Triage teams are not adapting to one AI shift. They are constantly seeing new behaviour, tooling, patterns, and expectations. Head of Triage, Lennaert Oudshoorn, discusses the challenges, how the industry is adapting, and the solutions going forward.

As founder and CEO of Intigriti, I've spent a long time around hackers, and one thing is clear. The best ones don't fear AI. They use it. What they do fear, however, and what I take seriously as a founder, is a world where platforms quietly replace them under…

Alt title: Bullying LLMs into submission to find 0days at scale

noxen is an Android runtime interception tool for security research...

This is quite a different post as it is not related as usual to Windows vulnerabilities 😉. In the past period, I have been looking into the myAudi connected vehicle platform “Audi Connect and…

The April NIS2 compliance deadline has come and gone, but where does your company stand?  

We built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard fuzzing workflow while using a stronger stack underneath.

Copilot agent mode is vulnerable to a prompt injection attack. If a repository maintainer clicks 'code with agent mode' on an issue, it will open a new codespace and copilot will automatically run the issue's description.

XBOW discovered CVE-2026-45185, a critical unauthenticated RCE in Exim, and used the disclosure window to test how far human and autonomous exploit development could go.

Two releases shipped this cycle - v10.4.2 (April 15) and v10.4.3 (May 5) - delivering deep KEV coverage, a major push into AI/LLM attack surface, fresh Perforce visibility, and broad quality improvements across the template library.


🚀 April Stats





…

In this video, I break down a critical Android vulnerability ( CVE‑2026‑0073 ) affecting modern versions of Android (14, 15, 16), where a flaw in ADB’s authentication logic can allow an attacker on the same network to gain shell access without user interaction.…

Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with Mythos Preview, built a working exploit in five days.

Continuous mechanisms for radical transparency, the advantage of consistent reasoning, and what giving back to the community really looks like.

A few days ago, I was reading a post by Kabir Acharya on how the CTF scene has died as a result of frontier models killing authentic competition. I couldn't really fault his points, but I started thinking about what could actually fix this. We're not going…

Explore this post and more from the bugbounty community

This research was recently presented at BSides Luxembourg 2026. This blogpost documents our findings presented during the talk. The BSides slides are posted here. Today, we’re also releasing the Docker-based playground utilized for the demos so anyone interested…

I pointed an autonomous coding agent at a $35 projector. It found a big RAT.

Most AI security tooling shipped over the last year focuses on one of two workflows, code review at PR time or zero-day research in open-source software. Models in PR pipelines now flag insecure patterns at every commit and autonomous research runs have produced…