Episode 174: Saving Bug Bounty Programs + AMPScript, tessl & GPT-5.5

Episode 174: In this episode of Critical Thinking - Bug Bounty Podcast we follow up from last episode with some advice for BB platforms, as well as cover a slew of writeups from Searchlight Cyber, watchTowr, and Starstrike.

Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
x.com/Rhynorater
x.com/rez0__
x.com/gr3pme

Critical Research Lab:
lab.ctbb.show

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at ctbb.show/merch!

Need a Pentest? We just launched CTBB Pentests!
pentest.ctbb.show

Hack full time? Check out the Full-Time Hunter’s Guild!
ctbb.show/fthg

====== This Week in Bug Bounty ======
COST, AI frontier models and more: A measured take on the future of security testing
yeswehack.com/security-best-practices/cost-myt…

Common AI misconceptions debugged!
intigriti.com/blog/business-insights/common-mi…

BountySync + Social
luma.com/bountysync_social

====== Resources ======
Ghosts of Encryption Past
slcyber.io/research-center/ghosts-of-encryptio…

tessl Skill Optimizer
tessl.io/registry/tessl/skill-optimizer/0.8.0

The Internet Is Falling Down, Falling Down, Falling Down
labs.watchtowr.com/the-internet-is-falling-dow…

High Fidelity Check for the cPanel Authentication Bypass
slcyber.io/research-center/high-fidelity-check…

Achieving Deterministic Prompt Injection Through Client-Side Feedback Loops
blog.starstrike.ai/posts/achieving-determinist…

GPT-5.5: Mythos-Like Hacking, Open To All
xbow.com/blog/mythos-like-hacking-open-to-all

Remote Command Execution in Google Cloud with Single Directory Deletion
flatt.tech/research/posts/remote-command-execu…

====== Timestamps ======
(00:00:00) Introduction
(00:09:20) AMPScript
(00:25:10) Tessl Skill Optimizer
(00:33:07) cPanel & WHM Authentication Bypass
(00:40:46) Advice for Bug Bounty Programs
(00:50:07) Prompt Injection Through Client-Side Feedback Loops
(00:54:37) GPT 5.5
(01:01:00) Remote Command Execution in Google Cloud