Intigriti Bug Bytes #239 - August 2026 🚀

Hi hackers,

Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring:

• Intigriti as the new provider for Adobe's Bug Bounty Program

• CSS injection as an attack vector inside your email inbox

• AI doing novel security research: the HTTP Terminator

• 169 offensive recon skills in one AI-ready toolkit

And so much more! Let's dive in!

CrowdRecon is coming

Most security teams only see what makes it into the final report. But the real signal often starts earlier. It starts in the paths explored, the assets questioned, and the context built before a finding is found.

That is where recon becomes more than research. It becomes intelligence. The Intigriti team has been building something around this idea for months. At DEF CON 34, our Senior Product Manager, Radu, gave the first public look at CrowdRecon during his talk "Turning Recon Coverage into Bug Bounty Signal" at the Bug Bounty Village.

The core idea: all that recon work hackers do before finding a vulnerability should not just disappear when it does not turn into a report. CrowdRecon makes sure it counts. Hackers get recognized for the exploration, not just the finding. Security teams get a live view of their attack surface through the community's eyes.

More details are coming soon. Keep an eye on our socials.

Reconnaissance unleashed: meet CrowdRecon

Intigriti named new provider for Adobe's Bug Bounty Program

Intigriti has been named the new provider for Adobe's Bug Bounty Program, effective September 1, 2026.

As our Founder and CEO, Stijn Jans shared: "At Intigriti, we believe the strongest security comes from working alongside the hacking community. Our focus is on giving Adobe researchers an outstanding experience and supporting that community's continued growth. We are honored that they have chosen us as the new home for their Bug Bounty Program, and we see this as the start of a long and rewarding partnership."

If you are a researcher, create your Intigriti account ahead of September 1 to be ready when the program goes live.

Read the full announcement

Intigriti named new provider for Adobe's Bug Bounty Program

Beyond CVSS: rethinking scoring systems amidst AI Safety and Security

CVSS is a solid framework for traditional vulnerabilities, but when an AI model produces biased outputs or hateful language, there is no confidentiality breach, no integrity failure, no availability loss. And yet the regulatory and reputational damage can be significant.

In our latest blog, we explore why AI security and AI safety need fundamentally different scoring models. AI security findings, such as prompt injection leading to data leakage, map cleanly to CVSS. AI safety findings, harmful outputs, unsafe tool use, misleading responses, need an outcome-based, customer-specific severity model instead. The post covers three specific challenges every security team should be thinking about right now.

Beyond CVSS: rethinking scoring systems amidst AI Safety and Security

When fear no longer holds you back: interview with Ryan Bonner (Roll4CombatUS)

We interviewed Intigriti Ambassador Ryan Bonner, known in the community as Roll4CombatUS, to talk about his journey from early career struggles to becoming one of the more dedicated hunters in the space. The conversation covers why he focuses on wide-scope programs, what he would tell bug bounty programs to improve researcher engagement, and the daily habit that changed how he works.

When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS)

Quick! Intigriti 0826 Bad Reception CTF is still live

Intigriti's 0826 Challenge is still ongoing. If you haven't captured the flag yet, now is the time. Head over, find the flag before Monday, the 31st of August. Take on the challenge!

Intigriti Challenge 0826 Bad Reception

Intigriti 0726 Canonically Yours Challenge results are in

Intigriti's 0726 Challenge, Canonically Yours, is now closed, and it bought the attention of a lot of researchers. The challenge was slightly easier than usual, which accounted for the high number of solves, and it was clear that a number of participants leaned on AI tools to help work through it!

Quick recap:

• First blood was captured by Jayce

• 138 hackers found the correct solution

• 34 hackers wrote a cool write-up

If you want to put your hacking skills to the test, be sure to give the Canonically Yours 0726 Challenge a go before heading over to Bugology, where you can find all the researchers' submitted solutions.

Intigriti Challenge 0726 Canonically Yours

Blogs & videos

Web fuzzing for hackers

Web fuzzing for hackers Cover Image

Web fuzzing is often treated as bruteforcing with a wordlist. When you move past that framing, it starts producing much more interesting results. In our latest article, put together with @GodFatherOrwa, we go deeper into using fuzzing for reconnaissance and vulnerability exploitation: discovering hidden assets, surfacing unusual application logic, and turning that behavior into findings. If you have been treating fuzzing as a last resort, this one is worth reading.

• Disagree with how your report was handled? Our latest guide on how to appeal a bug bounty submission walks through Intigriti's mediation process, the most common scenarios, and what to avoid during the process to reach a resolution faster.

• Going from zero to your first valid bug report? In case you missed it, we recently launched the Bug Bounty Starter Kit, a free guide covering everything from recon and tooling to the exploitation of SQLi, XSS, and BAC vulnerabilities, to finally how to learn to write a compelling vulnerability report that gets triaged faster. Get your copy now.

