Intigriti Bug Bytes #239 - August 2026 🚀

Intigriti was named the new provider for Adobe's Bug Bounty Program effective September 1, 2026, with Intigriti Founder and CEO Stijn Jans calling it "the start of a long and rewarding partnership." The August 2026 edition of Intigriti's Bug Bytes also previewed CrowdRecon, a recon-coverage product first shown publicly by Senior Product Manager Radu at DEF CON 34, and covered an Intigriti blog arguing AI safety findings need an outcome-based, customer-specific severity model rather than CVSS. The newsletter additionally featured CSS injection as an email attack vector and a toolkit of 169 offensive recon skills.

Intigriti Bug Bytes 239 - August 2026 🚀 By Ayoub August 28, 2026 Hi hackers, Welcome to the latest edition of Bug Bytes In this month's issue, we are featuring: - Intigriti as the new provider for Adobe's Bug Bounty Program - CSS injection as an attack vector inside your email inbox - AI doing novel security research: the HTTP Terminator - 169 offensive recon skills in one AI-ready toolkit And so much more Let's dive in CrowdRecon is coming Most security teams only see what makes it into the final report. But the real signal often starts earlier. It starts in the paths explored, the assets questioned, and the context built before a finding is found. That is where recon becomes more than research. It becomes intelligence. The Intigriti team has been building something around this idea for months. At DEF CON 34, our Senior Product Manager, Radu https://www.linkedin.com/in/radustefanvoloaga/ , gave the first public look at CrowdRecon https://www.intigriti.com/blog/news/introducing-crowdrecon during his talk "Turning Recon Coverage into Bug Bounty Signal" at the Bug Bounty Village. The core idea: all that recon work hackers do before finding a vulnerability should not just disappear when it does not turn into a report. CrowdRecon makes sure it counts. Hackers get recognized for the exploration, not just the finding. Security teams get a live view of their attack surface through the community's eyes. More details are coming soon. Keep an eye on our socials. Reconnaissance unleashed: meet CrowdRecon Intigriti named new provider for Adobe's Bug Bounty Program Intigriti has been named the new provider for Adobe's Bug Bounty Program, effective September 1, 2026. As our Founder and CEO, Stijn Jans https://www.linkedin.com/in/stijnjans/ shared: "At Intigriti, we believe the strongest security comes from working alongside the hacking community. Our focus is on giving Adobe researchers an outstanding experience and supporting that community's continued growth. We are honored that they have chosen us as the new home for their Bug Bounty Program, and we see this as the start of a long and rewarding partnership." If you are a researcher, create your Intigriti account https://login.intigriti.com/account/register ahead of September 1 to be ready when the program goes live. Intigriti named new provider for Adobe's Bug Bounty Program Beyond CVSS: rethinking scoring systems amidst AI Safety and Security CVSS is a solid framework for traditional vulnerabilities, but when an AI model produces biased outputs or hateful language, there is no confidentiality breach, no integrity failure, no availability loss. And yet the regulatory and reputational damage can be significant. In our latest blog, we explore why AI security and AI safety need fundamentally different scoring models. https://www.intigriti.com/blog/business-insights/rethinking-cvss-scoring-systems-amidst-ai-safety-and-security AI security findings, such as prompt injection leading to data leakage, map cleanly to CVSS. AI safety findings, harmful outputs, unsafe tool use, misleading responses, need an outcome-based, customer-specific severity model instead. The post covers three specific challenges every security team should be thinking about right now. Beyond CVSS: rethinking scoring systems amidst AI Safety and Security When fear no longer holds you back: interview with Ryan Bonner Roll4CombatUS We interviewed Intigriti Ambassador Ryan Bonner https://www.intigriti.com/blog/business-insights/interview-with-ryan-bonner-roll4combatus , known in the community as Roll4CombatUS, to talk about his journey from early career struggles to becoming one of the more dedicated hunters in the space. The conversation covers why he focuses on wide-scope programs, what he would tell bug bounty programs to improve researcher engagement, and the daily habit that changed how he works. When fear no longer holds you back. Interview with Ryan Bonner Roll4CombatUS Quick Intigriti 0826 Bad Reception CTF is still live Intigriti's 0826 Challenge is still ongoing. If you haven't captured the flag yet, now is the time. Head over, find the flag before Monday, the 31st