lean

SR @cantinasecurity | bug bounty | CTF | web2

[Hari @hrkrshnn]

The state of the cyber capabilities.

It's possible to build an exploit factory today, i.e., a system that goes from a website to an exploit in a few hours.

We've built this and earned over a million dollars from our disclosures from to bug bounty programs. We're currently #1 on the HackerOne US Business leaderboard for 2026! (live link below for you to check)

The unit economics are falling, and it's already hitting close to $1 per website.

Unfortunately, no security product out there is ready to defend against these attacks today. They need to be built.

The best thing to do today is to have agents attack yourself and fix all the ways they find to breach you. This makes hacking you expensive for other agents.

For most organizations, making the cost of hacking greater than $10,000 in tokens is enough to stay safe for the next few months.

We're working on making a lightweight version of our product free for a large number of companies so they can stay safe (the same one that earned a million dollars in bounties).

If you want to get a taste of it, fill in your website and email, and we'll send you security disclosures that need to be urgently fixed for free.

Links below

[lean @leangotroot]

@LiveOverflow @ECSC_openECSC telepwn was peak

[lean @leangotroot]

@S1r1u5_ Hi

[ckrielle @ckrielle]

It was always a dream to travel beyond Europe for a CTF. Thanks to #SCAN2026 and #KBW for the opportunity to experience this in Seoul. Even in the AI era, the CTF was enjoyable! Cheers to all our competitors, and especially to my awesome teammates @Jiri123_eth @leangotroot

[Cantina 🪐 @cantinasecurity]

today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.

we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.

how we built it: https://t.co/sSIV6qKFGt

[Cantina 🪐 @cantinasecurity]

we’re building security intelligence that compounds through shared context and memory.

what does this actually mean? imagine you’re conducting a security investigation about an unauthorized login to an account that has privileges to approve payments on behalf of a company. it looks like it’s being done from 2 locations.

you have a suspicion a VPN was involved, although you also don’t know if it’s possible someone is using the account somewhere other than that VPN. you need to dig into what’s going on which would take hours or even days of manual work to find.

knowing security means knowing how things work at your company: which systems connect, what a user can access, what the team learned last time.

we're introducing The Brain: shared context and memory for Cantina's agents.

it connects identities, devices, code and cloud infrastructure with operating knowledge and past investigations. agents can follow those connections and retrieve what earlier work uncovered.

so a repository comes with the services it supports. a suspicious IP comes with its investigation history. and your agents have more to go on when the next alert fires.

check how it works: https://t.co/7W7gAZC2Y4

[Cantina 🪐 @cantinasecurity]

we will be giving away a limited amount of Apex credits for people to run a free vulnerability scan on a code base!

this offer will only be available for 24 hours. register in the link below.

https://t.co/HZA3AqoAiC

[Cantina 🪐 @cantinasecurity]

our autonomous pentesting agent wanted to go on vacation, so it found a business logic flaw in a massive online travel agency that allowed real supplier bookings to go through even when payments failed.

it first rented a car.
then it booked a hotel.
and then it asked the car to be delivered to the hotel.

bad apex, agents don't take vacation!

[lean @leangotroot]

@_jensec Also forgetting that AI creates a lot of bugs too! A lot of times there is not that much bandwidth in internal security bugs to handle the entirety of a scopes surface

[lean @leangotroot]

@Dantxlian_ @crypt_3n How did it work?

[Jiri123 🪐 @Jiri123_eth]

This is how to lose $50 in 4 minutes.

[lean @leangotroot]

@sahuang97 Finals will be finished in 10 minutes

[lean @leangotroot]

@joaxcar Your crappy blog has minimal dependencies hence it requires 0 friction to auto update, organisations run heavily customised wp instances dependent on lots of functionality that can make it non trivial to update + the human factor leaves a gap for exploitation by bad actors

[lean @leangotroot]

@busf4ctor And “remember this device” will never work

[ckrielle @ckrielle]

Continuing the streak of i0rs posts, we have another one by @__connar who investigated Speakeasy by @Mandiant and put together some bypasses for the framework. If you have seen Speakeasy deployed in the wild or are interested in its internals, check it out https://t.co/1hjB9EEl2F

[lean @leangotroot]

@anzuukino2802 @h0mbre_ You’re not the only one if it makes it better

[ckrielle @ckrielle]

Another i0rs post, this time from @0x3dward who takes it upon himself to write a POC for a recently discovered heap buffer overflow in PostgreSQL's pgcrypto leading to RCE, originally discovered by team @xint_official. Enjoy🤘🔥

https://t.co/EN9ICFv7jM

[ckrielle @ckrielle]

New i0rs post, this time from @freysolareye going into an SSRF vulnerability he found in @roundcube which gives attackers data exfiltration on the victim. An interesting read for red teamers before going into their next assessment👀 https://t.co/u4Hj0Pgr2m

[lean @leangotroot]

@Tetraslam CTFs

[lean @leangotroot]

@MaitaiThe Is this v8, if so which component?