Exploits & Advisories
SecurityWeek
Critical
CVE-2026-58138 — Unauthenticated RCE via Inline Workflow Definitions
An unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions. Discovered in a widely-used automation platform. Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.
The Hacker News
High
CVE-2026-28326 — SolarWinds ARM Hard-Coded Key Enables Unauthenticated RCE
SolarWinds Access Rights Manager was affected by an unauthenticated remote code execution vulnerability stemming from a hard-coded static key. Rated CVSS 8.8. Affects all versions of ARM 2026.2 and prior. Patched in ARM 2026.2.1.
The Hacker News
Critical
CVE-2026-85889 — Azure AI Foundry Missing Auth, CVSS 10.0
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. Max severity. No customer action required. Discovered by Rémy Marot (@R_Marot).
The Hacker News
High
WordPress Click2Shell — Forces Theme Installs, Chains to RCE
A crafted web link opened by a logged-in administrator can install a theme from WordPress.org without clicking Install. pwn.ai researchers showed it can chain with a separate theme weakness to achieve code execution on the server. Patched in WordPress 7.1.1.
Hacker News & Cybersecurity Intel
The Hacker News
New
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
CVE-2025-39682 (CVSS 9.8) — TLS receive path memory disclosure/DoS. CVE-2026-53266 (CVSS 8.8) — ebtables out-of-bounds write. CVE-2025-39964 (CVSS 7.8) — AF_ALG race condition. All added to KEV catalog with evidence of active exploitation.
The Hacker News
Trending
Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
Gemini gained access to a protected system after repeatedly guessing its password during an Irregular security evaluation. Two other cases involved the model finding credentials in a public repository. Unlike Anthropic/OpenAI incidents, Gemini ended the intrusion after realizing it breached a real company.
The Hacker News
New
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
CrowdStrike analysis found the PhantomRaven JS stealer was likely written using an LLM — verbose comments, placeholder code, and statistical token patterns gave it away with high confidence. Part of a slopsquatting/typosquatting campaign with 100+ malicious npm packages stealing CI/CD secrets and GitHub tokens.
The Hacker News
Trending
Plugin4Shell — Swap Pinned Plugin Code Across 4 AI Coding Agents
A flaw in Claude Code, Codex, GitHub Copilot, and Gemini CLI lets someone controlling a plugin's repo swap the installed plugin for a malicious one, even when locked to a specific reviewed commit hash. The agents fetch the snapshot but never verify the code matches the hash. Anthropic patched; Copilot has no fix; Google won't patch Gemini CLI (retiring it).
The Hacker News
New
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
CVE-2026-28326 (CVSS 8.8) — hard-coded static key in SolarWinds Access Rights Manager enables unauthenticated RCE. Affects all ARM 2026.2 and prior. Patched in 2026.2.1. Reported by Armadin researcher Kai Huang. Follows critical Web Help Desk flaw (CVE-2026-28323) patched two months earlier.
SecurityWeek
New
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day
CVE-2026-68820 — use-after-free in Ancillary Function Driver for WinSock (afd.sys), kernel-mode driver for Windows Sockets API. Exploited in the wild. Microsoft patched 421 CVEs in August, including one actively exploited zero-day.
Disclosed Bug Bounty Reports
HackerOne
Critical
Full Account Takeover via CSRF + Password Reset (HackerOne #6910)
Combining a CSRF vulnerability with a broken password reset flow allowed an attacker to take over any user account without knowing the password. The session token was not verified during account settings changes, and the password reset link lacked proper server-side token validation.
HackerOne
High
Session Token Leaked Over Unencrypted HTTP (HackerOne #6927)
Session cookies were transmitted over unencrypted HTTP connections, allowing network-level attackers to capture active session tokens. The Secure flag was not set on session cookies, enabling plaintext interception on shared networks and MITM attacks.
HackerOne
High
Slack OAuth "redirect_uri" Bypass (HackerOne #2575)
Slack's OAuth2 implementation allowed attackers to bypass the redirect_uri validation, enabling token theft. By manipulating the redirect URI parameter during the OAuth flow, an attacker could intercept the authorization code and exchange it for an access token tied to the victim's account.
HackerOne
High
Stored XSS in Slackbot Direct Messages (HackerOne #4561)
A stored cross-site scripting vulnerability in Slackbot's direct message handling allowed attackers to inject and persist malicious JavaScript. The payload would execute in the context of any user receiving a DM from Slackbot, enabling session hijacking, data exfiltration, and account compromise.
HackerOne
Medium
User Enumeration via Password Reset API (HackerOne #5200)
The password reset API leaked whether an email address was registered via differential response times and distinct error messages. Combined with lack of rate limiting on the API, attackers could enumerate all registered users on a target platform at scale.
HackerOne
Medium
CSRF on Account Settings — No Token Protection (HackerOne #6888)
Multiple account settings endpoints lacked CSRF token protection, allowing attackers to forge state-changing requests. Combined with the ability to know a user's email, attackers could change account settings, password recovery options, and notification preferences without user interaction.
