I just published my writeup about How an incident gave us $$$ bounty. If you have any query feel free to DM me. medium.com/@vpawar1147/how-a…

🚨 CVE-2026-21589 - Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read Nuclei Template : github.com/projectdiscovery/… Reference: labs.watchtowr.com/you-wont-… #bugbounty #hackwithautomation #atlassian

men after losing everything

@Meta @instagram My Instagram account (Username: prites.sh) has been suspended unexpectedly. I have not violated Instagram’s Community Guidelines or Terms of Use. Please review my account and restore it if the suspension was made in error.

obsession over talent

Better to be a wolf that everyone hates, than a donkey who everyone rides.

"><img src=x onerror=alert('@bsidesahmedabad ')> I want to bring my friend to learn AI Security, prompt injection, and how we can defend AI systems. BSides is the perfect place to learn from researchers, share ideas, and discover what’s next in cybersecurity. @pritesec

Web cache deception tricks 🪄 GET /api/me → returns PII Run these to trick the CDN into caching a sensitive endpoint: 🟥 GET /api/me;.css 🟥 GET /api/me/foo.css 🟥 GET /static/..%2fapi/me 🟥 GET /api/me%00.css 🟥 GET /profile%2f%2e%2e%2fstatic Your ideal scenario: the origin ignores the trailing junk (; param, extra path segment, encoded traversal) and returns private data anyway, but the CDN only sees the .css suffix and caches it as static. NOTE: Also try other delimiters, file extensions, and static directories.

On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

Guys, I built a super fast Android decompiler called ASC. It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel. And this week my Agent use ASC found 2 RCE in Honor and Xiaomi! This tool now accepted by BlackHat EU Arsenal github.com/MG1937 #BHEU

I wrote a write-up about a v8 challenge. In that write-up I explain about the v8's sandbox. I expect that you enjoy reading that write-up!!!! davi1337.gitbook.io/public/h…

@ViCustomerCare My Vi number has been deactivated without any prior SMS, email, or WhatsApp notification. I have already completed the recharge, yet none of my services are working. Why was I not informed before deactivation? Please clarify the reason and kindly resolve urgently

Starting September 2026, standard Google API keys (AIza...) will no longer be accepted for Gemini API access. ai.google.dev/gemini-api/doc…

$1,500 for leaking AI System Prompt. I show you how your Burp suite configuration is preventing you from catching these bugs. A specific 3rd party domain, when not configured right would expose your system prompt and configuration flags. medium.com/@tinopreter/1-500…

The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for what’s next. huggingface.co/blog/agent-in…

You can also use Shodan's Certificate Transparency (CT) API to enumerate a target's subdomains directly from the crt.sh database. ctl.shodan.io/api/v1/domain/… /api/v1/domain/{domain} ~returns the certificates that match a domain /api/v1/domain/{domain}/hostnames ~returns all hostnames associated with a domain

Kimi K3 exploited the latest Redis server with a 0day it discovered. All it took was 27min with 32 agents. github.com/berabuddies/redis…

$100,000 in bounty 🤯 Thanks @GitHubSecurity

OAuth Authorization Bypass Testbed 403.brutelogic.net/authz/oau…

Local AI for Penetration Testing & Research Author: Eddie Zhang Resource: projectblack.io/blog/local-a…