode write-up discusses how AI can recreate the old “scanner dupe” dynamic, where many hunters converge on the same initial foothold, and argues for incentives like paying for “impact bumps” when researchers turn a known low into a critical. It also outlines where AI helps in practice (fingerprinting, parser edge cases, injection variants) and where it still struggles (context-heavy SSRF, races, blind paths).
The Evolution of Bug Bounty: History, Best Practices, and the Impact of AI [📓 Blog]
by YesWeHack
YesWeHack reviews how bug bounty programs fit into modern exposure management and where LLMs change day-to-day workflows (recon acceleration, payload iteration, report drafting) without replacing validation and exploitability judgment. It also calls out AI-specific scope and triage considerations, including prompt injection, non-deterministic behavior, and permission/RAG boundaries.
How a Bug Bounty Researcher Chooses Which Features to Investigate [📓 Blog]
by GitHub · interview by Shilpa Kumari with @vaib25vicky
GitHub profiles a VIP program researcher and their approach to target selection: prioritizing complex features, leaning into access-control/authorization hypotheses, and iterating on a surface until behavior breaks. The interview also touches on using AI as a productivity layer (with careful verification) and summarizes GitHub’s VIP qualification criteria and incentives.
Did I miss something? Tell me.
Frans Rosen on the AI Age of Bug Bounty (Ep. 195) [🎥 Video]
by Critical Thinking Podcast
This episode features Frans Rosen on how AI is changing bug bounty dynamics, including increased dupes and the case for rewarding “impact bumping” when researchers escalate known issues into higher-severity chains. The conversation also covers where AI adds real leverage versus where hands-on validation and deep context still dominate.
I Gave Claude Access to My Hacking Traffic [🎥 Video]
by Ben Sadeghipour (@NahamSec)
Ben Sadeghipour demos routing real-world web hacking traffic into Claude to assist with analysis and hypothesis generation. The video focuses on practical workflow integration—what helps, what fails, and where human validation is still required when interpreting noisy request/response data.
The Last Hacker Standing: Surviving the Age of AI [🎥 Video]
by Zenity Labs (@zenitysec_labs)
Ben Sadeghipour (NahamSec) discusses how LLMs are reshaping bug bounty workflows, from recon automation to faster code comprehension, and where they introduce new noise and attacker leverage. The talk argues that chaining, threat modeling, and rigorous validation remain the differentiators as automation becomes table stakes.
Did I miss something? Tell me.
Short SQLi Concatenation Payload Bypasses an 8-Character Limit [𝕏 Tweet]
by r9Mody
r9Mody shares a compact SQLi pattern using concatenation (||) and table.column dot notation to work within an 8-character backend constraint. It’s a useful reminder that length limits often collapse once alternative concatenation and identifier formats are in play.
Turbo Intruder Breaks 100k HTTP/3 RPS and Highlights Rate-Limit Mismatch Tricks [𝕏 Tweet]
by Critical Thinking Podcast
A tweet notes Turbo Intruder hitting 100k+ HTTP/3 requests/sec over Wi‑Fi, enabling significantly larger brute-force and wordlist workloads. It also calls out rate-limit mismatch angles (e.g., path normalization quirks like semicolon variants) to squeeze extra attempt budget past defenses.
New XSS Vector Using the usermedia Tag Added to the Cheat Sheet [𝕏 Tweet]
by Gareth Heyes (@garethheyes)
Gareth Heyes flags a newly cataloged XSS vector leveraging the usermedia HTML tag, now added to the community cheat sheet. It’s a small but practical payload expansion for HTML/DOM XSS testing.
Many AI Failures Are Objective Failures, Not Model Failures [𝕏 Tweet]
by Daniel Miessler (@DanielMiessler)
Daniel Miessler argues that a large class of AI “failures” are really failures to define objectives and constraints, leading systems to optimize toward unintended outcomes. The point translates cleanly to security automation: unclear success criteria produces brittle agents and misleading results.
Did I miss something? Tell me.
Because Disclosure Matters: This newsletter was produced with the assistance of AI. While I strive for accuracy and quality, not all content has been independently vetted or fact-checked. Please allow for a reasonable margin of error. The views expressed are my own and do not reflect those of my employer.