I analyze thousands of bug bounty content items every month. Less than 5% makes it to the newsletter. I distilled those curated selections down to the top 25 resources for 2026 and put them in this PDF. It includes the top platforms, tools, and people that consistently deliver high signal content. Comment RESOURCES and I'll DM you the PDF for free. (Make sure your DMs are open) #BugBounty

This week, Disclosed. (January 5, 2026) #BugBounty New MVH crowned. A million dollar WAF hardening payout, a /health endpoint turning into a credential leak, and a ZIP upload workflow producing two criticals. Full issue → getDisclosed.com Preview below 👇 @vercel detailed a $1M paid effort with @Hacker0x01 to pressure-test and harden its WAF against React2Shell-class bypasses, including runtime mitigation and detection changes. @pxmme1337 linked a newly launched anonymous forum for bug bounty discussions, with an optional verification mechanism aimed at proving bounty earnings. @Hacker0x01 announced @alexbindrei as Most Valuable Hacker of H1-3120, framed around AI security research. @Bugcrowd published a practical mapping of RCE pathways and detection methods, including command injection sinks; unsafe eval patterns; SSTI routes. @intigriti CSP bypass material focused on permissive source expressions; nonce and hash misuse; overbroad allowlists that still land script execution or exfiltration. @PortSwiggerRes published new SAML authentication bypass techniques tied to parser differentials in Ruby and PHP, including attribute pollution; namespace confusion; Void Canonicalization. @aretekzs wrote up a chain from self-XSS constraints to account takeover via DOM injection plus login CSRF and cookie-tossing effects on auth state. @xnl_h4ck3r shipped xnldorker v3.2 with Google Custom Search support and configuration changes aimed at smoother dorking workflows. @zack0x01 released video material on broken access control testing and a recon workflow overview spanning asset discovery; prioritization; validation loops. @medusa_0xf published a 2026 learning roadmap video centered on web and API hacking structure, with labs and category coverage. @ctbbpodcast dropped “2025 Hacker Stats & 2026 Goals (Ep. 155)”, reflecting on 2025 trends and predictions for 2026 workflows and disclosure dynamics. @NahamSec shared a 2025 findings retrospective video, focused on what made specific bugs interesting rather than full reproduction detail. @H4cktus published “Can you compromise a multi-billion dollar company via /health?”, centered on a health check surface exposing environment variables and sensitive cloud configuration. @_bergee_ published “Two crits, one zip”, two critical issues in a ZIP upload workflow, including symlink-based file access and a path to RCE via unsafe extraction processing. @J0R1AN walked through the Intigriti December XSS Challenge (1225), using browser behaviors like iframe messaging; performance entries; regex edge cases. @ptswarm research covered HTML-to-PDF generation stacks as a trust boundary that repeatedly turns into SSRF; local file disclosure; deserialization; DoS. This is just a preview. Full links, write-ups & more → getDisclosed.com The bug bounty world, curated.

Thank you @Rhynorater and @rez0__ for having @Arl_rose and myself on the pod. Had a blast recording this and hope that it brings value to your audience.

tbh I didn't even want to do a CTF. I felt like they have been overdone and often were not realistic to what you would see in the real world That’s why, when @Arl_rose and I started thinking about how to make this one special, we knew we wanted it to feel like a real-life vulnerable web app. Something similar to @owasp_juiceshop. And while juiceshop is cool, we wanted to be able to give it the real "bug bounty" vibe. Writing reports, getting rewarded for good write-ups, dealing with triage, maybe even getting hit with a dupe. As we wrote out the idea and started talking to vendors, I honestly didn’t think we could actually pull it off with the time and budget we had. Then we met the folks at @CTFae and we could just tell immediately that they were the right partners for this project. The scope quickly grew beyond just a single vulnerable web app to an interconnected ecosystem of vulnerable infrastructure: web, APIs, even LLM assets. If you like bug bounty and hate CTFs, this is for you. If you love CTFs but don’t know about bug bounty, this is also for you. Seriously I am so excited for this. Register at bbv.ctf.ae

The next issue of "Disclosed." is about to be released and I'm excited to share that I have partnered with @PentesterLab to bring you weekly giveaways! Shout-out to @snyff for making this possible ♥️