of August. Take on the challenge https://go.intigriti.com/xss-challenge Intigriti Challenge 0826 Bad Reception Intigriti 0726 Canonically Yours Challenge results are in Intigriti's 0726 Challenge, Canonically Yours, is now closed, and it bought the attention of a lot of researchers. The challenge was slightly easier than usual, which accounted for the high number of solves, and it was clear that a number of participants leaned on AI tools to help work through it Quick recap: - First blood was captured by Jayce https://x.com/JxyceDang - 138 hackers found the correct solution - 34 hackers wrote a cool write-up If you want to put your hacking skills to the test, be sure to give the Canonically Yours 0726 Challenge a go before heading over to Bugology https://bugology.intigriti.io/intigriti-monthly-challenges , where you can find all the researchers' submitted solutions. Intigriti Challenge 0726 Canonically Yours Blogs & videos Web fuzzing for hackers https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers Web fuzzing for hackers Cover Image Web fuzzing is often treated as bruteforcing with a wordlist. When you move past that framing, it starts producing much more interesting results. In our latest article, put together with @GodFatherOrwa https://x.com/GodFatherOrwa , we go deeper into using fuzzing for reconnaissance and vulnerability exploitation https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers : discovering hidden assets, surfacing unusual application logic, and turning that behavior into findings. If you have been treating fuzzing as a last resort, this one is worth reading. - Disagree with how your report was handled? Our latest guide on how to appeal a bug bounty submission https://intigriti.com/researchers/blog/hacking-tools/how-to-appeal-a-bug-bounty-submission walks through Intigriti's mediation process, the most common scenarios, and what to avoid during the process to reach a resolution faster. - Going from zero to your first valid bug report? In case you missed it, we recently launched the Bug Bounty Starter Kit https://www.intigriti.com/bug-bounty-starter-kit , a free guide covering everything from recon and tooling to the exploitation of SQLi, XSS, and BAC vulnerabilities, to finally how to learn to write a compelling vulnerability report that gets triaged faster. Get your copy now. https://www.intigriti.com/bug-bounty-starter-kit Tools & resources Tools UnKover https://github.com/BruteLogic/unKover unKover Getting blocked by a 403 does not always mean access controls are correctly enforced. UnKover https://github.com/BruteLogic/unKover by @BRuteLogic https://x.com/BRuteLogic is a simple new Bash script that tests a target returning a 403 status code against a set of proven bypass techniques, including IP header spoofing, method tampering, path normalization, URL encoding, HTTP/1.0 downgrade, and more. - Tired of SAST tools flooding you with unverifiable findings? Strix https://github.com/usestrix/strix by @strix ai https://x.com/strix ai takes a different approach: instead of pattern matching, it deploys AI agents that run your code in a sandbox, discover the attack surface, and validate each finding with a working proof of concept before surfacing it. - Recon eating up half your session time? Recon-skills https://github.com/uphiago/recon-skills by @uphiago https://x.com/uphiago packages 169 offensive security skills into an AI-ready toolkit covering subdomain enumeration, vhost discovery, JS analysis, and GitHub secret hunting. All of them were tested across 600+ real targets in 45+ sectors. Resources CSS: the bomb inside your inbox https://portswigger.net/research/css-the-bomb-inside-your-inbox CSS: the bomb inside your inbox @garethheyes https://x.com/garethheyes at PortSwigger published research showing how CSS injection https://portswigger.net/research/css-the-bomb-inside-your-inbox within an email client can be turned into an account takeover, including credential theft, without JavaScript. - Getting an arbitrary file write closed as medium? @0xacb https://x.com/0xacb and the Ethiack team published Write Once, Shell Everywhere https://ethiack.com/info-hub/research/write-once-shell-everywhere-arbitrary-file-writes-into-rce , a detailed look at how to escalate arbitrary file writes to remote code execution across a range of server configurations. - Can AI do novel security research? @albinowax https://x.com/albinowax at PortSwigger published a whitepaper on the HTTP Terminator https://portswigger.net/research/can-ai-do-novel-security-research , a research effort testing whether AI agents can discover new classes of HTTP vulnerabilities independently. The results are worth reading alongside the methodology. - 0-click stored XSS on Next.js via type confusion. @zhero https://x.com/zhero and @inzo https://x.com/inzo published Re:CACHE https://zhero-web-sec.github.io/research-and-things/re-cache-excessive-reflection-type-confusion-and-0-click-sxss-on-nextjs , covering a real-world exploitation case where a specific mistake in Next.js's caching behavior leads to a systematic zero-click SXSS on its latest versions. - A 22-year-old bug in EasyTimeline allowed arbitrary code execution from wikitext. @v12sec https://x.com/v12sec published a thread with their finding around a code injection vulnerability https://x.com/v12sec/status/2085048205847523622 introduced in 2004 that was still present in 2026. - Universal XSS in Google Translate, $8,500 bounty. @R3dpars3c https://x.com/R3dpars3c found a UXSS https://r3dpars3c.github.io/writeups/Google Chrome UXSS Via Google Translate.html that allowed JavaScript execution on any domain with reflected input via Google Translate. - What's in a tag name? JavaScript, apparently. @garethheyes https://x.com/garethheyes also published a shorter research post https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently on a less-obvious XSS technique. - A silent signature extraction in Rabby wallet led to a full wallet drain. In another thread, the @v12sec https://x.com/v12sec team shares how they managed to drain a wallet https://x.com/v12sec/status/2090114226320977931 while the victim was playing a video game. - CRLF-Powered Desync Attacks: beheading HTTP streams. @t0xodile https://x.com/t0xodile published new research at PortSwigger on how CRLF injection can be used to trigger HTTP request desynchronization attacks https://portswigger.net/research/crlf-powered-desync-attacks . - CVE-2026-18501: stored XSS in UsersWP https://cryptocat.me/blog/research/analysis/cve 2026 18501/ via variable substitution. @ CryptoCat https://x.com/ CryptoCat published a detailed analysis of how sanitize text field preserved an entity-encoded payload that was later decoded and output without escaping. - IDOR via comma-injection https://medium.com/@s0ufm3l/idor-via-comma-injection-how-concatenating-two-ids-leaked-cross-tenant-pii-d5f003e594f9 led to cross-tenant PII exposure. @s0ufm3l https://x.com/s0ufm3l published a write-up on how concatenating two IDs with a comma was enough to access another tenant's data. - A simple RBAC misconfiguration https://medium.com/@Seek404/how-a-simple-rbac-mistake-led-to-a-20k-admin-takeover-d196694791dd led to a $20K+ admin takeover. The write-up is a clear example of how a single logic gap in role enforcement can have a disproportionate impact. - Bullying LLMs into submission to find 0days at scale. @ZephrSec https://x.com/ZephrSec published a practical post on using several prompting techniques as part of a workflow for finding real vulnerabilities at scale with LLMs https://blog.zsec.uk/bullyingllms/ . - How to start or come back to bug bounties in 2026. @hakluke https://x.com/hakluke published a comprehensive guide https://hakluke.com/how-to-start-or-come-back-to-bug-bounties-in-2026 covering the current landscape, where to focus, and how to build momentum whether you are just starting out or returning after a break. - An authentication bypass in LinkedIn's session handling. @torious100 https://x.com/torious100 published a write-up on how a sneaky session update mechanism could be abused to achieve account takeover https://adebayosec.medium.com/auth-bypass-a-story-of-linkedins-sneaky-session-update-bypass-2c9ee712b48c . - Google's agentic source code review https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review found 100+ critical vulnerabilities in two days. The approach is worth more attention than the number itself: the post separates generation agents from validation agents, avoiding the problem of a single agent defending its own findings. - $250,000 bounty for CVE-2026-9876, a critical WebGL use-after-free in Chrome https://issues.chromium.org/issues/493747593 . The Chromium issue links it to a bypass of a previously exploited Qualcomm Adreno CVE. - Accelerating EDR evasion with LLM-driven analysis. @xpn https://x.com/ xpn published a post on using LLMs to analyze local EDR rulesets https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/ , YARA rules, and behavioral detections to make evasion significantly faster. Worth reading for the harness setup as much as the findings. - Borrowing Windows Hello keys for authentication and persistence. @ dirkjan https://x.com/ dirkjan published a post covering how Windows Hello keys can be extracted https://dirkjanm.io/borrowing-windows-hello-keys/ and reused for authentication and long-term persistence. - Bypassing rate limits via forwarding headers. @Reeshasx https://x.com/Reeshasx shared a practical tip on using headers such as X-Forwarded-For , X-Real-IP , and Forwarded to bypass rate limiting