# Intigriti Bug Bytes #239 - August 2026 ๐Ÿš€ > Source: > Published: 2026-08-28 00:00:00+00:00 # Intigriti Bug Bytes #239 - August 2026 ๐Ÿš€ By Ayoub August 28, 2026 ## Hi hackers, Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: - Intigriti as the new provider for Adobe's Bug Bounty Program - CSS injection as an attack vector inside your email inbox - AI doing novel security research: the HTTP Terminator - 169 offensive recon skills in one AI-ready toolkit And so much more! Let's dive in! ## CrowdRecon is coming Most security teams only see what makes it into the final report. But the real signal often starts earlier. It starts in the paths explored, the assets questioned, and the context built before a finding is found. That is where recon becomes more than research. It becomes intelligence. The Intigriti team has been building something around this idea for months. At DEF CON 34, our Senior Product Manager, [Radu](https://www.linkedin.com/in/radustefanvoloaga/), gave the first public look at [CrowdRecon](https://www.intigriti.com/blog/news/introducing-crowdrecon) during his talk "Turning Recon Coverage into Bug Bounty Signal" at the Bug Bounty Village. The core idea: all that recon work hackers do before finding a vulnerability should not just disappear when it does not turn into a report. CrowdRecon makes sure it counts. Hackers get recognized for the exploration, not just the finding. Security teams get a live view of their attack surface through the community's eyes. More details are coming soon. Keep an eye on our socials. Reconnaissance unleashed: meet CrowdRecon ## Intigriti named new provider for Adobe's Bug Bounty Program Intigriti has been named the new provider for Adobe's Bug Bounty Program, effective September 1, 2026. As our Founder and CEO, [Stijn Jans](https://www.linkedin.com/in/stijnjans/) shared: "At Intigriti, we believe the strongest security comes from working alongside the hacking community. Our focus is on giving Adobe researchers an outstanding experience and supporting that community's continued growth. We are honored that they have chosen us as the new home for their Bug Bounty Program, and we see this as the start of a long and rewarding partnership." If you are a researcher, [create your Intigriti account](https://login.intigriti.com/account/register) ahead of September 1 to be ready when the program goes live. Intigriti named new provider for Adobe's Bug Bounty Program ## Beyond CVSS: rethinking scoring systems amidst AI Safety and Security CVSS is a solid framework for traditional vulnerabilities, but when an AI model produces biased outputs or hateful language, there is no confidentiality breach, no integrity failure, no availability loss. And yet the regulatory and reputational damage can be significant. In our latest blog, we explore [why AI security and AI safety need fundamentally different scoring models.](https://www.intigriti.com/blog/business-insights/rethinking-cvss-scoring-systems-amidst-ai-safety-and-security) AI security findings, such as prompt injection leading to data leakage, map cleanly to CVSS. AI safety findings, harmful outputs, unsafe tool use, misleading responses, need an outcome-based, customer-specific severity model instead. The post covers three specific challenges every security team should be thinking about right now. Beyond CVSS: rethinking scoring systems amidst AI Safety and Security ## When fear no longer holds you back: interview with Ryan Bonner (Roll4CombatUS) [We interviewed Intigriti Ambassador Ryan Bonner](https://www.intigriti.com/blog/business-insights/interview-with-ryan-bonner-roll4combatus), known in the community as Roll4CombatUS, to talk about his journey from early career struggles to becoming one of the more dedicated hunters in the space. The conversation covers why he focuses on wide-scope programs, what he would tell bug bounty programs to improve researcher engagement, and the daily habit that changed how he works. When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS) ## Quick! Intigriti 0826 Bad Reception CTF is still live Intigriti's 0826 Challenge is still ongoing. If you haven't captured the flag yet, now is the time. Head over, find the flag before Monday, the 31st of August. [Take on the challenge!](https://go.intigriti.com/xss-challenge) Intigriti Challenge 0826 Bad Reception ## Intigriti 0726 Canonically Yours Challenge results are in Intigriti's 0726 Challenge, Canonically Yours, is now closed, and it bought the attention of a lot of researchers. The challenge was slightly easier than usual, which accounted for the high number of solves, and it was clear that a number of participants leaned on AI tools to help work through it! Quick recap: - First blood was captured by [Jayce](https://x.com/JxyceDang) - 138 hackers found the correct solution - 34 hackers wrote a cool write-up If you want to put your hacking skills to the test, be sure to give the Canonically Yours 0726 Challenge a go before heading over toย [Bugology](https://bugology.intigriti.io/intigriti-monthly-challenges), where you can find all the researchers' submitted solutions. Intigriti Challenge 0726 Canonically Yours ## Blogs & videos ### [Web fuzzing for hackers](https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers) Web fuzzing for hackers Cover Image **Web fuzzing is often treated as bruteforcing with a wordlist.