Hello Hackers,

How I chained three public V8 bugs against Google's v8CTF, escaped the V8 sandbox, printed a real flag, and still received no bounty.

Multiple critical vulnerabilities at Plausible Analytics: pre-auth Storybook RCE, registration bypass with cross-tenant IDORs and stored XSS, and SSO verification SSRF to PostgreSQL RCE.

Introduction

Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the $6,700 bounty and two CVEs it produced: CVE-2026-76639 / CVE…

Writeups and notes from a bug bounty hunter.

See how Codex tackles blind vulnerability labs, plus lessons from HashKitten’s 10-hour WordPress zero-day research with GPT-5.6 Sol.

We found a second delayed RCE in MECCHA CHAMELEON: a malicious custom map could write files anywhere on your system and run code after a restart. Now patched in 4.0.0.

How a missing @PreAuthorize line in GeoNetwork led to unauthenticated Remote Code Execution across government geospatial infrastructure in 39 countries.

Sansec discovered StyleSmuggler, a Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. Attacks started September ...

A Real Estate Web App Bug Bounty Story

The Door Was Already Open

A pre-deployment scan of an open source URL shortener surfaced cross-tenant link takeover, SSRF, and custom-domain takeover chains that AI code review did not flag.

How a sacrificial block turned a decrypt-only padding oracle into a forgery, and the forgery into unauthenticated RCE.

Three attempts at code execution paid nothing. One template expression that just read a variable paid $1,000.

A client-side path traversal in the front-end's URL builder turned into arbitrary PUT/DELETE on the API, then chained with an inherited-property lookup bug to bypass 2FA

Researcher @sagitz_ disclosed a remote code execution vulnerability in GitHub, earning a $100,000 bounty—the largest payout in the platform's bug bounty program.

This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.