Automated Code Audit’s First Customer
Summary: Trail of Bits reports that its Cyber Reasoning System, developed for DARPA's Cyber Grand Challenge, audited the open source zlib compression library for Mozilla's Secure Open Source Fund, which the firm describes as the first paid, automated security audit by a CRS. Mozilla paid 20% of what Trail of Bits normally charges for this kind of work, and the assessment paired the CRS with TrustInSoft's verification software to find memory corruption vulnerabilities and identify code that may lead to future bugs.
Key Takeaway: Mozilla, a non-profit, got a detailed audit of a library bundled in virtually every software package that requires compression for one-fifth the usual price - a cost gap that has kept deep code review out of reach for the non-profits maintaining core Internet infrastructure.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026