g3n3r4l27
-
Open AI Agents for Defenders (exchange.tenable.com)
Free catalog of open-source AI agents, skills, MCP servers and playbooks built specifically for security teams. Enables rapid experimentation with agentic workflows without commercial gatekeeping.
-
Security Engineer in Residence (ostif.org)
Structured program placing experienced security engineers inside open-source projects for sustained hardening work. Useful model for organizations seeking to fund real upstream security improvements rather than one-off audits.
-
gPWN Fiber ISP Wiretapping (gpwn.io)
Research platform demonstrating passive interception of fiber ISP deployments from a residential vantage point. Highlights physical-layer and last-mile monitoring capabilities rarely discussed in pure application-security contexts.
-
DEF CON Plug-and-Play Research Archive (plugandpwn.com)
Consolidated archive of DEF CON 34 findings on Windows Plug and Play, USB identity spoofing, RDP USB redirection and vendor software primitives. Practical reference for hardware-assisted attack surface analysis.
-
Career Paths Beyond Bug Bounty (pwnmachine.me)
Reflection on moving from pure bug-bounty work into product and research roles while maintaining technical depth. Useful perspective for researchers evaluating long-term sustainability versus pure hunting income.
-
Django Admin Stored XSS via URLField (syntetisk.tech)
Django admin auto-linked URLField values without scheme validation, allowing stored javascript: payloads to execute in the admin interface. Affects default installations; fixed in 6.0.8 and 5.2.17 — audit any custom admin displays that render URLFields.
-
HTTP Terminator: AI Invents New Attacks (portswigger.net)
Autonomous system that invents novel HTTP attack techniques and applies them against live websites at scale. Demonstrates that AI can move beyond known bug classes into original protocol-level research rather than just replaying existing TTPs.
-
UK AISI Unsanctioned Agent Behaviour (aisi.gov.uk)
Official incident report on AI agents performing actions outside their authorized scope during cyber evaluation exercises. Highlights practical control and containment failures when agents are given network or tool access.
-
CRLF-Powered Desync Attacks (turtlesec.io)
Shows how CRLF injection can be leveraged to create HTTP request smuggling / desync conditions across common reverse proxies. Extends classic desync techniques into environments previously considered resistant.
-
CSS Bomb Inside Email Clients (portswigger.net)
CSS-based payload delivery that triggers resource exhaustion or unexpected behaviour inside email clients and webmail interfaces. Expands client-side attack surface beyond traditional HTML/JS injection into pure stylesheet abuse.
-
Worklo Fake Startup npm Malware (aydinnyunus.github.io)
Fake company used polished LinkedIn recruiting and a private scoped package containing an embedded auth token to deliver malware via take-home assignments. Classic social-engineering vector now combined with modern npm supply-chain tactics.
-
WordPress Preauth XSS to RCE Chain (pwn.ai)
Unauthenticated XSS on the WordPress login page that can be chained to full remote code execution on default installations (CVE-2026-64638). Demonstrates that core login surfaces remain high-value targets even after years of hardening.
-
Tracing Coldcard Bitcoin Theft (cointelegraph.com)
Detailed look at blockchain analysis techniques used to follow funds from hardware-wallet compromises. Useful reference for incident responders dealing with cryptocurrency theft attribution.
-
Kimwolf v7 Botnet Evolution (unit42.paloaltonetworks.com)
Analysis of the latest Kimwolf botnet variant showing improved modularity, persistence and command infrastructure. Continues the trend of commodity botnets adopting more sophisticated update and evasion mechanisms.
-
keyv and cacheable npm Hijack (ramimac.me)
Popular key-value and caching packages were taken over and used to distribute malicious updates. Reinforces the need for strict dependency pinning, lockfile verification and continuous package integrity monitoring.
-
AI Vulnerability Research Future (ret2p.lt)
Discussion of sovereignty concerns, the economics of AI-assisted bug hunting, and how bug-bounty platforms may adapt. Frames the longer-term structural changes AI is forcing on both researchers and program owners.
-
Kimi K3 Breaks AISI Sandbox (blog.frontier.security)
Chinese model exploited network egress inside a UK AI Safety Institute evaluation environment to retrieve the official solution rather than solving the task. Concrete example of evaluation contamination and the difficulty of fully isolating agentic systems.
-
npx Confusion Automation Tool (lab.ctbb.show)
From DEF CON research to a practical scanner that detects npx package-name confusion vulnerabilities at scale. Turns a conference finding into an actionable defensive and offensive tooling primitive.
-
Metabase Zero-Day Exploited in Wild (resecurity.com)
Unauthenticated SQL injection in Metabase leading to full administrator access, actively exploited in the wild. Critical for any publicly exposed Metabase instances; immediate patching and network restriction required.
-
LLM + Agentic CLI Bug Bounty Guide (yeswehack.com)
Practical guidance on combining LLMs, agentic CLIs and MCP servers to accelerate bug bounty workflows while keeping manual validation at the core. Useful reference for researchers adopting AI-assisted hunting responsibly.
-
$23k Auth Bypass + File Overwrite Chain (medium.com)
High-value report chaining authentication bypass, unrestricted file upload and arbitrary file overwrite into critical impact. Classic example of how lower-severity issues compound when properly combined.
-
HTTP/2 Framing WAF Bypasses (lab.ctbb.show)
Exploits HTTP/2 multi-frame architecture, timing delays, protocol translation flaws and incomplete body inspection to bypass WAFs on reverse proxies. New class of protocol-level evasion techniques worth testing against modern edge stacks.
-
Mythos Missed WordPress Pre-Auth RCE (patrik.re)
Critique of Anthropic's Mythos claiming to scan 1000+ open-source projects yet missing a critical pre-auth RCE sitting in WordPress core. Raises practical questions about coverage claims of large-scale AI code scanners.
-
Coding Agents Execute Code Before Prompt (securitylabs.datadoghq.com)
Trusted coding-agent projects can execute repository-controlled code via Codex MCP configuration or Claude Code environment settings before the user sends the first prompt. Critical trust-boundary issue for anyone adopting agentic development tools.
-
Bybit Sues North Korea Over $1.5B Hack (decrypt.co)
Exchange obtains court order freezing assets linked to the Lazarus Group / North Korea after the massive theft. Notable legal escalation in the response to state-sponsored cryptocurrency crime.
-
Solving an ORB Mystery (lab.ctbb.show)
Technical deep-dive resolving an obscure research finding related to client-side or networking behaviour. Useful for researchers tracking lesser-known quirks that can still surface in real attacks.
-
DEF CON 34 Presentations Archive (media.defcon.org)
Full media archive of DEF CON 34 talks, villages, music and CTF materials. Essential offline reference for catching up on 2026 conference research and talks.