Security knowledge hub

Security insights frompeople who break things.

Research, tear-downs, and field notes from our offensive security team. No filler, no vendor talking points.

All

123 articles

Career Paths After Bug Bounty: 5 Honest Routes From Hunter to Founder

Latest

Security

Career Paths After Bug Bounty: 5 Honest Routes From Hunter to Founder

A bug bounty career can lead to pentesting, AppSec, red teaming, the platform side or a company. Five honest routes, with the evidence and its limits.

XHack

Oct 8, 2026

Security

API Credits: The Complete 2026 XHack AI API Guide

API credits for the XHack AI API: how to buy them, create a key, price each request, and connect Codex, Claude Code and Aider with tested code examples.

XHack

Oct 8, 2026

Security

XHack AI Can Make Mistakes: What Goes Wrong, Why, and How to Catch It

AI mistakes in pentesting: how XHack AI errs, why they happen, what research shows, and the checks that catch false positives before a client sees them.

XHack

Oct 7, 2026

News

CVE-2026-76461: The Critical Cisco Email Gateway Bug Triggered by One Email

CVE-2026-76461 is a CVSS 9.8 SQL injection in Cisco Secure Email Gateway, exploited in the wild. Affected builds, fixes, and how to check for compromise.

XHack

Oct 7, 2026

Security

Bug Bounty vs Freelance Pentesting: Which Pays Better in 2026?

Bug bounty vs freelance pentesting: which pays better? Day rates, bounty income data, hidden costs and a four-question test to choose your path.

XHack

Oct 7, 2026

News

CVE-2026-93616: The Critical Check Point Management Server Zero-Day

CVE-2026-93616 is a CVSS 9.8 pre-auth zero-day in Check Point Security Management, exploited since July 23. Affected versions, fix and hunt steps inside.

XHack

Oct 6, 2026

Security

Why the curl Bug Bounty Ended in 2026: The Truth and What Came Next

Why the curl bug bounty ended: AI slop cut valid reports from 15% to under 5%. Then slop stopped, volume doubled and curl paused. What hunters can learn.

XHack

Oct 6, 2026

Security

Is Bug Bounty Worth It in 2026? The Honest Verdict

Is bug bounty worth it in 2026? Strong for learning and career, weak for reliable income. The data, costs, legal risk and a four-question test to decide.

XHack

Oct 4, 2026

News

CVE-2026-82042: The Critical UTMStack Flaw Where One Shared Key Was Admin

CVE-2026-82042 and CVE-2026-82041 are critical UTMStack SIEM flaws: one shared key acted as admin, and no role check guarded agent commands. Fixed in 11.2.14.

XHack

Oct 3, 2026

Security

Does AI Actually Help You Win Bug Bounties? The Honest 2026 Answer

Does AI help you win bug bounties? One AI system had ~12% of reports resolved, curl’s valid rate fell under 5%, and GitHub cut payouts. The honest data.

XHack

Oct 3, 2026