** When you move past that framing, it starts producing much more interesting results. In our latest article, put together with [@GodFatherOrwa](https://x.com/GodFatherOrwa), we go deeper into using [fuzzing for reconnaissance and vulnerability exploitation](https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers): discovering hidden assets, surfacing unusual application logic, and turning that behavior into findings. If you have been treating fuzzing as a last resort, this one is worth reading. - **Disagree with how your report was handled?** Our latest guide on[how to appeal a bug bounty submission](https://intigriti.com/researchers/blog/hacking-tools/how-to-appeal-a-bug-bounty-submission) walks through Intigriti's mediation process, the most common scenarios, and what to avoid during the process to reach a resolution faster. - **Going from zero to your first valid bug report?** In case you missed it, we recently launched the[Bug Bounty Starter Kit](https://www.intigriti.com/bug-bounty-starter-kit) , a free guide covering everything from recon and tooling to the exploitation of SQLi, XSS, and BAC vulnerabilities, to finally how to learn to write a compelling vulnerability report that gets triaged faster.[Get your copy now.](https://www.intigriti.com/bug-bounty-starter-kit) ## Tools & resources ### Tools #### [UnKover](https://github.com/BruteLogic/unKover) unKover **Getting blocked by a 403 does not always mean access controls are correctly enforced.** [UnKover](https://github.com/BruteLogic/unKover) by [@BRuteLogic](https://x.com/BRuteLogic) is a simple new Bash script that tests a target returning a 403 status code against a set of proven bypass techniques, including IP header spoofing, method tampering, path normalization, URL encoding, HTTP/1.0 downgrade, and more. - **Tired of SAST tools flooding you with unverifiable findings?**[Strix](https://github.com/usestrix/strix) by[@strix_ai](https://x.com/strix_ai) takes a different approach: instead of pattern matching, it deploys AI agents that run your code in a sandbox, discover the attack surface, and validate each finding with a working proof of concept before surfacing it. - **Recon eating up half your session time?**[Recon-skills](https://github.com/uphiago/recon-skills) by[@uphiago](https://x.com/uphiago) packages 169 offensive security skills into an AI-ready toolkit covering subdomain enumeration, vhost discovery, JS analysis, and GitHub secret hunting. All of them were tested across 600+ real targets in 45+ sectors. ### Resources #### [CSS: the bomb inside your inbox](https://portswigger.net/research/css-the-bomb-inside-your-inbox) CSS: the bomb inside your inbox [@garethheyes](https://x.com/garethheyes) at PortSwigger published research showing how [CSS injection](https://portswigger.net/research/css-the-bomb-inside-your-inbox) within an email client can be turned into an account takeover, including credential theft, without JavaScript. - **Getting an arbitrary file write closed as medium?**[@0xacb](https://x.com/0xacb) and the Ethiack team published[Write Once, Shell Everywhere](https://ethiack.com/info-hub/research/write-once-shell-everywhere-arbitrary-file-writes-into-rce) , a detailed look at how to escalate arbitrary file writes to remote code execution across a range of server configurations. - **Can AI do novel security research?**[@albinowax](https://x.com/albinowax) at PortSwigger published a whitepaper on[the HTTP Terminator](https://portswigger.net/research/can-ai-do-novel-security-research) , a research effort testing whether AI agents can discover new classes of HTTP vulnerabilities independently. The results are worth reading alongside the methodology. - **0-click stored XSS on Next.js via type confusion.**[@zhero___](https://x.com/zhero___) and[@inzo____](https://x.com/inzo____) published[Re:CACHE](https://zhero-web-sec.github.io/research-and-things/re-cache-excessive-reflection-type-confusion-and-0-click-sxss-on-nextjs) , covering a real-world exploitation case where a specific mistake in Next.js's caching behavior leads to a systematic zero-click SXSS on its latest versions. - **A 22-year-old bug in EasyTimeline allowed arbitrary code execution from wikitext.