[Bug Bytes #241] PHP2Shell + 1-click Discord RCE + Hacking Microsoft & Google + More!
PHP2Shell
BUG BYTES #241
Hi hackers,
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring:
- A full Microsoft Edge exploit chain using only logic bugs
- 1-click RCE in Discord via Twitch embed
- $250K Chrome full-chain bounty in just 6 days
- XSS in Cloudflare's image endpoint via SVG sanitizer bypass
- $90K Google RCE via Flask session pickle deserialization
And so much more! Let's dive in!
Understanding PHP2Shell: everything you need to know about CVE-2026-109618 & CVE-2026-109619
On October 21, emergency patches were released for two critical vulnerabilities in PHP's core engine. PHP2Shell (CVE-2026-109618 & CVE-2026-109619) carries a CVSS score of 9.2, and we've put together everything you need to know about PHP2Shell in one place: the four confirmed attack chains and the potential impact of each, three immediate steps your organization can take today, and long-term actions to strengthen your security posture.
AI raised the floor. The hacker crowd keeps raising the ceiling.
Submission volume is still growing, and validity has recovered sharply. High-severity findings are increasing, and researchers are repeatedly returning. The community is not simply producing more, it is learning how to produce better.
In our latest blog, Head of Product Greg Jenkins explores the latest Intigriti data on AI and bug bounty trends, what this shift means for bug bounty, and how CrowdRecon is making the community's wider reconnaissance work visible.
What ID verification changes mean for public bug bounty programs at Intigriti
ID verification is moving earlier in the bug bounty journey. Chris Holt, our Strategic Engagement & Community Architect, discusses what ID verification changes mean for public programs, how requiring verification before submission can help reduce noise in triage queues, and why responsible disclosure should remain welcome even without verification.
Quick! Intigriti 1026 Bonus Challenge is still live
Are you up for a bonus challenge? Six random solvers will win a limited-edition T-shirt.
Head over to the challenge page and capture the flag before November 2, 2026, at 11:59 PM UTC.
Intigriti 1026 Halloween Store CTF results are in
Halloween season is finally here! Our challenge creator went with a spooky Halloween store for this month's challenge and made it deliberately vulnerable to a price manipulation vulnerability. It was a fun CTF that was also more approachable than usual, which the solver count reflects. Here are the final numbers.
Quick recap:
- First blood was captured by mianx
- 411 hackers found the correct solution
- 72 hackers wrote a cool write-up
If you want to put your hacking skills to the test, be sure to give the Intigriti 1026 Challenge a go before heading over to Bugology, where you can find all the researchers' submitted write-ups and solutions.
Blogs & videos
Prompt injection vulnerabilities are some of the most interesting bugs to hunt for right now. Extracting someone's email from a Reddit comment, leaking OTPs through an email reply, taking actions on a victim's behalf without ever touching a proxy interceptor: the attack surface is wide open, and most developers underestimate it. Our latest article breaks down the full LLM prompt injection exploitation guide, from basic system prompt overrides to advanced indirect injection scenarios that trick LLMs into complying with just about anything.
- Are you using AI to generate your reports? Be sure to feed it our AI vulnerability report-writing guide, which contains a list of practical tips to help you write proper vulnerability reports that get triaged faster.
- It is okay to disagree with the outcome of your report. Whether it is an incorrect closure, a severity downgrade, or a payout that takes longer than expected, knowing how to respond matters. Our guide covers Intigriti’s mediation process, the most common scenarios researchers run into, and the common mistakes that can further escalate the situation.
Tools & resources
Tools
Recon involves running multiple tools in order, which is a super tedious process if you have to do it for every target manually. HexStrike AI by @0x4m4 is an MCP server that lets any LLM (such as Claude, GPT, or Copilot) autonomously run 150+ recon tools for automated information gathering, fingerprinting, and vulnerability discovery.
- Looking for a way to add structured recon capabilities to your AI workflow? Claude-OSINT is a drop-in set of Claude skill files that gives you 100+ recon capabilities, 80+ dorks, secret-regex patterns, and 27 attack-path templates for red-team engagements and bug bounty workflows. If you are already using Claude for security testing, this is worth checking out.
Resources
@orange_8361 published a full Microsoft Edge exploit chain built entirely from logic bugs, with no memory corruption involved. In a landscape where browser exploitation has become synonymous with heap sprays and use-after-frees, this work stands out as a fundamentally different approach. As a bonus, he also flipped the chain and popped Microsoft Edge from calc.exe.
- 1-click RCE in Discord via a Twitch embed. The disclosure details a chain going from an attacker page through Twitch rich embed, a parser gap in the manifest node, inherited-origin Discord popout, V8 RegExp UAF, Electron IPC escape, WebDAV demand-start, and TOCTOU in the updater to reach cmd.exe. One of the coolest exploit chains disclosed this year.
Feedback
Before you click away: Do you have feedback, or would you like your technical content to get featured in the next Bug Bytes issue? We want to hear from you. Feel free to send us an email at [email protected] or DM us on X/Twitter, and we'll take it from there.
Did you like this Bug Bytes issue? Consider sharing it with your friends and tagging us along on X/Twitter, Instagram, or LinkedIn.
Wishing you a bountiful month ahead,
Keep on rocking!
Klokstraat 16, Antwerp
Belgium