![[tl;dr sec] #336 - Autonomous Vulnerability Hunting, GuardDog 3.0, Are Bug Bounties Cooked?](https://image.cybernoz.com/wp-content/uploads/2026/07/tldr-sec-336-Autonomous-Vulnerability-Hunting-GuardDog-30-Are-600x340.png)
[tl;dr sec] #336 – Autonomous Vulnerability Hunting, GuardDog 3.0, Are Bug Bounties Cooked?
Amurrica Day I love how peak America the 4th of July is, with tons of outdoor grilling, people wearing red, white, and blue, and of…
Category: Mix
Heading to Vegas? Meet PortSwigger at Black Hat, BSides, and DEF CON 34.
Fran Hutchings | Thursday, 9 July 2026 at 09:20 UTC PortSwigger is heading to Las Vegas for one of the biggest weeks in the cybersecurity…
Introducing Apex Discovery to secure every domain you actually own
Most tools will only test the domains you already know about. We’ve decided that’s not enough. TLDR: Detectify’s new Apex Discovery automatically identifies root domains…
Why traditional DAST Tools fail modern AppSec teams (and how to fix it)
For years, development and security practitioners have treated dynamic application security testing as a critical final safety check before code goes live. However, the external…
Why Don’t We Put Handguns in the Convenience Aisle?
A quick thought on this whole “control of AI models” debate. Handguns and Fentanyl are available all over the world, but we still don’t put…
Hacking An AI Children’s Toy: Remote Access to Every Conversation · Joseph Thacker
My neighbor texted me the other day and said she’d pre-ordered two AI toys for her kids that supposedly used an LLM to dynamically generate…
![[tl;dr sec] #335 - Prompt Injection as Role Confusion, PHP Ecosystem Security, New MCP Spec](https://image.cybernoz.com/wp-content/uploads/2026/07/tldr-sec-335-Prompt-Injection-as-Role-Confusion-PHP-600x340.png)
[tl;dr sec] #335 – Prompt Injection as Role Confusion, PHP Ecosystem Security, New MCP Spec
Wedding This past weekend I attended a friend’s wedding, and it was heartwarming. The couple have been together over a decade, and had many…
The Agentic Hacking Era: Ramblings and a Tool · Joseph Thacker
A few weeks ago I wrote about how AI is going to impact bug bounty. That post was mostly predictions. This one is about what’s…
Operation Floodlight · Joseph Thacker
I have been thinking about the downstream impacts of AI systems having strong cybersecurity capabilities. The United States has a lot of critical infrastructure that…
Launching: AI Safety For Parents · Joseph Thacker
I’ve always been a fan of levelsio. He’s a serial entrepreneur who has launched a bunch of SaaS and AI products, mostly in public, one…
Reconnaissance for exposure management. Why context matters in the AI era
Over the last few weeks, we’ve explored what AI is changing in security: discovery is faster (Vulnpocalypse now?), volume is higher (Common AI misconceptions debugged!),…
Exploiting insecure cookie policies | Intigriti
Cookies are one of the most fundamental building blocks of the modern web, and yet they are often overlooked from a security perspective. When misconfigured,…