An attacker turned the comparatively small market for the MAMO token into a source of multimillion-dollar loans. Within a few hours, the assailant inflated the value of collateral in Moonwell, bor…

A familiar humanity check has suddenly become a gateway into the corporate network. Microsoft has disclosed a campaign named TerminalFix, in which compromised websites display a counterfeit Cloudf…

An enormous fragment of early Steam history suddenly became accessible for public scrutiny over a decade later. A colossal archive, spanning roughly 12 to 13 terabytes, is currently circulating ra…

The US Department of Justice has had to amend a resounding statement about the Chinese hacking group QTFY. After the first release, the impression formed that the attackers had successfully penetr…

Malicious tools strive to blend into ordinary network traffic, but the new Miraak framework has gone further and transformed a cloud PostgreSQL database into a full-fledged channel for controlling…

A cyberattack on one of Australia’s largest book distributors has been disrupting deliveries across the country for roughly six weeks. After intruders breached the systems of Alliance Distri…

Open registration on developer platforms generally streamlines onboarding processes. However, concerning Gitea, this convenience inadvertently transformed a critical vulnerability into an easily a…

ServiceNow recently addressed three maximum-severity vulnerabilities residing within its AI Platform. Astonishingly, each individual flaw received a perfect 10.0 rating on the CVSS 4.0 scale. Furt…

A technical breakdown of a working Claude Sonnet 4.6 jailbreak, responsible disclosure, and 57 days of silence.

When a Single Text File Breaks a Trust Boundary (Bug Bounty writeup) During a recent security review, I encountered an interesting vulnerability in an open-source tool that, at first glance, appeared …

The target was an application portal. You register, you fill out a genuinely ENORMOUS form, and at the end it generates a PDF of everything…

I finally got my first bug bounty.

What’s up everyone! Nitin here 👋

AI-powered security scanners are becoming increasingly common. They can authenticate to applications, browse sensitive areas, inspect…

30-Second Version: One SSRF bypass technique — a single HTTP redirect — worked against Infogram (2017), Slack (2018), Bitwarden (2020), and…

User Records Without Authentication

Intigriti May 2026 XSS Challenge — full write-up

CrowdRecon is a new Intigriti product that makes high-quality reconnaissance, shared by our researcher community, visible, useful, and rewardable.

Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside y...

Ryan Bonner, also known as Roll4CombatUS, is a respected Bug Bounty hunter, consultant, speaker, and Intigriti Hacker Ambassador based in the United States.  

Ryan Bonner, also known as Roll4CombatUS, is a respected Bug Bounty hunter, consultant, speaker, and Intigriti Hacker Ambassador based in the United States.