HAIJA INTEL REPORT

what a crazy chain here 🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX https:// tantosec.com/blog/2026/09/t elerik-padding-oracle-to-shell/ … The vulnerabilities described in this post were discovered, analysed, and exploited with

i had AI read all 1,520 bug bounty reports i've submitted since 2014 and told it not to protect my feelings. Three things i didn't want to hear: - the bugs that built my career don't exist anymore - my dupe rate went UP over 12 years - 685 of those reports never paid me a

Imagine getting into bug bounty or CTF now Imagine getting into infosec now… 🙃

Had to change some wording, some people thought this was malware written by the Israel government. This malware is masquerading as an Israel government domain to try to convince people to execute a goop (malware) payload.

I looked at this goop masquerading as the Israel government. I don't know anything about Israeli stuff, so maybe someone can provide context on what these Threat Actors are trying to achieve. > israel[.]gov[.]2026[.]vercel[.]app > domain still live, don't shoot yourself in the

Congratulations to @MercedesAMGF1 , Kimi Antonelli and @GeorgeRussell63 on a brilliant 1 - 2 finish at the Italian Grand Prix. The “Temple of Speed” delivered a fantastic backdrop for the Silver Arrows to lock out the top two steps of the podium! 🏆

I think too many people are just yoloing code without understanding what or how their vibe coding is doing/working. Sometimes you can get to A to Z by vibe coding. But oftentimes you're getting (A to F) + (N to Z) and the model is telling you it did A to Z. And you're not

This #LaborDay, we’re celebrating the hard work and dedication of people everywhere who help their teams and communities thrive. Wishing everyone a safe and relaxing holiday with family and friends!