DEFCON 34 Hotel Room Debrief (Ep. 188)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Aug 20, 2026 · 41:48
This DEF CON episode of Critical Thinking covers Adobe's move to Integrity, YesWeHack's anti-AI-slop credits, and standout bug stories 0:35.
Key Takeaways:
• Adobe moves its bug bounty to Integrity on September 1st; hunters should register, and Critical Thinkers is raffling a lifetime sub on Discord 0:48
• YesWeHack launched credits to fight AI slop: accepted reports earn credits, spam/invalid ones deduct them 1:41
• Panelist talks: VS Code extension hacking workshop (RCE via vibe-coded extension), a Caido+AI talk, and a BT6 AI red-teaming panel 13:08
• James Kettle's talk showed AI enabling novel research; his tool, prompts, and methodology are open source 20:09
• Turbo escalated a wormable stored XSS via Electron IPC into full spyware leaking screenshots, process lists, and remote JS execution 22:41
• A hunter chained firmware dumps and token shuffles to temporary AWS credentials, reaching a fleet-wide shared secrets manager 27:55
• The group wholeheartedly recommends DEF CON for fresh research and motivation amid low bug bounty morale 36:14
Program news, cutting-edge AI-era research, and encouragement to attend security conferences.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Before I flew out to Vegas, I woke up at like 1:00 a.m., you know, my I had to wake up at 6:00 for my flight. I woke up from a nightmare that I was like HTML being injected into the DOM and I'm being blocked by the CSP and can't execute. [music] >> Best part of when you can just, you know, critical thing, right? [music] Yeah, [laughter and gasps] dude. >> [music] >> Sup hackers. Hope you guys are amped up and ready to hack after all the festivities at DevCon this past week and all the crazy research as well that dropped. Um, always very inspiring I think. Uh, so we have an exciting announcement to give you as well. Um, Adobe is going to be shifting their program over to Integrity. Okay, the cut over date is going to be September 1st. So if you're hacking on them, they're going to pause the…