If you run a Bug Bounty program (or platform) now might be a good time for you to publish the average time to triage for various issue severities. There are a _lot_ of disgruntled hackers out there at the moment who are waiting weeks / months for a program to even perform a first look at a report!

Bug Bounty is remotely debugging last year's unreliable n-day using last week's reliable n-day... which I can't report because the vendor needs "time to patch." 🤦

Heading to OffensiveCON this week? Thank you for coming to my talk... claude.ai/share/227b48...

Well this is depressing.

If you would like to see a preview of @jameskettle.com's Blackhat talk "the HTTP terminator" then check out this interview my colleague @jameswilson.io recorded with him. Some pretty freaky stuff! VIDEO: www.youtube.com/watch?v=GdFG... AUDIO: risky.biz/RBNEWSSI126/

Sponsored: James Kettle built an AI hacker

YouTube video by Risky Business Media

youtube.com

2026 and Bug Bounty triage is broken. This has on the horizon for years, even without LLM pressure, but it still seems to have caught _every_ major platform and large private program by surprise.

I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at Black Hat USA! Check out the abstract: blackhat.com/us-26/briefi...

👏 @intigriti.com

The VSCode remote editor function has really gone to crap recently. Any form of linting is just spinning server CPU at 100% and OOM killing random processes. Going to have to go back to filesystem monitoring and rsync at this rate.

When reviewing pull requests with new additions for CSPBypass.com, I often find myself questioning how useful a given entry actually is. If no websites whitelist a specific host, there is little point in adding it.

Every bug hunter / vulnerability researcher / pentester should have to write their own blind or timing based SQL injection tool. It's like a rite of passage, if you've taken the time to understand and produce your own you'll probably make it in this world, if not 😬 x.com/slonser_/sta...

Last BSidesNYC I sat behind a guy doing the CTF with ChatGPT. Ctrl-a paste page source and a screenshot, hit enter, repeat. User totally not reading the output. LLM got the flag (flappybird-style JS challenge) after maybe ten rounds of this. Last message dude sent in the session was "We did it!".

This post on LLM use in CTFs sums up my feelings on the subject nicely. vt.social/@lina/116198... When simply directing LLMs for development / security research / CTFs it's quick, often accurate, often useful, but I don't inherently learn anything other than how to direct the LLM.

What I'm waiting for: Email updates to 5 separate Bug Bounty reports What I get: Email notifications of 3 year old reports being closed 😭

Same.

If you are selling a mirror and your ad creative includes images of the product with impossible reflections, I'm going to have to go ahead and assume your product doesn't work very well!

I'm sympathetic to corporate policy "patch gaps", but when it's framed as "acceptable exploitation window" it hits on a different level 🤔

Dad’s books are full of empathy, common sense, and a healthy suspicion of the powerful. But at its heart his work is also about how systems keep people poor while pretending it’s their own fault. So I hope Kemi’s taking notes as well as reading the jokes.

Paul Haine@paulhaine.bsky.social · 10mo ago

Kemi Badenoch claiming Terry Pratchett as her favourite author is wild

An in depth summary of the consequence of Google VRP increasing bounties in 2024. "We observe statistically significant increases in the reporting of high-value bugs, especially in the highest impact tiers and high merit submissions." 🔥 arxiv.org/abs/2509.16655

Incentives and Outcomes in Bug Bounties

Bug bounty programs have contributed significantly to security in technology firms in the last decade, but little is known about the role of reward incentives in producing useful outcomes. We analyze ...

arxiv.org

An in depth summary of the consequence of Google VRP increasing bounties in 2024. "We observe statistically significant increases in the reporting of high-value bugs, especially in the highest impact tiers and high merit submissions." 🔥 arxiv.org/abs/2509.16655

Incentives and Outcomes in Bug Bounties

Bug bounty programs have contributed significantly to security in technology firms in the last decade, but little is known about the role of reward incentives in producing useful outcomes. We analyze ...

arxiv.org

The new favourite fidget toy on my desk is the Zippo lighter I've had since I was a teenager. There is something about the noise of the cap flipping open and flint sparking. This has replaced the ever popular poker chips. Needless to say, I am not a great example for my kids 😬

Hackers tops the list of films that have influenced my life. Without seeing this film as a young teen I may not have misspent my youth in front of a computer trying to understand how it all worked. Which, despite what my parents suggested at the time, seems to have worked out well for me 😆

Ian Coldwater 🧊🚫@lookitup.baby · 11mo ago

Today is the 30th anniversary of Hackers

That feeling when you finally read that blog post you've had open in a browser tab for 3 months, and it's complete garbage 😑

It's been another year since my wife and I lost our first daughter Chloë. She would have been 7 today. With each passing year I can't help but think about what her life would have been like, what our life would have been like, had she been given a chance. I love her so much, but don't even know her.

This jaw dropping write-up of an LLM solving a DEF CON CTF challenge(!) with minimal human interaction 🤯 It seems like "vibe-reversing" is becoming a viable option now...

There is something quite depressing about many of the advertised agentic AI use cases being posting "viral" content to social media. It stinks of one person assuming their time is inherently worth more than everyone else.

I've said it before and I'll say it again, Windows 11 is _such_ a hostile user experience, it's like they've actively tried to make it unpleasant to use 😑

Can Bluesky say every word in the dictionary? I dunno but I plan to find out! I made a website that tracks every single word said on bluesky (as of yesterday).

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

HTTP/1.1 Must Die

Upstream HTTP/1.1 is inherently insecure, and routinely exposes millions of websites to hostile takeover. Join the mission to kill HTTP/1.1 now

http1mustdie.com

We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojec... It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!

Add V8SandboxFuzzer · googleprojectzero/fuzzilli@675eccd

This is a basic fuzzer for the V8 Sandbox. It uses the memory corruption API to implement a random-but-deterministic (given a seed) traversal through the V8 heap object graph and corrupts some obje...

github.com