https://x.com/Reeshasx/status/2090198916763431256 . The same technique can also lead to IP allowlist bypasses 401/403 bypasses and SSRF. - Beyond Prompt Injection: hacking Apple's Private Cloud Compute. Researcher Drinor Sentry found that darwin-init, the first userspace process in Apple's Private Cloud Compute, uses an archive extractor that never validates file paths. A crafted tar file was enough to write files as root https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/ to a persistent location and redirect AI telemetry. Apple awarded $150,000 for CVE-2026-20685. - 200 billion tokens later: a month of letting AI agents decompile MW2. @momo5502 https://x.com/momo5502 published a post https://momo5502.com/posts/2026-08-17-mw2-decompilation/ focused mainly on the multi-agent setup behind the decompilation effort. - From a simple random ID to a mass PII leak €1,875 . @luq0xss https://x.com/luq0xss shared a brief write-up on how a predictable identifier exposed personal data https://x.com/luq0xss/status/2085014583777902860 at scale. - Hacking SAML with Claude Code. A write-up from Oblique Security on using Claude Code as part of a SAML vulnerability https://oblique.security/blog/hacking-saml/ hunting. - DEF CON war stories: chat XSS to spyware, token shuffles, and camera hijacks. The Critical Thinking Bug Bounty Podcast @ctbbpodcast https://x.com/ctbbpodcast published HackerNotes for episode 188 https://blog.criticalthinkingpodcast.io/p/hackernotes-ep-188-def-con-war-stories-chat-xss-to-spyware-token-shuffles-and-camera-hijacks covering three stories from DEF CON week: a stored XSS chained through Electron IPC for persistence, embedded AWS credentials leading to a fleet-wide secrets manager, and a postMessage handler with no origin check giving access to camera and microphone. - How to become a hacker. @alisaesage https://x.com/alisaesage from Zero Day Engineering shared a video https://x.com/5mukx/status/2084315795069538401 on the mindset and approach behind building a career in vulnerability research. - Are security researchers doomed because of AI? @0xLupin https://x.com/0xLupin wrote a thoughtful X/Twitter article https://x.com/0xLupin/status/2087615702710538421 that goes back through 500 years of technology disruption to put the current moment in context. - Using AI to get 1 on the NetHack leaderboard. @rez0 https://x.com/rez0 published a post on building an AI agent to play NetHack competitively https://josephthacker.com/hacking/2026/08/20/using-genius-hacking-models-for-important-things.html . - The future of vulnerability research and bug bounty in an AI world. @impost0r https://x.com/impost0r published a personal take https://ret2p.lt/2026/08/10/ai-vuln-research-future.html on where independent research and bug bounty are heading. - I found a critical vulnerability and was paid $15,500. This write-up covers how a simple URL tweak exposed millions of private records https://medium.com/@tanvir.infosec/i-found-a-critical-vulnerability-they-paid-me-15-500-9976ce313544 , and what the process behind finding the bug looked like. - Frontier class vulnerabilities: it gets worse before it maybe gets better. @infosec au https://x.com/infosec au published a post on what is changing in the high-end vulnerability research space https://shubs.io/frontier-class-vulnerabilities-it-gets-worse-before-it-maybe-gets-better/ and what a realistic strategy looks like in response. - More criticals, less dopamine. @dhakal ananda https://x.com/dhakal ananda published a personal reflection https://dhakal-ananda.com.np/misc/more-criticals-less-dopamine/ on finding more bugs than ever while enjoying it less, and what AI has changed about the experience of vulnerability research. - Playing with DeepSeek-V4-Flash-0731 at the airport. @mrexodia https://x.com/mrexodia shared some quick observations https://x.com/mrexodia/status/2090806161813405917 on the model's behavior under adversarial prompting. - Executing arbitrary code via Google's own signed installer. @buffaloverflow https://x.com/buffaloverflow published a post on Tag, You're Managed covering how signed Google Chrome installers can be abused to achieve arbitrary code execution https://blog.amberwolf.com/blog/2026/august/tag-youre-managed---executing-code-via-googles-own-signed-installer/ . - AI agents as an alternative to Frida for hardened mobile apps. @c3l3si4n https://x.com/c3l3si4n shared a practical insight on moving away from Frida-based hooking toward AI agent workflows for apps https://x.com/c3l3si4n/status/2089534142685811114 that actively resist dynamic instrumentation. - Multiple XSS vulnerabilities in Mailcow. @J0R1AN https://x.com/J0R1AN Aikido published a new article covering his recent findings in Mailcow, including an unauthenticated XSS https://www.aikido.dev/blog/xss-vulnerabilities-in-mailcow