Piyush Kumawat
Posts from Security Cipher.
Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
Most web bugs hit one victim at a time. Web cache poisoning is different, and that is exactly why it is worth…
Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
Ask any bug bounty hunter how 2026 is going and you will get one of two answers. Either “I have never found…
AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
Half the bug bounty writeups on my feed this week were not about a new vulnerability class – they were about a…
LLM Red Teaming in 2026: A Practical garak + PyRIT Workflow
You shipped an LLM feature. A support chatbot, a “summarize this document” button, an agent that can call tools. Now the obvious…
Indirect Prompt Injection in 2026: Hacking AI Through the Content It Reads
Most people picture prompt injection as someone typing “ignore your instructions” into a chatbot. That is the direct kind, and it is…
Hacking GraphQL APIs in 2026: Introspection, BOLA, and Batching Attacks
GraphQL is a gift to attackers. One endpoint, usually /graphql, that speaks a typed, self-describing language and will happily tell you every…
Actively Exploited CVEs in June 2026: A Practical Patch-Now Briefing (SimpleHelp, Citrix, ColdFusion, Defender)
June 2026 was a brutal month for anyone who runs internet-facing infrastructure. A run of critical, actively-exploited vulnerabilities landed one after another,…
IDOR Hunting in 2026: A Practical Playbook for Finding Broken Access Control
IDOR is the bug that pays rent for a lot of bug bounty hunters, and it is still the one developers ship…
MCP Server Security (2026): A Practical Pentester’s Testing Playbook
If you are running Cursor, Claude Desktop, Windsurf, or a home-grown agent stack in 2026, you almost certainly have MCP servers in…
From Prompts to AI Security Loops: A Practical Playbook
Most teams are still treating AI like a better prompt box. "Review this code for vulnerabilities." "Write a Sigma rule for this…