Cybersecurity Blog
Bug bounty write-ups, penetration testing guides, and vulnerability research by Piyush Kumawat.
DevSecOps From Laptop to Production: A Practical Security Pipeline Guide
How software travels from a developer's editor to a live server - and where security checks sit along the way. Every tool…
The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
Your vulnerability scanner ran overnight. Your inbox has 47 new CVE alerts. Slack is pinging you about a "critical" flaw in a…
RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
Your support bot knows the refund policy. Your internal copilot cites the employee handbook. Your sales assistant pulls answers from a folder…
Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
Most secret scanners dump hundreds of high-entropy strings and leave you to guess which ones still work. That is a terrible way…
Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
Most teams still treat supply chain security like a compliance checkbox: generate an SBOM once a quarter, turn on Dependabot, call it…
I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
Hands-on OpenAI Codex Security CLI guide: scan a Flask shop API, get 14 findings, threat model, remediations, GitHub bulk-scan, and a real…
How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
Give me your company name and 24 hours. That is usually all it takes to go from knowing nothing about a startup…
Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
Most web bugs hit one victim at a time. Web cache poisoning is different, and that is exactly why it is worth…
Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
Ask any bug bounty hunter how 2026 is going and you will get one of two answers. Either "I have never found…
AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
Half the bug bounty writeups on my feed this week were not about a new vulnerability class - they were about a…
LLM Red Teaming in 2026: A Practical garak + PyRIT Workflow
You shipped an LLM feature. A support chatbot, a "summarize this document" button, an agent that can call tools. Now the obvious…
Indirect Prompt Injection in 2026: Hacking AI Through the Content It Reads
Most people picture prompt injection as someone typing "ignore your instructions" into a chatbot. That is the direct kind, and it is…
Hacking GraphQL APIs in 2026: Introspection, BOLA, and Batching Attacks
GraphQL is a gift to attackers. One endpoint, usually /graphql, that speaks a typed, self-describing language and will happily tell you every…
Actively Exploited CVEs in June 2026: A Practical Patch-Now Briefing (SimpleHelp, Citrix, ColdFusion, Defender)
June 2026 was a brutal month for anyone who runs internet-facing infrastructure. A run of critical, actively-exploited vulnerabilities landed one after another,…
IDOR Hunting in 2026: A Practical Playbook for Finding Broken Access Control
IDOR is the bug that pays rent for a lot of bug bounty hunters, and it is still the one developers ship…
MCP Server Security (2026): A Practical Pentester’s Testing Playbook
If you are running Cursor, Claude Desktop, Windsurf, or a home-grown agent stack in 2026, you almost certainly have MCP servers in…
From Prompts to AI Security Loops: A Practical Playbook
Most teams are still treating AI like a better prompt box. "Review this code for vulnerabilities." "Write a Sigma rule for this…
Bug Bounty Recon Workflow (2026): A Practical, Copy-Paste Playbook
A practical bug bounty recon workflow for 2026 - the exact commands for subdomains, live hosts, URLs, JS analysis and content discovery,…
AI Bug Bounty in 2026: How Hunters Use Claude Code and Automation to Find Bugs Faster
AI bug bounty in 2026: how hunters use Claude Code, Burp MCP and automation to find bugs faster, with honest accuracy numbers…
Agentjacking: How Attackers Hijack AI Coding Agents Like Cursor and Claude
Agentjacking lets attackers hijack AI coding agents like Cursor, Claude Code and Codex via poisoned error data. Here's how it works and…
AutoJack: How One Web Page Can Hijack Your AI Agent and Own Your Machine
Microsoft's AutoJack shows how a single malicious web page can hijack an AI agent and run code on your machine. Here's how…