and a Self-XSS escalated using a login/logout CSRF. - How Burp AT helped expose whistleblower reports via a critical overlooked vulnerability. @Burp Suite https://x.com/Burp Suite published a case study on a vulnerability that had gone undetected for years before being discovered with Burp AT https://portswigger.net/blog/how-burp-at-helped-expose-whistleblower-reports-via-a-critical-vulnerability-that-was-overlooked-for-years . - Blueprint to making $100K with Caido — a free bug bounty course. @NahamSec https://x.com/NahamSec shared a free course https://x.com/NahamSec/status/2089332667003052170 put together with @amrelsagaei https://x.com/amrelsagaei covering how to build a productive bug bounty workflow while using Caido. Company news DEF CON 34 and Hacker Summer Camp 2026 recap What a week in Las Vegas. Hacker Summer Camp ran from August 3 to 9, and Intigriti was part of it across the full run. We kicked things off at BSides Las Vegas with PortSwigger, then hosted PWN The Pot, a casino night at the Fontainebleau featuring poker, roulette, and a prize auction with some genuinely fun prizes on the line. At Black Hat, we ran a spot-the-bug challenge at the PortSwigger booth. Solvers who whispered the password walked away with a limited-edition Intigriti Nike hat, and the lucky ones got their hands on a challenge coin. We also attended Vulnerability Vibes to meet the community in a more relaxed setting, and hosted Hackers Unplugged at Play Playground with drinks, games, and time with our Program Managers. DEF CON was the finish line. As proud platinum sponsors of the Bug Bounty Village, our team delivered four CFP talks, including "Hacking Human-in-the-Loop Systems" by @intidc https://www.linkedin.com/in/intidc/ . And a talk by Radu https://www.linkedin.com/in/radustefanvoloaga/ , Intigriti’s Senior Program Manager, who gave attendees the first public look at CrowdRecon. Huge thanks to everyone who showed up. We hope to see you next year. Intigriti at Hacker Summer Camp 2026 Vulnerability Vibes The Vulnerability Vibes https://www.linkedin.com/feed/update/urn:li:activity:7491955606069760001 event was a good one. The conversations were fantastic, the poster got signed by some of the most talented hackers in the community, and meeting the people behind the handles in person is always worth it. Big thanks to the organizers and sponsors for putting it together. Intigriti at Vulnerability Vibes 2026 HackGlasgow 2026 The Intigriti team were live at HackGlasgow 2026 https://www.linkedin.com/feed/update/urn:li:activity:7494339261597536257 We had a booth where you could meet the team, pick up some swag, and take on our CTF challenge. It was a great opportunity to connect with the local security community, and the energy in the room reflected that. Intigriti at HackGlasgow 2026 Feedback & suggestions Before you click away: Do you have feedback, or would you like your technical content to get featured in the next Bug Bytes issue? We want to hear from you. Feel free to send us an email at community@intigriti.com mailto:community@intigriti.com or DM https://twitter.com/messages/compose?recipient id=736615159653924864 us on X/Twitter, and we'll take it from there. Did you like this Bug Bytes issue? Consider sharing it with your friends and tagging us along on X/Twitter, Instagram, or LinkedIn. Wishing you a bountiful month ahead, Keep on rocking Author Ayoub Senior security content developer You may also like July 31, 2026 Intigriti Bug Bytes 238 - July 2026 🚀 Welcome to the latest edition of Bug Bytes In this month's issue, we'll be featuring: Intigriti turns 10 RCE in GitHub.com and GitHub Enterprise Server Burp Suite going agentic with Burp AT Hacking Gemini Enterprise for $15,000 3,708 live credentials found by scanning GitHub Archive And so much mo Read more https://www.intigriti.com/researchers/blog/bug-bytes/intigriti-bug-bytes-238-july-2026 June 26, 2026 Intigriti Bug Bytes 237 - June 2026 🚀 Welcome to the latest edition of Bug Bytes In this month's issue, we are featuring: A 10-year-old pre-auth RCE in phpBB Earning $500K hacking Google with AI Reading any Salesforce Marketing Cloud account's emails New DOMPurify sanitizer bypass Mapping abandoned S3 buckets to redo SolarWinds at scal Read more https://www.intigriti.com/researchers/blog/bug-bytes/intigriti-bug-bytes-237-june-2026 May 30, 2026 Intigriti Bug Bytes 236 - May 2026 🚀 Welcome to the latest edition of Bug Bytes In this month's issue, we'll be featuring: Earning $148K via RCE in Google Cloud How public Google API keys became Gemini credentials Our first official Burp Suite extension Two new bypasses for Chrome's Sanitizer API One-click account takeover from a sani Read more https://www.intigriti.com/researchers/blog/bug-bytes/intigriti-bug-bytes-236-may-2026