Claude Code, Codex or Gemini CLI for Bug Bounty? 🤔 We put all three through blind PortSwigger labs 🧪 These tests aren’t benchmarks, but the patterns observed say a lot about where each agent could fit in your workflow 👇 yeswehack.com/learn-bug-boun…

🏁 #SPIRITCYBER26 has come to a close after weeks of persistence, creativity and pushing the limits. Huge congratulations to the top five: 🥇nullIoT 🥈One Prompt to Pwn Them All 🥉Peenoise 🏆Hamtarou 🏆Undefined Behavior 👏 Big shoutout to all the team that took part in the qualifiers. Every valid report helped push the challenge further and strengthen the connected technologies supporting Singapore’s #SmartNation. 🤝 Proud to have joined forces again with @CSAsingapore for another round of hacking for a good cause. Till next year!

⌛ Last chance to shake up the leaderboard. The #SPIRITCYBER26 finalists know their targets well, but one overlooked detail or breakthrough could still change everything. ⚡Final day starts now! #SICW2026 @CSAsingapore

💡 Behind every finding: trial and error, dead ends, and sometimes another hunter asking, “Have you tried this?” That’s the power of the #BugBounty community. Different minds with a shared goal of making digital systems safer for all. Leading the pack at #SPIRITCYBER26: @bytehx343 @0xakm, @mgthura404 from Team nullIoT🔥 Stay tuned for the final push tomorrow. #SICW2026 @CSAsingapore

👀 #SPIRITCYBER26 so far: 10% typing, 90% staring intensely at the screen. Our 5 finalist teams spent the day pulling apart these IoT devices and refining their exploits. Some findings come quickly, but the interesting ones usually don’t. Back tomorrow for Day 2! 🔎 #SICW2026 @CSAsingapore

🇸🇬 Today, the #SPIRITCYBER26 IoT Bug Bounty finals officially begin at @SICWSG, in collaboration with @CSAsingapore! ☝️ 30 teams. 5 weeks of hacking. 5 finalists heading to Singapore: 🔹 nullIoT 🔹 Peenoise 🔹 One Prompt to Pwn Them All 🔹 Hamtarou 🔹 Undefined Behavior Now the challenge continues with three days of live hacking to dig deeper, prove impact and help strengthen the security of critical #IoT systems. Good luck to all and let the hacking begin 💥 #HackThePlanet

“Your main hacking tool should be your own knowledge and curiosity,” says @_Sn0rkY, a longstanding hunter on our Bug Bounty Programs 🧠 In a video just published on our blog, the hacker shares his backstory, hunting approach and perspective on AI 👇 yeswehack.com/community/inte…

Hacking complete. Leaderboard locked. 🔒 🥇 PyUs3r 🥈 bofill3 🥉 tonysec 🌈 Full Spectrum: @deb_security 💥 Biggest Impact: bofill3 Thanks @BancoGalicia, @BugBountyArg & @Ekoparty for a great round two! 🚀 ✅ Final leaderboard: event.yeswehack.com/events/e…

Day two at @ekoparty: done ✅ Our LHE with @BancoGalicia and @BugBountyArg is heading into its final stretch. PyUs3r, tonysec and gpk21 are still leading 👀 Who will finish on top? 🏆 Leaderboard 👉 event.yeswehack.com/events/e…

The hunt is back on ⚡ Day 2 of our LHE with @BancoGalicia and @BugBountyArg has begun at @ekoparty! 🐛 PyUs3r, tonysec and gpk21 currently lead the leaderboard. Can anyone shake up the podium today? 👀 Follow the action 👉 event.yeswehack.com/events/e…

Round two. Let the hacking begin 🔥 Our Live Hacking Event with @BancoGalicia and @BugBountyArg is officially underway at @ekoparty! Hackers, you know the target. Now you have until Friday, 10AM, to show us what you can find 👀 Happy hacking! 🔗 Leaderboard: event.yeswehack.com/events/e…

Not every AI agent needs to do the active hacking! 👀 Gemini CLI is fast, cheap and great at reviewing large amounts of HTTP traffic or source code. We tested it on blind vulnerability labs to see what it could spot 🔎 Full test 👇 yeswehack.com/learn-bug-boun…

This week, the hunt goes live in Buenos Aires! 🔴 From Wednesday, 1PM to Friday, 10AM, @BancoGalicia, @YesWeHack and @BugBountyArg are back at @ekoparty for our second Live Hacking Event together. If you’re attending, bring your laptop and come put your skills to work. 💻

What if one request could tell two different stories? 👀 This month’s Dojo is all about making the right thing appear in the wrong place. Can you fool the system and capture the flag? 🚩 Go hack it 👉 dojo-yeswehack.com/challenge…

What if the cache key itself is the attack surface? 🔑 At @BugBountyDEFCON, @Brumens2 broke down how cache key injection can lead to unauth cache deception, CPDoS and stored XSS. Catch the full article & talk👇 yeswehack.com/lab/research-c…

Did you know you could bypass filters by "jumping" over characters? The solution to Highscore, is out! 💡 See how a mismatch between JavaScript string length and UTF-8 bytes can bypass character checks! 👀 Read the full write-up 👇 yeswehack.com/dojo/dojo-chal…

What happens when you stop giving Codex step-by-step instructions and just give it the goal? 👀 It can investigate, test hypotheses and follow promising leads on its own. We put that workflow to the test for Bug Bounty 👇 yeswehack.com/learn-bug-boun…

Highscore has been beaten! 💥 Huge congrats to Brahimmg, Admin_A & Gaby_ri for hacking their way through our latest CTF challenge! 🎁 Swag is coming your way! Keep an eye on your inbox. The next challenge is right around the corner 👉 dojo-yeswehack.com/challenge…

📱 Ready to hunt bugs on Android? Join @pwnwithlove at @ekoparty 2026 for a hands-on workshop with @BugBountyGirlsC. 📅 7 Oct, 2:45 PM 📍 Room A2 Build your lab, explore an app’s attack surface and find your first vulnerabilities.