Starting in Bug Bounty: Understanding 1-Day Vulnerabilities
Mikhail Klyuchnikov, widely recognized in the bug hunting scene as n1, introduces readers to the fundamentals of 1-day vulnerabilities in the context of bug bounty programs.
Klyuchnikov has spent ten years at Positive Technologies, where he leads a group dedicated to software security analysis. His team focuses on two core activities: discovering previously unknown 0-day vulnerabilities and reproducing already disclosed 1-day vulnerabilities for use during penetration tests.
In addition to his work at Positive Technologies, Klyuchnikov participates in the PT SWARM team. Members of PT SWARM regularly publish technical articles, practical tips, and detailed breakdowns of vulnerabilities as soon as new information becomes available.
Over the years, Klyuchnikov has accumulated substantial experience participating in bug bounty programs on major international platforms as well as on the Russian platform Standoff Bug Bounty.
In this article, he sets out to explain what 1-day vulnerabilities are and how they fit into the workflow of researchers who are just beginning their journey in bug bounty hunting.
Related articles
Keycloak Fixes Critical CVE-2026-18963 Password Reset Flaw Allowing Unauthenticated Account Takeover
Keycloak has patched a critical vulnerability tracked as CVE-2026-18963 that lets remote unauthenticated attackers force a password reset for any user and seize control of the account. The flaw affects the reset-credentials flow due to improper state validation, enabling attackers to bypass email verification and reach the password change endpoint directly. With a CVSS 3.1 score of 9.1, the issue requires no privileges or user interaction and impacts confidentiality and integrity. Patches are available in Keycloak 26.7.2 and corresponding Red Hat Build of Keycloak releases 26.4.15 and 26.6.6. Organizations unable to update immediately should disable the Forgot password feature across all realms. Post-remediation auditing of login events and credential changes on privileged accounts is recommended to detect any prior exploitation attempts.
Sky Discloses Five Vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
Sky has released a security advisory detailing five vulnerabilities affecting its IT asset management tools SKYSEA Client View and SKYMEC IT Manager. The flaws impact all Windows-based components including master servers, management machines, terminal machines, and standalone terminals. Two issues received CVSSv4 base scores of 8.5 while the remaining three scored 5.8, with CVSSv3 scores reversing the severity ranking for some entries. The vulnerabilities include missing authorization checks, improper file permissions during installation, multiple path traversal flaws, and a stack-based buffer overflow. Sky has made update and patch modules available to contracted customers and strongly recommends immediate deployment.
CISA Adds Oracle WebLogic Proxy Plug-in Flaw CVE-2026-21962 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the Oracle WebLogic Server Proxy Plug-in. The vulnerability affects the mod_wl_ohs module that proxies requests from web servers to Oracle WebLogic Server. It is bundled with Oracle HTTP Server and also impacts equivalent plug-ins for Apache HTTP Server and IIS. The flaw allows unauthenticated remote attackers to tamper with, delete, or create data and exfiltrate information. Exploitation can impact connected environments and backend systems. CISA issued the alert on August 24, 2026, highlighting the risk to organizations running affected proxy configurations.
Critical Zoom Vulnerability Exposes All Platforms to Remote Takeover via Screen Sharing Annotations
A high-severity vulnerability in Zoom Workplace clients across Windows, Mac, iOS, Android, and Linux allows attackers to remotely seize full device control simply by having a victim enable screen sharing and the annotation tool. The flaw requires no user interaction such as clicking links or dismissing warnings, and the compromise occurs silently without visible alerts. Security researchers demonstrated that AI tools enabled complete exploit development within 24 hours, dramatically lowering the barrier for advanced attacks previously limited to nation-state actors. The issue affects hundreds of millions of remote workers who rely on Zoom’s daily screen-sharing features. Official patches have been released, and users are urged to update immediately while avoiding annotation tools in sensitive sessions. Apple simultaneously addressed related macOS flaws in multiple versions. The incident highlights how generative AI is accelerating the weaponization of vulnerabilities.