𝘻𝘰𝘪𝘥𝘴𝘦𝘤

Same trap, two languages: Python: os.path.join("/app", "/foo/bar") is "/foo/bar" C#: Path.Combine("/app", "/foo/bar") is "/foo/bar" In the happy path they do what you expect, so people never look further.

If you've read my book The CVE Archeologist's Field Guide, an honest Amazon review would really help. Any rating. One or two sentences is plenty: what was useful, what was missing. It has 5 ratings so far, and for a niche book that's the first thing strangers check.

We investigated a spam campaign running on throwaway domains, and found the company behind it with our new Pivot tool. Its WHOIS was privacy-protected, but the company name was left in the organization field, on 208 domains. blog.profundis.io/blog/from-…

@HacktronAI names a July intrusion chain into @OpenAI , @MetaBugBounty announces a public Muse bounty up to $300K, @efaav finds unsigned JWT auth in a Microsoft analytics API tied to 17 trillion records, and more. This week, Disclosed. #BugBounty Full issue → getdisclosed.com Highlights below 👇 @MetaBugBounty takes its Muse AI-agent bounty public, up to $300K for qualifying vulns and high-impact prompt injection. @HacktronAI documents a chained intrusion into @OpenAI, starting from an image parsing bug and ending in RCE plus downstream identity and SSO abuse. @efaav walks through unsigned JWTs in an internal Microsoft analytics API, claim spoofing unlocked arbitrary queries, the write-up frames the blast radius as 17 trillion records. @vercel consolidates private and OSS coverage into one public @Hacker0x01 program spanning Vercel products and open-source projects. @Intigriti confirms @Adobe’s public bug bounty program migration, going live on September 1, 2026. @AnthropicAI announces a public @Hacker0x01 bug bounty after running privately with invited researchers. Anthropic’s September 2026 threat report summarizes observed Claude misuse, including multi-agent phishing and AI-augmented cyber workflows. @NahamSec announces NahamCon “Prompt2Pwn,” a live hacking event format for 2026. @forefy releases reburp, a Burp extension that exposes the Montoya API as a localhost OpenAPI REST interface for external scripts and agents. @Pillar_sec reports session spoofing and SSRF in Grafana MCP, one issue enabled unauthenticated tool execution with server-side privileges. @0xacb drops a GeoNetwork pre-auth RCE chain write-up, unauth formatter upload plus unsafe XSLT reached code execution. @SLCyberSec details Goja JavaScript engine exploitation, out-of-bounds heap write to arbitrary read/write and full RCE. @devploit ships geminiHunter, scanning web assets and Android apps for exposed Google Gemini API keys, plus validation checks. @Antisy_Training publishes “Exfil Everything,” a survey of real-world data theft chains against AI agents and their trust boundaries. That's not all. Full links, writeups & more → getdisclosed.com Bug bounty and offensive AI, curated.

🫶🫶🫶 "Like and Subscribe" 🫶🫶🫶

One of the biggest mistakes beginners make when testing an application is not reading the error messages properly. They send a payload, get an error and conclude that it did not work. Then they send another payload, get another error and assume it is basically the same thing. But an error does not mean the payload did not work. It just means that an error was triggered somewhere in the execution path, and that point may be after the interesting part already happened. Your payload may have been parsed successfully, changed the control flow, bypassed a check, reached a different function or triggered behaviour that the previous payload did not. Something later may simply have failed. This is why small differences matter so much. A different exception, a slightly different message, a different status code or even a different location in a stack trace can tell you that you moved forward. Security testing is often about noticing those tiny changes and asking why they happened. Don’t just look for success or failure. Read the error.

I have spent a fair amount of time writing SQL (Injections), and today I learnt that LIKE has an ESCAPE clause that lets you redefine the escape character! > SELECT 'PTL%' LIKE 'PTLX%'; -- 0 > SELECT 'PTL%' LIKE 'PTLX%' ESCAPE 'X'; -- 1

You can’t demo or benchmark your AI pentester against Juice Shop and expect to be taken seriously.

🚨 Profundis update 🚨 Over the last few weeks Profundis changed a lot - for the better. A new credit system, 100M+ new similar favicons, grouped results, and our powerful recon engine is now quietly backfilling bug-bounty scopes. Thread 🧵