XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally.

Learn what happened when curl co-founder Daniel Stenberg requested an AI-powered security audit by AISLE.

A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of routers. This post covers its discovery through agentic vulnerability…

Bug Bounty secures applications the agile way with a global community of ethical hackers through private and public programs. Create an effective vulnerability disclosure strategy for security researchers.

CVE-2026-108097: how a Drupal Field UI callback led to file disclosure and RCE in a paired lab. The contributed-module writer remains unverified.

This was my first real bug bounty finding, and somehow, it turned into a Critical vulnerability with a $1,500 bounty.

Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies. - pentestershell/php2shellbt

Preface AWS announced the general availability of the AWS MCP Server on May 6, 2026. It is a managed remote Model Context Protocol (MCP) server.
An MCP server exposes certain tools/functions and lets your AI agent call them. It extends your AI agent’s capabilities.…

Diving into the Steam platform for local and remote code execution vulnerabilities.

Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each built a browser into their AI assistant, then enriched it beyond what a normal browser allows. Those enrichments broke the browser threat model, letting a web page or a local file reach the machine…

This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥

How CVE-2026-16481 leaked OAuth tokens through Google MCP Toolbox SSRF, and how a $0 reward decision became a $9,760.44 bounty.