7 Aug 2026, 10:51 UTC215 views2 reactionsread 7 August 2026 Photo
0.25 XMR Monero Bug Bounty 🤑
relay_tx wallet-rpc skips --restricted-rpc guard and lets any caller corrupt wallet state via attacker-controlled pending_tx by Beni Saprulah 🤯🔥
👨💻 Beni Saprulah (h1/benisprlh)
🔗 https://hackerone.com/reports/3687543
🔗 https://github.com/monero-project/monero/pull/10434
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
🔥2
7 Aug 2026, 10:00 UTC260 views3 reactionsread 7 August 2026 Photo
From Deep Link to Shell: Easy $3000 Android Crits by tinopreter 🤯🔥
👨💻 cTino (x/tinopreter)
🔗 https://medium.com/the-first-digit/from-deep-link-to-shell-easy-3000-android-crits-866f2a002a3c
🔥2😱1
31 Jul 2026, 13:25 UTC739 views7 reactionsread 7 August 2026 Photo
$1,500 AI System Prompt Leak: Using this Burp Suite Configuration by cTino 🤯🔥
👨💻 cTino(x/tinopreter)
🔗 https://medium.com/@tinopreter/1-500-ai-system-prompt-leak-using-this-burp-suite-configuration-e1cb6ab27dc5
🔥5❤2
31 Jul 2026, 11:06 UTC724 views2 reactionsread 7 August 2026 Photo
Enumerable Lead ID Exposes Millions of Car-Buyer Records and Lets Anyone Overwrite Their Contact Details by Marius du Preez 🤯🔥
👨💻 Marius du Preez (mdpsec.com)
🔗 https://mdpsec.com/reports/auto-lead-platform-enumerable-id-unauth-idor-pii/
🔥2
31 Jul 2026, 01:51 UTC776 views8 reactionsread 7 August 2026 Photo
$42,751 Ubiquiti Inc. Bug Bounty 🤑
Pre-Auth RCE in UniFi OS - CVE-2026-34909: One Request to Root Behind Seven Products by Catchify Security 🤯🔥
👨💻 Abdulaziz Almadhi (Catchify Security)
🔗 https://www.catchify.sa/post/pre-auth-rce-unifi-os-one-request-to-root
CVEs
🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-34909
🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-50747
🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-50748
🤯4😱2👍1🔥1
30 Jul 2026, 14:02 UTC742 views5 reactionsread 7 August 2026 Video
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years 🤯🔥
👨💻 Nebula Security
🔗 https://nebusec.ai/research/ionstack-part-2/
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
🔥5
27 Jul 2026, 07:28 UTC≈1,050 views4 reactionsread 7 August 2026 Photo
"How I Found Open-Source 0-days with an LLM Multi-Agent Workflow" by Hyunseo Shin 🤯🔥
👨💻 Hyunseo Shin (se1en)
🔗 https://blog.cykor.kr/2026/02/How-I-Found-Open-Source-0-days-with-an-LLM-Multi-Agent-Workflow
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
❤2👍2
26 Jul 2026, 04:47 UTC≈1,020 views4 reactionsread 7 August 2026 Photo
0.5 XMR (175 USD) Monero Bug Bounty 🤑
ZMQ RPC Log Injection and Untrusted Payload Persistence by redlobsterz 🤯🔥
👨💻 redlobsterz (h1/redlobsterzzz)
🔗 https://hackerone.com/reports/3621606
🔗 https://github.com/monero-project/monero/pull/10388
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
❤2🔥2
22 Jul 2026, 11:39 UTC≈1,290 views4 reactionsread 7 August 2026 Photo
$1,337 8x8 Bug Bounty 🤑
connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability by Ferreira 🤯🔥
👨💻 Kauã Ferreira (x/0xkyotozx)
🔗 https://hackerone.com/reports/3800870
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
🔥3❤1
21 Jul 2026, 13:02 UTC≈1,250 views1 reactionsread 7 August 2026 Photo
Bypassing LFI (Local File Inclusion) by Yadav 👾💥
👨💻 Abhishek Yadav (x/abhishekY495)
🔗 https://medium.com/@abhishekY495/bypassing-lfi-local-file-inclusion-ebf4274e7027
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
❤1
19 Jul 2026, 15:17 UTC≈1,250 views6 reactionsread 7 August 2026 Photo
$1,600 Shopify Bug Bounty 🤑
Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering by saltymermaid 🤯🔥
👨💻 saltymermaid
🔗 https://hackerone.com/reports/2509022
🔗 https://t.me/ZeroToBug
🔗 https://whatsapp.com/channel/0029VbCTM6RDp2QAFE8r140p
🔥5❤1
19 Jul 2026, 15:10 UTC≈1,150 views3 reactionsread 7 August 2026 Photo
PoC:
[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core 👾💥
- https://github.com/0xsha/wp2shell
- https://github.com/Icex0/wp2shell-poc
- https://github.com/sergiointel/wp2shell-poc
- https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
- https://nvd.nist.gov/vuln/detail/CVE-2026-60137
- https://nvd.nist.gov/vuln/detail/CVE-2026-63030
❤2👍1
Showing the 12 most recent of 18 posts we hold for @ZeroToBug. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.