Companies will put up all kinds obstacles to responsible disclosure for researchers to get around to make their own lives easier. But they often forget that in the end it is researcher who calls the shots. It is the researchers vuln and they can do whatever they want with it.

https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/#comments

#vulnerability #disclosure #responsibledisclosure #windows #microsoft

The Cathedral and the Catacombs - Stretching a metaphor deep into the floor.

https://nesbitt.io/2026/04/06/the-cathedral-and-the-catacombs.html

If you want to see some quality AI security reports, that often identify a bug we don't think have security properties, remember that we disclose every report once closed and this is now quite a few every week:

https://hackerone.com/curl/hacktivity?type=team

Axios supply chain attack is interesting, partly because I'm not seeing NEARLY the traffic I'd expect to the C2 domain.

I expect some absolute chad caught it early and negotiated a very effective sinkhole.

I clearly need to start a wall of “trusted publishing would have prevented this” incidents

Edit: but not axios, maybe! Looks like that one may be full maintainer account compromise.