**[@v12sec](https://x.com/v12sec) published a thread with their finding around a[code injection vulnerability](https://x.com/v12sec/status/2085048205847523622) introduced in 2004 that was still present in 2026. - **Universal XSS in Google Translate, $8,500 bounty.**[@R3dpars3c](https://x.com/R3dpars3c) found a[UXSS](https://r3dpars3c.github.io/writeups/Google_Chrome_UXSS_Via_Google_Translate.html) that allowed JavaScript execution on any domain with reflected input via Google Translate. - **What's in a tag name? JavaScript, apparently.**[@garethheyes](https://x.com/garethheyes) also published[a shorter research post](https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently) on a less-obvious XSS technique. - **A silent signature extraction in Rabby wallet led to a full wallet drain.** In another thread, the[@v12sec](https://x.com/v12sec) team shares how they managed to[drain a wallet](https://x.com/v12sec/status/2090114226320977931) while the victim was playing a video game. - **CRLF-Powered Desync Attacks: beheading HTTP streams.**[@t0xodile](https://x.com/t0xodile) published new research at PortSwigger on how CRLF injection can be used to trigger[HTTP request desynchronization attacks](https://portswigger.net/research/crlf-powered-desync-attacks) . - [**CVE-2026-18501: stored XSS in UsersWP**](https://cryptocat.me/blog/research/analysis/cve_2026_18501/) **via variable substitution.**[@_CryptoCat](https://x.com/_CryptoCat) published a detailed analysis of how`sanitize_text_field()` preserved an entity-encoded payload that was later decoded and output without escaping. - [**IDOR via comma-injection**](https://medium.com/@s0ufm3l/idor-via-comma-injection-how-concatenating-two-ids-leaked-cross-tenant-pii-d5f003e594f9) **led to cross-tenant PII exposure.**[@s0ufm3l](https://x.com/s0ufm3l) published a write-up on how concatenating two IDs with a comma was enough to access another tenant's data. - **A simple** [**RBAC misconfiguration**](https://medium.com/@Seek404/how-a-simple-rbac-mistake-led-to-a-20k-admin-takeover-d196694791dd) **led to a $20K+ admin takeover.** The write-up is a clear example of how a single logic gap in role enforcement can have a disproportionate impact. - **Bullying LLMs into submission to find 0days at scale.**[@ZephrSec](https://x.com/ZephrSec) published a practical post on using several prompting techniques as part of a workflow for finding real[vulnerabilities at scale with LLMs](https://blog.zsec.uk/bullyingllms/) . - **How to start (or come back to) bug bounties in 2026.**[@hakluke](https://x.com/hakluke) published[a comprehensive guide](https://hakluke.com/how-to-start-or-come-back-to-bug-bounties-in-2026) covering the current landscape, where to focus, and how to build momentum whether you are just starting out or returning after a break. - **An authentication bypass in LinkedIn's session handling.**[@torious100](https://x.com/torious100) published a write-up on how a sneaky session update mechanism could be abused to achieve[account takeover](https://adebayosec.medium.com/auth-bypass-a-story-of-linkedins-sneaky-session-update-bypass-2c9ee712b48c) . - [**Google's agentic source code review**](https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review) **found 100+ critical vulnerabilities in two days.** The approach is worth more attention than the number itself: the post separates generation agents from validation agents, avoiding the problem of a single agent defending its own findings. - **$250,000 bounty for CVE-2026-9876, a** [**critical WebGL use-after-free in Chrome**](https://issues.chromium.org/issues/493747593)**.** The Chromium issue links it to a bypass of a previously exploited Qualcomm Adreno CVE. - **Accelerating EDR evasion with LLM-driven analysis.**[@xpn](https://x.com/_xpn_) published a post on using[LLMs to analyze local EDR rulesets](https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/) , YARA rules, and behavioral detections to make evasion significantly faster. Worth reading for the harness setup as much as the findings. - **Borrowing Windows Hello keys for authentication and persistence.**[@_dirkjan](https://x.com/_dirkjan) published a post covering how[Windows Hello keys can be extracted](https://dirkjanm.io/borrowing-windows-hello-keys/) and reused for authentication and long-term persistence. - **Bypassing rate limits via forwarding headers.**[@Reeshasx](https://x.com/Reeshasx) shared a practical tip on using headers such as`X-Forwarded-For` ,`X-Real-IP` , and`Forwarded` to[bypass rate limiting](https://x.com/Reeshasx/status/2090198916763431256) . The same technique can also lead to IP allowlist bypasses (401/403 bypasses) and SSRF. - **Beyond Prompt Injection: hacking Apple's Private Cloud Compute.