Tizen document comprehensive breakdown, release in few days on live device, with about 44 writeups on individual functionality. Live-tweeting notes findings were fun and agents will get more time.
Key points
Most comprehensive breakdown of some key concerns of Tizen seen run on a live device.
About 44 writeups on individual functionality.
Release probably happening in a few days.
Sources
PHP Attacks Update: AI attempts observed, no exploitation
PHP Attacks Update reports AI-generated PHP attempts against honeypot sensors last week, with no confirmed exploitation. Scans omit CVE-2026-109618/619 tagging because of a lack of reliable, safe large-scale methods.
Key points
Observed a lot of AI slop PHP attempts against honeypot sensors the last week
No confirmed exploitation
Refrained from CVE-2026-109618/619 tagging in scans
Lack of reliable, safe large scale methods
Sources
2026 Practical Bug Bounty Guide released
2026 Practical Bug Bounty Guide is a new opinionated methodology covering platform selection, recon workflow, manual Burp exploration, and phase-by-phase testing of XSS, SSTI, SQLi, IDOR, CSRF, SSRF, XXE, file upload, command injection, auth/session, business logic, GraphQL/OAuth/prototype pollution, WAF bypass, vuln chaining, and report writing. The guide is free, open source, and updated for 2026.
Key points
Guide includes a Mindset & Core Rules section with rules such as “PoC or GTFO” and “Know your enemy”.
Guide provides detailed Recon & Asset Discovery commands for subdomain enumeration, alive checks, visual recon, port scanning, directory discovery, JavaScript analysis, and Google/GitHub dorking.
Sources
- Original post
- SecurityTesting/Checklists/2026-bug-bounty-guide.md at master - Linked page
- thexssrat.podia.com - Linked in the post
Devolutions RDM switching to Azure Artifact Signing
Devolutions RDM is moving from an EV certificate to Azure Artifact Signing and will update pinning to check publisher ID and Microsoft Root CAs. The change affects how custom certificate pinning validates signatures.
Key points
Switching from an EV certificate to Azure Artifact Signing for Devolutions RDM
Updating custom certificate pinning to check publisher ID and Microsoft Root CAs instead of a list of thumbprints of EV certificates