Tools & resources

Tools

UnKover

unKover

Getting blocked by a 403 does not always mean access controls are correctly enforced. UnKover by @BRuteLogic is a simple new Bash script that tests a target returning a 403 status code against a set of proven bypass techniques, including IP header spoofing, method tampering, path normalization, URL encoding, HTTP/1.0 downgrade, and more.

• Tired of SAST tools flooding you with unverifiable findings? Strix by @strix_ai takes a different approach: instead of pattern matching, it deploys AI agents that run your code in a sandbox, discover the attack surface, and validate each finding with a working proof of concept before surfacing it.

• Recon eating up half your session time? Recon-skills by @uphiago packages 169 offensive security skills into an AI-ready toolkit covering subdomain enumeration, vhost discovery, JS analysis, and GitHub secret hunting. All of them were tested across 600+ real targets in 45+ sectors.

Resources

CSS: the bomb inside your inbox

CSS: the bomb inside your inbox

@garethheyes at PortSwigger published research showing how CSS injection within an email client can be turned into an account takeover, including credential theft, without JavaScript.

• Getting an arbitrary file write closed as medium? @0xacb and the Ethiack team published Write Once, Shell Everywhere, a detailed look at how to escalate arbitrary file writes to remote code execution across a range of server configurations.

• Can AI do novel security research? @albinowax at PortSwigger published a whitepaper on the HTTP Terminator, a research effort testing whether AI agents can discover new classes of HTTP vulnerabilities independently. The results are worth reading alongside the methodology.

• 0-click stored XSS on Next.js via type confusion. @zhero___ and @inzo____ published Re:CACHE, covering a real-world exploitation case where a specific mistake in Next.js's caching behavior leads to a systematic zero-click SXSS on its latest versions.

• A 22-year-old bug in EasyTimeline allowed arbitrary code execution from wikitext. @v12sec published a thread with their finding around a code injection vulnerability introduced in 2004 that was still present in 2026.

• Universal XSS in Google Translate, $8,500 bounty. @R3dpars3c found a UXSS that allowed JavaScript execution on any domain with reflected input via Google Translate.

• What's in a tag name? JavaScript, apparently. @garethheyes also published a shorter research post on a less-obvious XSS technique.

• A silent signature extraction in Rabby wallet led to a full wallet drain. In another thread, the @v12sec team shares how they managed to drain a wallet while the victim was playing a video game.

• CRLF-Powered Desync Attacks: beheading HTTP streams. @t0xodile published new research at PortSwigger on how CRLF injection can be used to trigger HTTP request desynchronization attacks.

• CVE-2026-18501: stored XSS in UsersWP via variable substitution. @_CryptoCat published a detailed analysis of how sanitize_text_field() preserved an entity-encoded payload that was later decoded and output without escaping.

• IDOR via comma-injection led to cross-tenant PII exposure. @s0ufm3l published a write-up on how concatenating two IDs with a comma was enough to access another tenant's data.

• A simple RBAC misconfiguration led to a $20K+ admin takeover. The write-up is a clear example of how a single logic gap in role enforcement can have a disproportionate impact.

• Bullying LLMs into submission to find 0days at scale. @ZephrSec published a practical post on using several prompting techniques as part of a workflow for finding real vulnerabilities at scale with LLMs.

• How to start (or come back to) bug bounties in 2026. @hakluke published a comprehensive guide covering the current landscape, where to focus, and how to build momentum whether you are just starting out or returning after a break.

• An authentication bypass in LinkedIn's session handling. @torious100 published a write-up on how a sneaky session update mechanism could be abused to achieve account takeover.

• Google's agentic source code review found 100+ critical vulnerabilities in two days. The approach is worth more attention than the number itself: the post separates generation agents from validation agents, avoiding the problem of a single agent defending its own findings.

• $250,000 bounty for CVE-2026-9876, a critical WebGL use-after-free in Chrome. The Chromium issue links it to a bypass of a previously exploited Qualcomm Adreno CVE.

• Accelerating EDR evasion with LLM-driven analysis. @xpn published a post on using LLMs to analyze local EDR rulesets, YARA rules, and behavioral detections to make evasion significantly faster. Worth reading for the harness setup as much as the findings.

• Borrowing Windows Hello keys for authentication and persistence. @_dirkjan published a post covering how Windows Hello keys can be extracted and reused for authentication and long-term persistence.

• Bypassing rate limits via forwarding headers. @Reeshasx shared a practical tip on using headers such as X-Forwarded-For, X-Real-IP, and Forwarded to bypass rate limiting. The same technique can also lead to IP allowlist bypasses (401/403 bypasses) and SSRF.

• Beyond Prompt Injection: hacking Apple's Private Cloud Compute. Researcher Drinor (Sentry) found that darwin-init, the first userspace process in Apple's Private Cloud Compute, uses an archive extractor that never validates file paths. A crafted tar file was enough to write files as root to a persistent location and redirect AI telemetry. Apple awarded $150,000 for CVE-2026-20685.

• 200 billion tokens later: a month of letting AI agents decompile MW2. @momo5502 published a post focused mainly on the multi-agent setup behind the decompilation effort.

