HAIJA INTEL REPORT

We've launched a new @WebSecAcademy topic on exploiting AI-powered security scanners! Learn how to use indirect prompt injection to steal data, cause damage & trigger exploit chains!

Who the fuck is still hosting his bug bounty program on HackerOne? i went to http:// clickup.com. opened the page source. found a hardcoded API key in the javascript. copied it. sent one GET request. got back 959 email addresses and 3,165 internal feature flags. employees from Ho

We're about to release an open source recon tool on GitHub. Try to get the most URLs out of its testbed with your recon methods (in the shortest time possible) and let us know in the comments. https:// recon.brutelogic.net

A red team is only as strong as its ability to think like the threats you’re actually up against. Bugcrowd’s RTaaS brings crowdsourced specialization to your unique attack surface, helping uncover deeper weaknesses and validate defenses beyond static testing. If you’re

ICYMI @_Mayyhem & Javier Azofra Ovejero shipped MSSQLHound in Go. Same lab, 17 min → under 17 sec Cross-platform, SOCKS, Kerberos/NT hash auth, + 37 BloodHound edges with pathfinding. If MSSQL isn't in your attack paths yet, it should be.

ProjectDiscovery @pdiscoveryio · Apr 27 projectdiscovery.io Benchmarking Neo's Black-Box DAST Capabilities - ProjectDiscovery Blog Since the launch of Neo, we've been steadily expanding what it can do. Neo has found 33+ real CVEs across open-source projects, performed well on whi

The rush to adopt AI is creating more connections, more identities, and more potential attack paths. @ne0nd0g joined Risky Business to talk through what that means for red teaming & why the fundamentals matter more than ever. : https:// risky.biz/SOAPBOX106/

"The Claude project transcripts under the /bissascanner/ project show the operator using Claude Code to read the scanner codebase, understand lease and acknowledgement flow, troubleshoot misses, review benchmark output, and document the project well enough to rebuild parts of the

New from @Sysdig Threat Research: CVE-2026-42208 is a critical pre-auth SQL injection in LiteLLM, an open-source gateway for OpenAI, Anthropic, and more. It was a very targeted AI attack: • Direct access to API keys, provider creds, env configs • Clear schema awareness

72 hours remain before the session. Join GTIG Chief Analyst John Hultquist and Mandiant Principal Consultant Omar ElAhdan to explore how security teams are adapting to faster exploitation timelines and AI-enabled threats. Register now → https:// bit.ly/4u76P4g

During tax season I got a notification that my tax documents are ready, from... uh... Zoom Phishing email leveraging their legitimate document sharing functionality, pointing to a link and a domain that _looks like_ an IRS website, but, infects your computer. Video link below:

We often chase what’s new(or can hype): triaging the latest threats, pushing quick analysis, applying mitigations, and moving on. In that cycle, it’s easy to overlook the value of continuity and historical context in ongoing campaigns. This research from @vkamluk is a good

God now I REALLY want a Framework laptop :/ Those Pro's look awesome!