Starting in Bug Bounty: Understanding 1-Day Vulnerabilities
Mikhail Klyuchnikov, widely recognized in the bug hunting scene as n1, introduces readers to the fundamentals of 1-day vulnerabilities in the context of bug bounty programs.
Klyuchnikov has spent ten years at Positive Technologies, where he leads a group dedicated to software security analysis. His team focuses on two core activities: discovering previously unknown 0-day vulnerabilities and reproducing already disclosed 1-day vulnerabilities for use during penetration tests.
In addition to his work at Positive Technologies, Klyuchnikov participates in the PT SWARM team. Members of PT SWARM regularly publish technical articles, practical tips, and detailed breakdowns of vulnerabilities as soon as new information becomes available.
Over the years, Klyuchnikov has accumulated substantial experience participating in bug bounty programs on major international platforms as well as on the Russian platform Standoff Bug Bounty.
In this article, he sets out to explain what 1-day vulnerabilities are and how they fit into the workflow of researchers who are just beginning their journey in bug bounty hunting.
Related articles
Password Deleted from Git but Still Present: Major CI/CD Security Mistakes
Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.
Critical SSRF Vulnerability in AWS SSM Agent Allows IAM Credential Theft via Port Forwarding Bypass
Amazon Web Services has disclosed a high-severity server-side request forgery vulnerability in the AWS Systems Manager Agent. The flaw, tracked as CVE-2026-89049, affects the port forwarding feature used by Session Manager and stems from insufficient validation that permits bypass of deny-list restrictions on link-local addresses. Successful exploitation requires port-forwarding permissions but can lead to unauthorized access to instance metadata and temporary IAM role credentials. The company rated the issue as Important with CVSSv4.0 base score 8.5 and CVSSv3.1 score 9.9. The vulnerability was addressed in version 3.3.4851.0 released on 13 July 2026, prior to the public advisory issued on 10 September 2026.
New Windows 11 Bypass Lets Users Skip Internet and Microsoft Account During Setup
A new method has been discovered that allows Windows 11 Home users to complete initial setup without an internet connection or Microsoft account. The technique requires no command-line tools or scripts and was found by enthusiast Bob Pony. During the OOBE process, users simply open the sign-in options and click the Learn more link, which redirects the wizard to local account creation. Previous bypasses such as OOBE\bypassnro and start ms-cxh:localonly have already been blocked by Microsoft. The new approach appears to be an overlooked interface element and works only on the Home edition. Microsoft is expected to close this loophole in a future update as it continues tightening account requirements.
CISA Adds Four Actively Exploited Vulnerabilities in GitLab, ConnectWise ScreenConnect and JFrog Artifactory to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaws affect GitLab Community Edition and Enterprise Edition, ConnectWise ScreenConnect, and JFrog Artifactory. CVE-2026-85706 allows unauthenticated path traversal in GitLab’s commit API, enabling arbitrary file reads. CVE-2026-84869 in ScreenConnect permits unauthorized file transfer and execution over active remote sessions. Two additional issues in Artifactory, CVE-2026-42018 and CVE-2026-42016, can lead to token leakage and privilege escalation. Federal agencies have been directed to apply mitigations and investigate potential compromises by specific deadlines.