• From a simple random ID to a mass PII leak (€1,875). @luq0xss shared a brief write-up on how a predictable identifier exposed personal data at scale.

• Hacking SAML with Claude Code. A write-up from Oblique Security on using Claude Code as part of a SAML vulnerability hunting.

• DEF CON war stories: chat XSS to spyware, token shuffles, and camera hijacks. The Critical Thinking Bug Bounty Podcast @ctbbpodcast published HackerNotes for episode 188 covering three stories from DEF CON week: a stored XSS chained through Electron IPC for persistence, embedded AWS credentials leading to a fleet-wide secrets manager, and a postMessage handler with no origin check giving access to camera and microphone.

• How to become a hacker. @alisaesage from Zero Day Engineering shared a video on the mindset and approach behind building a career in vulnerability research.

• Are security researchers doomed because of AI? @0xLupin wrote a thoughtful X/Twitter article that goes back through 500 years of technology disruption to put the current moment in context.

• Using AI to get #1 on the NetHack leaderboard. @rez0__ published a post on building an AI agent to play NetHack competitively.

• The future of vulnerability research and bug bounty in an AI world. @impost0r_ published a personal take on where independent research and bug bounty are heading.

• I found a critical vulnerability and was paid $15,500. This write-up covers how a simple URL tweak exposed millions of private records, and what the process behind finding the bug looked like.

• Frontier class vulnerabilities: it gets worse before it maybe gets better. @infosec_au published a post on what is changing in the high-end vulnerability research space and what a realistic strategy looks like in response.

• More criticals, less dopamine. @dhakal_ananda published a personal reflection on finding more bugs than ever while enjoying it less, and what AI has changed about the experience of vulnerability research.

• Playing with DeepSeek-V4-Flash-0731 at the airport. @mrexodia shared some quick observations on the model's behavior under adversarial prompting.

• Executing arbitrary code via Google's own signed installer. @buffaloverflow published a post on Tag, You're Managed covering how signed Google Chrome installers can be abused to achieve arbitrary code execution.

• AI agents as an alternative to Frida for hardened mobile apps. @c3l3si4n shared a practical insight on moving away from Frida-based hooking toward AI agent workflows for apps that actively resist dynamic instrumentation.

• Multiple XSS vulnerabilities in Mailcow. @J0R1AN (Aikido) published a new article covering his recent findings in Mailcow, including an unauthenticated XSS and a Self-XSS escalated using a login/logout CSRF.

• How Burp AT helped expose whistleblower reports via a critical overlooked vulnerability. @Burp_Suite published a case study on a vulnerability that had gone undetected for years before being discovered with Burp AT.

• Blueprint to making $100K with Caido — a free bug bounty course. @NahamSec shared a free course put together with @amrelsagaei covering how to build a productive bug bounty workflow while using Caido.

Company news

DEF CON 34 and Hacker Summer Camp 2026 recap

What a week in Las Vegas. Hacker Summer Camp ran from August 3 to 9, and Intigriti was part of it across the full run.

We kicked things off at BSides Las Vegas with PortSwigger, then hosted PWN The Pot, a casino night at the Fontainebleau featuring poker, roulette, and a prize auction with some genuinely fun prizes on the line.

At Black Hat, we ran a spot-the-bug challenge at the PortSwigger booth. Solvers who whispered the password walked away with a limited-edition Intigriti Nike hat, and the lucky ones got their hands on a challenge coin.

We also attended Vulnerability Vibes to meet the community in a more relaxed setting, and hosted Hackers Unplugged at Play Playground with drinks, games, and time with our Program Managers.

DEF CON was the finish line. As proud platinum sponsors of the Bug Bounty Village, our team delivered four CFP talks, including "Hacking Human-in-the-Loop Systems" by @intidc. And a talk by Radu, Intigriti’s Senior Program Manager, who gave attendees the first public look at CrowdRecon.

Huge thanks to everyone who showed up. We hope to see you next year.

Read the full recap!

Intigriti at Hacker Summer Camp 2026

Vulnerability Vibes

The Vulnerability Vibes event was a good one. The conversations were fantastic, the poster got signed by some of the most talented hackers in the community, and meeting the people behind the handles in person is always worth it. Big thanks to the organizers and sponsors for putting it together.

Intigriti at Vulnerability Vibes 2026

HackGlasgow 2026

The Intigriti team were live at HackGlasgow 2026! We had a booth where you could meet the team, pick up some swag, and take on our CTF challenge. It was a great opportunity to connect with the local security community, and the energy in the room reflected that.

Intigriti at HackGlasgow 2026

Feedback & suggestions

Before you click away: Do you have feedback, or would you like your technical content to get featured in the next Bug Bytes issue? We want to hear from you. Feel free to send us an email at community@intigriti.com or DM us on X/Twitter, and we'll take it from there.

Did you like this Bug Bytes issue? Consider sharing it with your friends and tagging us along on X/Twitter, Instagram, or LinkedIn.

Wishing you a bountiful month ahead,

Keep on rocking!