Abhishek

Building @Vulncure ⚡ Better SaaS security shouldn't cost a fortune.

AI-powered vulnerability finding & code fixes from $49/mo ↓

waitlist open →

[Abhishek @aacle_]

Cybersecurity in one word ? For You 👇

[Abhishek @aacle_]

@NahamSec I think Delhi have more hackers though 🙌

[Abhishek @aacle_]

every group chat I'm in this week is the same three messages:

"did you see PHP2SHELL" "yeah" "are we affected" "…checking"

nobody's affected until the inventory says so. and nobody has an inventory 🚨

[Abhishek @aacle_]

Check if your site is secure against php2shell vulnerability ?

https://t.co/IQ3sfFqfQv

[Abhishek @aacle_]

php2shell EXPOSED publically before being patched Released

AI just found an unauthenticated RCE in PHP, a language running roughly 70% of websites.

The bug affects every version back to 5.4

Found by OPENSOURCE MODEL by the way 🚨

[H4x0r.DZ @h4x0r_dz]

Gitlab2shell 😂
New unauthenticated RCE affecting gitlab
Found by @joaxcar

[Luke Stephens (hakluke) @hakluke]

Are bug bounties dead in 2026?

Not even close. @simonkoeck just found an RCE in Google.

A Flask session cookie on https://t.co/qNoDdIoM01 was signed with a secret key, and that same key let him forge a session into deserializing a malicious pickle payload, straight to code execution across Google's dev sites.

Google paid him $90,000.

Bug bounties aren't dead. You just need the mindset to look for angles nobody else has checked yet.

I wrote a full guide on how to start (or come back to) bug bounties in 2026

Link below, plus Simon's write-up. 👇

[hexa @Labost909]

when my agents has gone crazy
@rez0__
blog:https://t.co/mdOxL8HSEp is always the perfect motivation to bring my mindset and to remind me of any mistake im doing. love you bro😀

[Abhishek @aacle_]

@tabaahi_ You'll probably not get the chance next year

[Abhishek @aacle_]

just came across this claude-kit by yeswehack 👀

the part i found interesting is how it handles things like IDOR, SSRF and race conditions when reviewing bug bounty reports.

it actually pushes back on claims you haven't proven instead of just helping you write a convincing report lol

especially the part about race conditions. multiple 200 responses don't necessarily mean the bug is real. you need to verify what actually changed.

might give this one a try 👇
https://t.co/UrZQ6d4cZB

[Abhishek @aacle_]

@rez0__ I'm not having that much expectation with this new model at all 🤔.

[Abhishek @aacle_]

hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer

I'm genuinely amazed by what Hackbot can do 🔥.

If you've trained your hackbot properly, it could easily handle 70% of your workflow, help you find more bugs, and let you submit more valid reports.

And we're still just getting started.

[Abhishek @aacle_]

A good hackbot isn't just about feeding it CVE data. It's about teaching it how to think and approach a hunt.

Give it your past bug bounty reports, your findings, and publicly available historical HackerOne reports. This helps the agent understand where bugs are actually found and what patterns to look for.

Then let it turn what it learns into reusable skills or .md files. Keep improving those skills by observing its testing and refining them day by day.

After a few weeks or months, the agent can perform much better than it did initially, and more of the work can be handled by your hackbot harness.

Also, keep testing your harness with different models. Understand which models perform better for which vulnerability types, where they struggle, and which ones give you the best results for less money.

That's a simple way to build, train, and continuously improve your own hackbot.

[flower nao @maple5124]

@aacle_ May I ask if you are directly using the relevant information of the historical CVE as prompt words to tell the agent? Or did you use skills or something like that?

[Abhishek @aacle_]

@opischillin It could be your own findings, or you can also pick it from the publicly available HackerOne reports. That's not too complicated.

[Abhishek @aacle_]

🧠 Using AI for bug bounty? These tips are worth a read.

Everyone is using the same frontier models for bug bounty now, which means generic prompts just put you in a race to the duplicate queue.

Things that gives you an edge is not the best model.

Because the model is accessible to everyone, the one thing that matters is the proprietary context and the past report data you feed into the harness to make them think better, find better vulnerabilities, and catch something different than duplicates.

[Marius du Preez @mdp_sec]

A few bypasses that keep working for me in hunts. There are huge lists out there, but these are my go-to checks:

1 - Edge vs. router path drift
/api;/v1/..., /admin/./, /API/..., or a trailing / on a 403. The proxy and the backend parse paths differently.

2- Fake static extensions
/api/users/123.photo or file.docx.pdf. WAFs and bot managers like DataDome often treat these as static media and wave them through.

3 - GraphQL comment prefix
#x\nmutation { ... } gets past gateways that regex-block anonymous mutations.

4 - Pre-MFA surface swap
Log in with the password, stop at the 2FA screen, then send that session to /graphql or /connect/token (grant_type=password). Not every endpoint checks that MFA finished.

5 - Case-varied JSON keys
suppliername write-blocked by RBAC? Send Suppliername. The authz check and the deserializer don't always agree.

6 - Null/empty OTP race
Request an OTP, then immediately verify with code: "" before the async DB write lands.

What's on your list? 👇

[Damian Strobel @damian_89_]

Rarely I post bug bounty tips anymore but this small gem is unknown to most ;)

[Simon @soeckly]

I got $90,000 for a RCE in Google.
https://t.co/cjm7ZaNMeq

[Abhishek @aacle_]

Mind-Blowing 🔥

[SuperBeetleGamer @Cayden_Liao]

Our AI found a bug that let anyone mint infinite XRP, with $94B at risk. It had been hiding in one of the most audited codebases in crypto for nearly a decade, and earned us the maximum $250K bounty.

Here's how it went unnoticed, and how we found it. https://t.co/m7rSD8mKS5