** Researcher Drinor (Sentry) found that darwin-init, the first userspace process in Apple's Private Cloud Compute, uses an archive extractor that never validates file paths. A crafted tar file was enough to[write files as root](https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/) to a persistent location and redirect AI telemetry. Apple awarded $150,000 for CVE-2026-20685. - **200 billion tokens later: a month of letting AI agents decompile MW2.**[@momo5502](https://x.com/momo5502) published[a post](https://momo5502.com/posts/2026-08-17-mw2-decompilation/) focused mainly on the multi-agent setup behind the decompilation effort. - **From a simple random ID to a mass PII leak (โ‚ฌ1,875).**[@luq0xss](https://x.com/luq0xss) shared a brief write-up on how a predictable identifier[exposed personal data](https://x.com/luq0xss/status/2085014583777902860) at scale. - **Hacking SAML with Claude Code.** A write-up from Oblique Security on using Claude Code as part of a[SAML vulnerability](https://oblique.security/blog/hacking-saml/) hunting. - **DEF CON war stories: chat XSS to spyware, token shuffles, and camera hijacks.** The Critical Thinking Bug Bounty Podcast[@ctbbpodcast](https://x.com/ctbbpodcast) published[HackerNotes for episode 188](https://blog.criticalthinkingpodcast.io/p/hackernotes-ep-188-def-con-war-stories-chat-xss-to-spyware-token-shuffles-and-camera-hijacks) covering three stories from DEF CON week: a stored XSS chained through Electron IPC for persistence, embedded AWS credentials leading to a fleet-wide secrets manager, and a postMessage handler with no origin check giving access to camera and microphone. - **How to become a hacker.**[@alisaesage](https://x.com/alisaesage) from Zero Day Engineering shared[a video](https://x.com/5mukx/status/2084315795069538401) on the mindset and approach behind building a career in vulnerability research. - **Are security researchers doomed because of AI?**[@0xLupin](https://x.com/0xLupin) wrote[a thoughtful X/Twitter article](https://x.com/0xLupin/status/2087615702710538421) that goes back through 500 years of technology disruption to put the current moment in context. - **Using AI to get #1 on the NetHack leaderboard.**[@rez0__](https://x.com/rez0__) published a post on[building an AI agent to play NetHack competitively](https://josephthacker.com/hacking/2026/08/20/using-genius-hacking-models-for-important-things.html) . - **The future of vulnerability research and bug bounty in an AI world.**[@impost0r_](https://x.com/impost0r_) published[a personal take](https://ret2p.lt/2026/08/10/ai-vuln-research-future.html) on where independent research and bug bounty are heading. - **I found a critical vulnerability and was paid $15,500.** This write-up covers how a simple URL tweak[exposed millions of private records](https://medium.com/@tanvir.infosec/i-found-a-critical-vulnerability-they-paid-me-15-500-9976ce313544) , and what the process behind finding the bug looked like. - **Frontier class vulnerabilities: it gets worse before it maybe gets better.**[@infosec_au](https://x.com/infosec_au) published a post on[what is changing in the high-end vulnerability research space](https://shubs.io/frontier-class-vulnerabilities-it-gets-worse-before-it-maybe-gets-better/) and what a realistic strategy looks like in response. - **More criticals, less dopamine.**[@dhakal_ananda](https://x.com/dhakal_ananda) published[a personal reflection](https://dhakal-ananda.com.np/misc/more-criticals-less-dopamine/) on finding more bugs than ever while enjoying it less, and what AI has changed about the experience of vulnerability research. - **Playing with DeepSeek-V4-Flash-0731 at the airport.**[@mrexodia](https://x.com/mrexodia) shared[some quick observations](https://x.com/mrexodia/status/2090806161813405917) on the model's behavior under adversarial prompting. - **Executing arbitrary code via Google's own signed installer.**[@buffaloverflow](https://x.com/buffaloverflow) published a post on Tag, You're Managed covering how signed Google Chrome installers can be abused to achieve[arbitrary code execution](https://blog.amberwolf.com/blog/2026/august/tag-youre-managed---executing-code-via-googles-own-signed-installer/) . - **AI agents as an alternative to Frida for hardened mobile apps.**[@c3l3si4n](https://x.com/c3l3si4n) shared a practical insight on moving away from Frida-based hooking toward[AI agent workflows for apps](https://x.com/c3l3si4n/status/2089534142685811114) that actively resist dynamic instrumentation. - **Multiple XSS vulnerabilities in Mailcow.**[@J0R1AN](https://x.com/J0R1AN) (Aikido) published a new article covering his recent findings in Mailcow, including an[unauthenticated XSS](https://www.aikido.dev/blog/xss-vulnerabilities-in-mailcow) and a Self-XSS escalated using a login/logout CSRF. - **How Burp AT helped expose whistleblower reports via a critical overlooked vulnerability.