For anyone using LLMs to do security research, bug bounty, red teaming, etc, we made a Discord to discuss/collaborate: mistakes.io/discord/

I’d be willing to pay $100 per report for priority triage with automated dupe checking and faster payouts (<48 hours). My experience with this on Immunefi was great, and it’s not a bad way to incentivize researchers to stop abusing teams as the initial assessors of AI reports.

If Discord is only paying $5k for an RCE in their desktop client, it's probably time to uninstall it

Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click

You have to re-watch all of them on the livestream. They are so great!!! So many talented people

We found a critical auth bypass in @better_auth, one of the most popular auth libraries in 2026 with over 9.5 million weekly downloads. CVSS 9.1. Fixed in Better Auth 1.7.7 PoC below 👇

How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net/how-i-couldve-… :)

One million requests in 10 seconds, over WiFi. Turbo Intruder 2 has landed!

It's a little hard to internalize that the list of things one person can achieve is rapidly growing. You must think big to match what you're truly capable of now

It's very possible to be a nobody and find bugs with AI, but I think @HacktronAI is catching some unnecessary flack after they (very humbly) didn't flex their insane reputation to journalists covering this story. It reads better if they are noobs, but they aren't. The opposite.

We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems.

🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX tantosec.com/blog/2026/09/te… The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.

- traced the login flow between the app, IdP, and backend. - saw weird automated call to reauth endpoint. was authenticated call. - the xx-char hex UID being sent as the password. It’s an account ID, not a UUID or secret. - the backend never checked the UID signature. - replayed another test account’s UID with no cookies, OTP, session, or password. - got a valid access token for that account. - confirmed profile access and read/write access. - possible cause: the backend trusted the identifier as a password. or bad code, didn't look into the code.

Cool bug, but I'm really curious why this works?

I read this sci-fi book when I was 7 and it should be realistic fiction now

Scoop: The FBI asked Federal Air Marshals to covertly monitor former congressman Eric Swalwell during an international flight, to see if they could visually ascertain the passcodes to his electronic devices. theatlantic.com/politics/202…

Reverse Engineering My ADHD Test by @blastbots nullpt.rs/reverse-engineerin…

The guy writing the TeamPCP/CanisterWorm malware knows me by first name and is leaving little notes in his source code asking me to be nice💀 Somehow, he's finding time to read my ramblings between pushing new versions🙃

Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. 🧵

leaking Microsoft employee secrets through diagnostic data: careful.net/blog/powerlift/

We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/