The Bugs AI Still Can’t Find: What Will Make You a Valuable Bug Hunter in 2026

Every few months someone posts a screenshot of an AI tool finding an XSS in thirty seconds, and the bug bounty community has a small panic…Continue reading on Medium »
Read more...

systeminformer v4.0.26241.138

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management. Portable and free.
Read more...

MHDDoS v2.4.5

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 56 Methods
Read more...

Smali By bithowl: Chapter 8 Methods and Fields

(“The Memory and Machinery Inside Every Android Class”)Continue reading on Medium »
Read more...

8 Months of Learning, 4 Months of Hunting, 0 Bugs — Here’s What Actually Went Wrong
https://medium.com/@rajnamdev/8-months-of-learning-4-months-of-hunting-0-bugs-heres-what-actually-went-wrong-898628c62438?source=rss------bug_bounty-5

The stuck-at-zero year is common, documented, and mostly misdiagnosed. The evidence points at where you hunt — not how well.Continue reading on Medium » (https://medium.com/@rajnamdev/8-months-of-learning-4-months-of-hunting-0-bugs-heres-what-actually-went-wrong-898628c62438?source=rss------bug_bounty-5)

New CTF: Format of Doom - Pentester vs AI Challenge 2
https://www.reddit.com/r/redteamsec/comments/1vxwg9u/new_ctf_format_of_doom_pentester_vs_ai_challenge_2/

<!-- SC_OFF -->Hi all! My company Escape just released a new CTF called Format of Doom (https://pentester-vs-ai-game.com/) which I thought you might be interested in trying. The theme of the CTF is to see if you can pentest faster and how you pentest differently to an AI engine in a classic human vs AI challenge. This challenge is a white-box engagement on a vulnerable web app Duck Store. You're looking for something they never handed over and are focusing on their email feature. Give it a try and let me know what you think! The challenge is live for two weeks and then we reveal the AI's solve and the top solves from the leaderboard. Happy playing : ) <!-- SC_ON --> submitted by /u/PriorPuzzleheaded880 (https://www.reddit.com/user/PriorPuzzleheaded880)
[link] (https://pentester-vs-ai-game.com/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vxwg9u/new_ctf_format_of_doom_pentester_vs_ai_challenge_2/)

SpecterOps Kubernetes for Red Teamers lab on KVM/libvirt
https://www.reddit.com/r/redteamsec/comments/1vxyowc/specterops_kubernetes_for_red_teamers_lab_on/

<!-- SC_OFF -->Had a look through SpecterOps' Kubernetes for Red Teamers course and ended up patching the lab to run on KVM/libvirt instead of VirtualBox. Dropping it here in case anyone else on Linux wants the same setup. <!-- SC_ON --> submitted by /u/blahmemeblah (https://www.reddit.com/user/blahmemeblah)
[link] (https://github.com/GregDurys/specterops-k8s-red-teamers-libvirt-patch) [comments] (https://www.reddit.com/r/redteamsec/comments/1vxyowc/specterops_kubernetes_for_red_teamers_lab_on/)

AI safety & security redteaming
https://www.reddit.com/r/redteamsec/comments/1vy5qjm/ai_safety_security_redteaming/

<!-- SC_OFF -->Most redteaming solutions for AI applications are focused on pure security aspects but application owners are putting behavior safeguards and want to validate those besides the security safeguards. The cyber professionals want to test not just the AI stack but any of the exposed API layers. These were some of the common pieces of feedback I heard to help design a solution from the ground up for these needs. We just announced a major release of our OSS repo at https://github.com/NuGuardAI/nuguard Supports wide-range of languages: JS/TS, Python, C#, Golang, K8s/cloud manifest files. 10+ agentic frameworks, data stores, guardrails, etc. Looking forward to your reviews and feedback. Give us a star if you like the toolkit. <!-- SC_ON --> submitted by /u/3Pointers (https://www.reddit.com/user/3Pointers)
[link] (https://github.com/NuGuardAI/nuguard) [comments] (https://www.reddit.com/r/redteamsec/comments/1vy5qjm/ai_safety_security_redteaming/)

I made a Cyberpunk 2077-inspired theme for Adaptix C2
https://www.reddit.com/r/redteamsec/comments/1vy83iu/i_made_a_cyberpunk_2077inspired_theme_for_adaptix/