**[@Burp_Suite](https://x.com/Burp_Suite) published a case study on a vulnerability that had gone undetected for years before being discovered with[Burp AT](https://portswigger.net/blog/how-burp-at-helped-expose-whistleblower-reports-via-a-critical-vulnerability-that-was-overlooked-for-years) . - **Blueprint to making $100K with Caido โ€” a free bug bounty course.**[@NahamSec](https://x.com/NahamSec) shared[a free course](https://x.com/NahamSec/status/2089332667003052170) put together with[@amrelsagaei](https://x.com/amrelsagaei) covering how to build a productive bug bounty workflow while using Caido. ## Company news ### DEF CON 34 and Hacker Summer Camp 2026 recap What a week in Las Vegas. Hacker Summer Camp ran from August 3 to 9, and Intigriti was part of it across the full run. We kicked things off at BSides Las Vegas with PortSwigger, then hosted PWN The Pot, a casino night at the Fontainebleau featuring poker, roulette, and a prize auction with some genuinely fun prizes on the line. At Black Hat, we ran a spot-the-bug challenge at the PortSwigger booth. Solvers who whispered the password walked away with a limited-edition Intigriti Nike hat, and the lucky ones got their hands on a challenge coin. We also attended Vulnerability Vibes to meet the community in a more relaxed setting, and hosted Hackers Unplugged at Play Playground with drinks, games, and time with our Program Managers. DEF CON was the finish line. As proud platinum sponsors of the Bug Bounty Village, our team delivered four CFP talks, including "Hacking Human-in-the-Loop Systems" by [@intidc](https://www.linkedin.com/in/intidc/). And a talk by [**Radu**](https://www.linkedin.com/in/radustefanvoloaga/), Intigritiโ€™s Senior Program Manager, who gave attendees the first public look at CrowdRecon. Huge thanks to everyone who showed up. We hope to see you next year. Intigriti at Hacker Summer Camp 2026 ### Vulnerability Vibes The [Vulnerability Vibes](https://www.linkedin.com/feed/update/urn:li:activity:7491955606069760001) event was a good one. The conversations were fantastic, the poster got signed by some of the most talented hackers in the community, and meeting the people behind the handles in person is always worth it. Big thanks to the organizers and sponsors for putting it together. Intigriti at Vulnerability Vibes 2026 ### HackGlasgow 2026 The Intigriti team were live at [HackGlasgow 2026!](https://www.linkedin.com/feed/update/urn:li:activity:7494339261597536257) We had a booth where you could meet the team, pick up some swag, and take on our CTF challenge. It was a great opportunity to connect with the local security community, and the energy in the room reflected that. Intigriti at HackGlasgow 2026 ## Feedback & suggestions **Before you click away:** Do you have feedback, or would you like your technical content to get featured in the next Bug Bytes issue? We want to hear from you. Feel free to send us an email at [community@intigriti.com](mailto:community@intigriti.com) or [DM](https://twitter.com/messages/compose?recipient_id=736615159653924864) us on X/Twitter, and we'll take it from there. Did you like this Bug Bytes issue? Consider sharing it with your friends and tagging us along on X/Twitter, Instagram, or LinkedIn. Wishing you a bountiful month ahead, Keep on rocking! Author Ayoub Senior security content developer ## You may also like July 31, 2026 ### Intigriti Bug Bytes #238 - July 2026 ๐Ÿš€ Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Intigriti turns 10! RCE in GitHub.com and GitHub Enterprise Server Burp Suite going agentic with Burp AT Hacking Gemini Enterprise for $15,000 3,708 live credentials found by scanning GitHub Archive And so much mo [Read more](https://www.intigriti.com/researchers/blog/bug-bytes/intigriti-bug-bytes-238-july-2026) June 26, 2026 ### Intigriti Bug Bytes #237 - June 2026 ๐Ÿš€ Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: A 10-year-old pre-auth RCE in phpBB Earning $500K hacking Google with AI Reading any Salesforce Marketing Cloud account's emails New DOMPurify sanitizer bypass Mapping abandoned S3 buckets to redo SolarWinds at scal [Read more](https://www.intigriti.com/researchers/blog/bug-bytes/intigriti-bug-bytes-237-june-2026) May 30, 2026 ### Intigriti Bug Bytes #236 - May 2026 ๐Ÿš€ Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Earning $148K via RCE in Google Cloud How public Google API keys became Gemini credentials Our first official Burp Suite extension Two new bypasses for Chrome's Sanitizer API One-click account takeover from a sani [Read more](https://www.intigriti.com/researchers/blog/bug-bytes/intigriti-bug-bytes-236-may-2026)