Cybersecurity Blog
Bug bounty write-ups, penetration testing guides, and vulnerability research by Piyush Kumawat.
Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
Most web bugs hit one victim at a time. Web cache poisoning is different, and that is exactly why it is worth…
Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
Ask any bug bounty hunter how 2026 is going and you will get one of two answers. Either “I have never found…
AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
Half the bug bounty writeups on my feed this week were not about a new vulnerability class – they were about a…
LLM Red Teaming in 2026: A Practical garak + PyRIT Workflow
You shipped an LLM feature. A support chatbot, a “summarize this document” button, an agent that can call tools. Now the obvious…
Indirect Prompt Injection in 2026: Hacking AI Through the Content It Reads
Most people picture prompt injection as someone typing “ignore your instructions” into a chatbot. That is the direct kind, and it is…
Hacking GraphQL APIs in 2026: Introspection, BOLA, and Batching Attacks
GraphQL is a gift to attackers. One endpoint, usually /graphql, that speaks a typed, self-describing language and will happily tell you every…
Actively Exploited CVEs in June 2026: A Practical Patch-Now Briefing (SimpleHelp, Citrix, ColdFusion, Defender)
June 2026 was a brutal month for anyone who runs internet-facing infrastructure. A run of critical, actively-exploited vulnerabilities landed one after another,…
IDOR Hunting in 2026: A Practical Playbook for Finding Broken Access Control
IDOR is the bug that pays rent for a lot of bug bounty hunters, and it is still the one developers ship…
MCP Server Security (2026): A Practical Pentester’s Testing Playbook
If you are running Cursor, Claude Desktop, Windsurf, or a home-grown agent stack in 2026, you almost certainly have MCP servers in…
From Prompts to AI Security Loops: A Practical Playbook
Most teams are still treating AI like a better prompt box. "Review this code for vulnerabilities." "Write a Sigma rule for this…
Bug Bounty Recon Workflow (2026): A Practical, Copy-Paste Playbook
A practical bug bounty recon workflow for 2026 - the exact commands for subdomains, live hosts, URLs, JS analysis and content discovery,…
AI Bug Bounty in 2026: How Hunters Use Claude Code and Automation to Find Bugs Faster
AI bug bounty in 2026: how hunters use Claude Code, Burp MCP and automation to find bugs faster, with honest accuracy numbers…
Agentjacking: How Attackers Hijack AI Coding Agents Like Cursor and Claude
Agentjacking lets attackers hijack AI coding agents like Cursor, Claude Code and Codex via poisoned error data. Here's how it works and…
AutoJack: How One Web Page Can Hijack Your AI Agent and Own Your Machine
Microsoft's AutoJack shows how a single malicious web page can hijack an AI agent and run code on your machine. Here's how…
🛠️ Reconnaissance and Vulnerability Scanning Script🛡️
In the fast-paced world of cybersecurity, staying ahead of potential threats requires thorough reconnaissance and vulnerability assessments. This blog post introduces you…
LLM Agents can Autonomously Hack Websites ?
Based on the research paper (https://arxiv.org/pdf/2402.06664.pdf), the study delves into the autonomous hacking capabilities of Large Language Models (LLMs), particularly focusing on…
$600 Simple MFA Bypass – Graphql
Welcome to my blog! In this post, I’ll delve into my recent security testing adventure focusing on multi-factor authentication (MFA) implementation in…
Exploring Application Security with SAST, DAST, SCA, and IAST
Welcome to today’s blog, where we’ll explore the world of software security testing. In an era where cyber threats are on the…
Top Recon Tools for Bug Bounty Hunters
In this blog, we explore top-tier reconnaissance tools that empower bug bounty hunters. From Shodan’s IoT device insights to Waymore’s web application…
Mastering WordPress Penetration Testing: A Step-by-Step Guide
In this comprehensive guide, we’ll explore various aspects of WordPress penetration testing. Starting with gathering information using tools like Wappalyzer and WPintel.…
Enhance WordPress Security: Comprehensive Guide
In this guide, we’ll unravel the crucial aspects of WordPress security, from user access management and update strategies to SSL implementation and…