What do you think would be the right response?🤔

To submit your answer, visit the link below: https://bugcod3.com/quiz

Your X links are snitching on you.

https://x.com/BugCod3/status/2115837807537299777

SubZer0 just passed 2,700+ visits 🔥

When I started SubZer0, I just wanted a simple place to see which CVEs actually matter and what to patch first. Seeing people come back to it every day honestly means a lot to me. Thank you 🤍

Now I want to build the next part with you 🫵

What's missing? What would make SubZer0 more useful for YOU?
A feature, a page, a tool, a small fix, anything🤔

📩 Send your idea straight to this channel's Direct Messages

I read every message, and the good ideas will be built into the site, with credit to you if you want it 🙌

🌐 iliya-bashrc.github.io/SubZer0
⚡️ @RootAccessClub

⚡ THE ART OF RECONNAISSANCE

Every successful Bug Bounty hunt starts with one essential skill: Reconnaissance.

Finding vulnerabilities isn't always about having the most advanced tools. It's about understanding the target, discovering its attack surface, and knowing where to look.

We've published a new article covering:

🔹 Passive vs. Active Reconnaissance
🔹 Essential Recon Tools
🔹 Building an Effective Recon Workflow
🔹 Attack Surface Discovery
🔹 Common Recon Mistakes
🔹 The Future of Reconnaissance

Whether you're starting your Bug Bounty journey or looking to improve your methodology, this guide is worth exploring.

📖 Read the full article:
🔗 https://bugcod3.com/p/art-of-reconnaissance?utm_campaign=telegram

━━━━━━━━━━━━━━━━━━

BugCod3 — From Shadows To Shells.

🌐 https://bugcod3.com

OpenSSH flaw lets attackers log into password-disabled Linux accounts

📰 Reading:
https://bugcod3.com/news?tag=linux

Wraith is out: BugCod3's toolkit for the AI attack surface.

Your agent reads every MCP tool description with the same authority as your prompt.
Nobody reviews that text. One sentence is enough to make the model read ~/.aws/credentials and send it out. No exploit, no auth, no click.
What it finds:

⚡️ hidden instructions aimed at the model
⚡️ invisible unicode, decoded to plaintext
⚡️ credential paths and exfil sinks
⚡️ "read-only" tools that take a path
⚡️ lying annotations: readOnlyHint on a tool that deletes accounts
⚡️ definition drift after review

Evidence bundle + report with CVSS, CWE and a replayable curl.

Zero dependencies, MIT.

pipx install git+https://github.com/MRvirusIR/wraith
wraith demo

Full writeup: bugcod3.com/p/wraith
Repo: github.com/MRvirusIR/wraith

#BugBounty #MCP #AIAgents
━━━━━━━━━━━━━━━━━━

BugCod3 — From Shadows To Shells.

🌐 https://bugcod3.com

🚨 When a WordPress update becomes an attack window

What if the few seconds spent updating your website were enough to expose it to an attacker?

CVE-2026-119977 is a race condition in WordPress Core that can lead to unauthenticated remote code execution under specific conditions. CISA has confirmed active exploitation. [^https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog]

In our latest BugCod3 write-up, we break down:

🔍 How the vulnerability works
🎯 What conditions an attacker needs
🛡 Which versions are patched and how to investigate suspicious activity
🧠 What bug bounty hunters can learn from this attack surface

📖 Read the full write-up:
https://bugcod3.com/p/wordpress-cve-2026-119977-update-rce

Know someone who manages a WordPress site? Share this with them.

#WordPress #CVE #BugBounty #CyberSecurity #RCE

━━━━━━━━━━━━━━━━━━

BugCod3 — From Shadows To Shells.

🌐 https://bugcod3.com

Most AI bug bounty reports fail for one reason:

They confuse a possible vulnerability with proven impact.

📰 Read:
https://x.com/BugCod3/status/2119473099640910296

🌐 BugCod3.com