<!-- SC_OFF -->I’ve been playing around with Adaptix C2 and decided its interface needed a bit more neon. So I made a Cyberpunk 2077-inspired theme for it. It includes custom themes for both the main UI and console. The basic setup only requires importing two JSON files. I also added instructions for applying a custom background if you want the full look. <!-- SC_ON --> submitted by /u/alfabuster (https://www.reddit.com/user/alfabuster)
[link] (https://github.com/alfabuster/Adaptix-C2-Cyberpunk-Theme) [comments] (https://www.reddit.com/r/redteamsec/comments/1vy83iu/i_made_a_cyberpunk_2077inspired_theme_for_adaptix/)

Unauthenticated remote uninstall in my own EDR agent, and the four other auth bugs that turned out to be the same bug
https://www.reddit.com/r/redteamsec/comments/1vy9rwy/unauthenticated_remote_uninstall_in_my_own_edr/

submitted by /u/RevolutionaryPie4948 (https://www.reddit.com/user/RevolutionaryPie4948)
[link] (https://d3vhex.github.io/2026-08-25-unauthenticated-remote-uninstall/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vy9rwy/unauthenticated_remote_uninstall_in_my_own_edr/)

MmMapIoSpace Returns NULL: Tracing the Real Kernel Mechanism Through ntoskrnl
https://www.reddit.com/r/redteamsec/comments/1vyt58m/mmmapiospace_returns_null_tracing_the_real_kernel/

submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/articles/mmmapiospace-returns-null-tracing-the-real-kernel-mechanism-through-ntoskrnlexe/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vyt58m/mmmapiospace_returns_null_tracing_the_real_kernel/)

Real-world tradecraft from a recovered intrusion set against a Phillipine Nuclear Agency: forged ownCloud pre-signed URLs, custom MT19937 exploit, low-and-slow exfil
https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/

<!-- SC_OFF -->The Hunt.io (http://hunt.io/) research team recovered an operator's full open directory, useful as a look at how someone actually chained known bugs in the field. ownCloud CVE-2023-49105: five Python scripts forging pre-signed WebDAV URLs off an empty PBKDF2 salt. OC-Credential set to the impersonated account, GET against /remote.php/dav/files//, no creds needed. The fifth script adds PROPFIND Depth: 1 enumeration to reach folders not known in advance. Low-and-slow exfil: randomized time.sleep(random.uniform(3, 6)) between requests, tightened to 1.5 to 3.5 in one script, to dodge volumetric detection. CVE-2024-28000 (LiteSpeed Cache): a Go build reimplementing MT19937 with PHP mt_rand() parity, self-tested against 11 seed/output pairs, 30 workers across a 0 to 999,999 seed range. Landed on seed 311787 and created an admin account via the REST API. Fallback path: XML-RPC brute force with rockyou.txt against the same site, successful independently. Staged frameworks: Sliver, Metasploit, Mettle, plus a custom stage-1 ELF loader pulling a Mettle stage-2. Full breakdown and IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor <!-- SC_ON --> submitted by /u/Straight-Practice-99 (https://www.reddit.com/user/Straight-Practice-99)
[link] (https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor) [comments] (https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/)

The Authorization Check That Only Fired When You Asked It To

A payment-processor IDOR, a timing oracle, and how a hunting harness turned one weak signal into a criticalContinue reading on Medium »
Read more...

How I Got My First Bounty After a Year of Hunting

So, hello everyone! My name is Pranav Patil. I’m a security researcher and, like many of you reading this, I’m also on the bug bounty…Continue reading on Medium »
Read more...

The Offensive Security & Bug Bounty Stack I Built for Myself — Now Free for Everyone

A walkthrough of OpenSwarm’s 12-phase autonomous security pipeline — from scoping and recon to vulnerability hunting, exploitation…Continue reading on Medium »
Read more...

Reverse Engineering Windows Security Center
https://www.reddit.com/r/redteamsec/comments/1vzm0x7/reverse_engineering_windows_security_center/

submitted by /u/ObligationLucky842 (https://www.reddit.com/user/ObligationLucky842)
[link] (https://github.com/NirvanaOn/OWN-Defender) [comments] (https://www.reddit.com/r/redteamsec/comments/1vzm0x7/reverse_engineering_windows_security_center/)

$$$ I Tried a Simple Registration Endpoint… and Accidentally Found a Critical Admin Account…

No login. No authorization. One API request. And suddenly… I had an administrator account.Continue reading on Medium »
Read more...

From an OTP Race Condition to Zero-Interaction Account Takeover

DisclaimerContinue reading on Medium »
Read more...

15 Access Control Mistakes Developers Keep Making: Master Real-World Application Security

Ever found yourself staring down a “bypass” bug report and thinking, “How did we miss this?”Continue reading on Medium »
Read more...