Unauthenticated RCE chain in Plex: $500 bounty Writeup: zmain.info/blog/plex2shell PoC: github.com/code-zm/plex2shel… Patch your servers!

Just found Dom XSS at *.microsoft.com Do they pay bounty for dom XSS ?

romanzipp.com/blog/shopify-h… 🚨 Bug bounty hunters: Shopify needs more security researchers looking at checkout flows. Recent reports of checkout hijacking across Shopify apps show why we need to pay closer attention to the entire checkout chain — app integrations, injected JavaScript, custom scripts, API responses, and payment redirects. 🔎 Look for: • Checkout manipulation & unauthorized redirects • XSS in app widgets and storefront extensions • Broken access control in Shopify apps • Insecure custom JavaScript configurations • Payment-flow logic flaws • Account takeover paths affecting merchants • Sensitive data exposure Focus on authorized bug bounty scopes, reproduce findings safely, and never access real customers’ payment data. Shopify security deserves more eyes. Find the flaws before attackers do. 🔥 #BugBounty #Shopify #AppSec #WebSecurity #CyberSecurity

this one been buffering for awhile

This was quite a ride :) I'm incredibly proud of XBOW's Native Team for their work on this, and looking forward to sharing details on the chain once we're able to!

I let ma agent to run for 48h using deepseek model to look for only 3 vulnerabilities type and currently sitting on 4 rce and 2 admin panel exposed total spend was 200$

Just $5k #bugbounty for a vulnerability that exposed 17 Trillion Microsoft records :( 🤯 blog.faav.net/how-i-couldve-… Great find by @efaav, a talented 15 y.o. researcher!

This is the extension I used. What it has: Tracing Dom sink through stack trace. Dom heuristics and dictionary, static page scan, JavaScript scan, postmessage test. I named it "Elecktrode trusted type crash 2.0.0" it used chrome manifest V3 (MV3) I will release it today.

Claude is leaking your data to the US government and CIA. Here is the proof. I looked inside the Claude Code binary bundled with Claude Desktop on my Mac. Found these 5 .gov strings: c2s.ic. gov api. aws.ic. gov sc2s.sgov. gov csp.hci.ic .gov api .aws.hci.ic .gov C2S is tied to AWS cloud for the US intelligence community. In the official Amazon announcement, the CIA CIO discusses its use at the TOP SECRET level. You can check your own installation. Mine is Claude Desktop 2.26454.2, bundled Claude Code 2.1.293. These strings appear in the AWS region definitions, under dnsSuffix and dualStackDnsSuffix. WHAT THE FUCK ???!!!! Run the check that's in the replies on macOS. See what YOUR copy contains.

43 hackers detected All using AI 🤖 Many of them are APT hackers. Full threat intelligence in our app.

Researchers can now earn up to $60,000 USD for qualifying critical vulnerabilities through the updated Microsoft Dynamics 365 and Power Platform Bug Bounty Program. Key updates include: ➤ Up to $60,000 USD in awards for qualifying critical vulnerabilities ➤ New cross-tenant award multipliers for select scenarios ➤ More granular severity and impact-based award categories We continue to evolve our bounty programs to reward impactful research and provide greater transparency into how submissions are evaluated. Learn more: msft.it/6013ab10b

Another 0-Click ATO in Meta's AI Systems! I recently discovered a critical vulnerability in @Muse leading to a 0-Click Full Account Takeover (ATO) on @facebook, @instagram & @Meta. This places me in the Top 5 on Meta's Bug Bounty Leaderboard. Thanks to the @metabugbounty Team.

Done. I canceled Claude Max 20x. $200/month for tiny, unpredictable limits is absurd. I’m done rationing usage instead of shipping. I’m moving to Codex - and my entire dev team is moving with me. Anthropic lost a paying user and an entire team. 💀 @AnthropicAI @DarioAmodei

To find subdomains you can use this new technique: crt.name/v1/search?apex=targ…

RT @XHackerx007: I had Claude Console CVP approved(api) , but my Claude.ai CVP has been pending for 3 weeks now. This basical…

Jangan pernah remehin "useless" bug. Self-XSS yang biasanya diketawain (karena butuh interaksi user) aja bisa berubah jadi bounty $15.000 (Zoom). Kuncinya adalah, chaining. Gue nemu case di mana attacker gabungin Self-XSS sama OAuth. Gini skenarionya: 1. Korban klik link malicious (XSS jalan di domain A). 2. XSS ini kirim postMessage ke domain B (trusted domain). 3. Domain B nerima message, terus trigger OAuth login ke Zoom. 4. Pas korban login, Authorization Code-nya malah dibajak sama XSS di domain B. 5. Attacker dapet Access Token. Hasilnya? Attacker ambil alih total, curi data, sampe bisa nyalain kamera & mic korban. Satu bug remeh kalo digabung sama celah lain bisa jadi exploit yang mematikan.

I haven't posted a crazy XSS vector for a while... Works on every browser

I got permanently banned from @Hacker0x01. Account deleted. No explanation. Years of work gone overnight. Submission history, achievements, leaderboard ranks, every contribution I made to the security and crypto ecosystems through HackerOne. Wiped, like I was never there.

I just cancelled 2 $200 Claude Max subscriptions. In their place: one $199 MoonshotAI Vivace plan, purchased this morning for Kimi K3. Kimi K3 is better than Fable 5 at frontend design. That is half of why I kept 4 Max accounts, gone overnight. The other half is trust, and Anthropic burned it. Nobody knows if Fable 5 survives Sunday. Nobody knows what the limits are week to week. Nobody knows anything, because they refuse to communicate. Moonshot earned $199 with one great model. Anthropic lost $400 with a month of chaos.