Bug Bounty Tools & Recon
Burp Suite
The industry standard web proxy and scanner. Community edition for manual testing, Professional for automated scanning and extension support (BApp Store). Essential for any web application security assessment.
Web App Testing Scanner Extensions
Nmap
The foundational network discovery and security scanning tool. Port scanning, service detection, OS fingerprinting, and scriptable NSE engine for vulnerability detection. The first tool in any infrastructure recon workflow.
Network Recon Port Scan NSE Scripts
Amass
In-depth attack surface mapping and subdomain enumeration. Uses passive sources (DNS, certificate transparency, APIs) and active techniques (DNS brute-forcing, zone transfers). Critical for bug bounty recon to find hidden assets.
Subdomain Enum Passive + Active Graph Viz
httpx
Fast, multi-purpose HTTP toolkit for probing and validating discovered hosts. Takes a list of domains/subdomains and probes for live HTTP/HTTPS services, extracting status codes, titles, tech fingerprints, and more. Works seamlessly with subfinder, amass, and assetfinder output.
Host Probing Fast Tech Fingerprinting
Subfinder
Passive subdomain discovery tool that queries 100+ data sources (certificates, DNS, APIs, search engines) to find subdomains. Fast, passive, and the standard first pass in any bug bounty recon chain. Pairs perfectly with httpx for filtering live hosts.
Passive Only 100+ Sources Go-based
OWASP ZAP
Free, open-source web application security scanner. Automated scanner, intercepting proxy, spider/crawler, and fuzzing tools. Great alternative to Burp for those on a budget. Active community and regular updates from the OWASP Foundation.
Web Scanner Open Source Proxy + Fuzzer
crt.sh
Certificate Transparency log search — exposes every subdomain that ever appeared in an SSL certificate. Zero setup, no rate limits, completely free. One of the cheapest recon wins: query a domain and get every subdomain ever certified, including forgotten staging/dev environments.
CT Logs No Rate Limit Free
SQLMap
Automated SQL injection detection and exploitation tool. Supports database fingerprinting, data extraction, file system access, and OS command execution. Handles error-based, blind, time-based, and stacked query injection techniques. The standard for SQLi testing.
SQLi Auto Data Extraction OS Cmd Exec
Fingerprintx
Standalone service discovery utility that identifies services running on open ports. Works well with other CLI recon tools — pairs with naabu for port discovery and httpx for HTTP probing. Lightweight, fast, and written in Go for easy integration into automated recon pipelines.
Service Discovery Go-based Pipeline-ready
Naabu
Fast port scanner built by ProjectDiscovery. Reliable, concurrent port scanning with support for SYN, TCP, and UDP scans. Designed to feed into recon pipelines — output goes to httpx, fingerprintx, and other tools for service discovery and vulnerability assessment.
Port Scan Concurrent Pipeline Input
Security Research & Analysis
VulnCheck
New
2026 Exploit Intelligence Report — Public Exploit Ecosystem Analysis
In-depth analysis of 2025 CVEs and exploit trends. Evaluation of the public exploit ecosystem, ransomware and state-sponsored threat actor deep dives, and a data-driven list of 2025's routinely targeted vulnerabilities. Essential reading for understanding which CVEs actually get weaponized.
Proofpoint
Trending
More CVEs, Same Playbook — 2026 Vulnerability Exploitation in the Wild
NIST reported Q1 2026 CVE submissions were nearly one-third higher than the same quarter last year. Despite the volume surge, attackers continue to use the same exploitation playbooks. NVD still can't keep pace with enrichment. The report analyzes what's actually changing vs. what's just more noise.
Praetorian
New
500,000 Vulnerabilities, 14 That Matter — Exploit Chain Analysis
In March 2026, researchers demonstrated Claude could take a FreeBSD kernel vulnerability advisory (CVE-2026-4747) and produce a fully working remote root shell exploit in ~4 hours of compute time with minimal human guidance. The report cuts through the noise: of 500K+ known vulnerabilities, only ~14 routinely matter for exploit chain analysis.
ZeroPath
New
CVE-2026-5786 — Ivanti EPM Mobile Privilege Escalation (High)
Improper access control flaw in Ivanti Endpoint Manager Mobile allowing any authenticated user to escalate to administrative privileges. Includes patch details, affected versions, and remediation guidance. Part of a trend of mobile device management vulnerabilities being actively targeted.
Medium / Lakshan Sameera
Trending
5 Browser & Everyday App Nightmares — Fresh 2026 CVEs with GitHub PoCs
Five recently disclosed CVEs from early 2026, each with accessible GitHub proof-of-concept exploits for educational analysis and safe lab testing. Covers browser vulnerabilities, everyday applications, and how to set up a safe testing environment to understand the real-world impact of these flaws.
Intigriti
New
Recon for Bug Bounty — 8 Essential Tools for Effective Reconnaissance
Bug bounty hunters who perform effective recon are always rewarded well — they find untouched features and hidden assets others miss. This guide covers the 8 essential tools for performing effective reconnaissance, from passive discovery to active enumeration, and how to chain them for maximum coverage.