PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

‘AI slop’ bug reports and outsourcing triage, OpenPGP.js signature-spoofing bug, race to combat zero-day exploits – OffSec roundup for CISOs

yeswehack.com | vulnerability | #ai-security | #bug-bounty | #zero-day | #ai-slop | #ciso | #vulnerability-triage | #openpgpjs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CISO roundup: the deluge of AI-generated 'slop' bug reports and calls to outsource triage, the OpenPGP.js signature-spoofing bug, and Google's analysis of zero-day exploitation trends.
Published
Collected

Related coverage

vulnerability · yeswehack.com
Critical signature-spoofing vulnerability in OpenPGP.js hits the headlines
CVE-2025-47934: Codean Labs researchers found a critical OpenPGP.js signature-spoofing flaw via YesWeHack's Bug Bounty program (€7,500 bounty), covering discovery, remediation and disclosure.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · hackerone.com
HackerOne’s In-Depth Approach to Vulnerability Triage and Validation
HackerOne describes its triage model: 45+ in-house analysts process 4,000+ reports weekly, assessing impact, deduplicating, and validating findings across web, mobile, API, and firmware assets.
vulnerability · bugcrowd.com
Bugcrowd Introduces a New, Intuitive Submission Search Bar
Bugcrowd added tokenized submission search and filtering to Crowdcontrol, responding to 67% year-over-year growth in vulnerability submissions and 73% growth in valid ones.
vulnerability · projectdiscovery.io
Introducing Neo Triage
On October 26, 2026 we're releasing Neo Triage, an autonomous engine for vulnerability triage. While other tools rank your backlog, Neo clears it.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Back