0.76
not a bad return on a 1 month Claude code max sub Confirmed! @chompie1337 of IBM X-Force Offensive Research (XOR) used a single bug to exploit NV Container Toolkit, earning $50,000 and 5 Master of Pwn points. #Pwn2Own #P2OBerlin
Official intelligence summary
HAIJA INTEL REPORT
Generated 15/05/2026, 09:12. Pipeline: Europe/Belgrade. Regular sources favor exploit, blog, red-team, and attack-path content. CVE items only stay with exploit signal.
Total items15
Regular sources6
Tweets / X9
Threshold0.62
You can save this report in your browser with the favorite button. If you need a shared favorite list, use the CLI helper.
Tweets / X
9 items0.68
Amaze! Amaze! Amaze! @orange_8361 of DEVCORE Research Team was able to exploit Edge with a sandbox escape! If confirmed, we wins $175K. He's off to the disclosure room to explain how he did it. #Pwn2Own #P2OBerlin
0.60
Claude helped me with this bug too but in a different way... Tried to gaslight me saying it wasn’t ~exploitable in practice~ and I got obsessed with proving it wrong Confirmed! @chompie1337 of IBM X-Force Offensive Research (XOR) used a race condition to escalate privileges on Re
0.46
AI-pentest companies get significant marketing value from publishing findings attributed to their products. In The HTTP Terminator, I’ll include the other side - the techniques and breakthroughs that AI consistently fumbles. security research now has this weird incentive where fi
0.46
That's my chain - a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17
0.42
New DFIR Labs case drops this weekend! ClickFix → RomComRAT → Domain Compromise (Private Case #35646) Hard | 30 Qs + 5 bonus Nine-day op: fake CAPTCHA lure, custom RAT implants, credential theft, mass exfil. New Splunk + Elastic dashboards included. Launch
0.34
Always good to hear about people having fun triggering race conditions with the single-packet attack! Recently performed a Pentest of a hybrid perp DEX. Found several issues, but one critical stood out: a race condition in the close-position logic that turned a 100 USDT position
0.32
In Episode 5 of Hacktics and Telemetry, @fulmetalpackets & @_CryptoCat talk zero-click XSS vulns (featuring @J0R1AN ), bug bounty updates, Copyfail, and @metasploit 's new MCP server Full video on YouTube: https:// r-7.co/49wOqG9 Audio on Spotify: https:// r-7.co/436KHLS
0.31
vx-underground @vxunderground · 11h Quote b0t @bot59751939 · 15h Article Apache Shiro RCE 0day on default config Hi everyone, This is a one off article with what appears to me to be a 0day for Apache Shiro, which is an authentication platform. Though this works, I would say it do
Regular sources
6 itemsMaximum Severity Cisco SD-WAN Bug Exploited in the Wild
This is the second time this year a threat actor has leveraged a CVSS 10.0 vulnerability in Cisco's network control system.
18-year-old NGINX vulnerability allows DoS, potential RCE
An 18-year-old flaw in the NGINX open-source web server, discovered using an autonomous scanning system, can be exploited for denial of service and, under certain condit…
When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps
Exposed UIs, weak authentication, and risky defaults could turn cloud-native AI apps on Kubernetes into potential targets by threat actors. Learn how exploitable misconf…
Re: Linux kernel LPE ("fragnesia", copyfail 3.0)
Posted by Jan Schaumann on May 13 Solar Designer wrote: https://github.com/v12-security/pocs/tree/main/fragnesia https://lists.openwall.net/netdev/2026/05/13/79, so Linu… | Posted by Salvatore Bonaccorso on May 14 Hi, https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/ for review https://lore.kernel.org/netdev/agW4vC0r8QOUKtRT@v4bel…
[vim-security] Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename affects Vim < 9.2.480
Posted by Christian Brabandt on May 14 Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename affects Vim < 9.2.480 =====================================…
Siemens gWAP
View CSAF Summary Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namel…