Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits audits frequently find improper uses of key derivation functions, and the post cites Flickr's API signature forgery vulnerability as a famous example of misusing a hash function during key derivation. It walks through HKDF's extraction and...
PyPI now lets project owners mark their projects as archived, signaling that no further updates are expected, and owners can unarchive at any time. Archival is distinct from yanking or deletion: archived projects are never deleted and can still be resolved...
Trail of Bits published a white paper documenting account takeover attack vectors and defenses specific to centralized cryptocurrency exchanges, noting that platform design choices such as not supporting phishing-resistant MFA like U2F hardware keys, or...
Trail of Bits argues that smart contract development needs a shift to invariant-driven development, embedding properties that must always hold into every stage of the software lifecycle, from design through monitoring and incident response. The firm notes...
TVM Ventures has selected Trail of Bits as its preferred security partner to strengthen the TON developer ecosystem, with Trail of Bits leading development of DeFi protocol standards and providing security services to contest-winning projects deploying on...
Trail of Bits released Medusa v1, an open-source EVM-based fuzzer built on Geth and derived from its earlier fuzzer Echidna, aimed at making smart contract fuzzing more scalable and efficient. An internal benchmark against Echidna showed Medusa and Echidna...
This is an index page of Trail of Bits blog posts by Josselin Feist, spanning 2017 to 2025 and covering smart contract security topics including fuzzing, invariant development, static analysis, and contract upgradeability. Individual entries describe work...
On February 21, 2025, cryptocurrency exchange Bybit lost approximately $1.5B from its multisig cold storage wallet, the largest cryptocurrency theft in history, after attackers compromised multiple signers' devices and manipulated what signers saw in their...
Trail of Bits researchers found that a single malicious request can crash web applications that use recursive functions to process untrusted input, and used a CodeQL query to identify denial-of-service vulnerabilities in several high-profile Java projects....
On February 21, 2025, cryptocurrency exchange Bybit lost $1.5 billion in the largest crypto hack to date, after attackers compromised the Safe signing frontend used by all of its multisig signers and manipulated transaction data so signers authorized a...
Trail of Bits describes TRAIL, its own threat modeling process, which extends Mozilla's single-component Rapid Risk Assessment to whole systems and incorporates parts of NIST SP 800-154 and the NIST SP 800-53 controls dictionary. The process maps in-scope...
Trail of Bits proposes TRAIL, a Threat and Risk Analysis Informed Lifecycle in which teams incrementally update a threat model at each phase of the SDLC rather than treating the completed report as a one-time snapshot. The post recommends keeping trust...
Trail of Bits ran a four-month independent benchmark, requested by AWS, comparing OpenSearch and Elasticsearch on OpenSearch Benchmark workloads using AWS instances, and found OpenSearch v2.17.1 was 1.6x faster on the Big5 workload and 11% faster on the...
This is an author index page for Trail of Bits Blog posts by Maciej Domański, listing entries from 2023 through 2025 on topics including snapshot fuzzing for kernel-level testing, a Burp Suite Professional chapter in the Testing Handbook, introducing...
Trail of Bits added a Snapshot Fuzzing section to the fuzzing chapter of its Testing Handbook, aimed at testing kernels, secure monitors, and other targets that require non-trivial setup. The technique captures memory and register state at a specific...
Trail of Bits describes an encounter in which its CEO received fake 'Bloomberg Crypto' interview invitations from two separate Twitter accounts run by the threat actor ELUSIVE COMET, which refused email and scheduled through Calendly pages that were not...
This is an index page of Trail of Bits blog posts by William Woodruff, covering work such as a new ASN.1 API for PyCA Cryptography, PEP 740 index-hosted digital attestations on PyPI, and audits of Homebrew and PyPI. Individual entries describe projects...
Trail of Bits, funded by Alpha-Omega, is building a new ASN.1 API for PyCA Cryptography that wraps rust-asn1, aiming to address performance, parser differentials, and modernization gaps in existing pure-Python libraries like pyasn1. The post notes that...
DARPA's AI Cyber Challenge has moved into its finals, where teams like Trail of Bits' Buttercup now get $1,000 or more per challenge instead of the semifinals' $100, can build custom AI models rather than relying only on Anthropic, OpenAI, and Google...
Trail of Bits describes a vulnerability it calls "line jumping" in which a malicious MCP server injects instructions through tool descriptions returned by the tools/list method, so the model acts on them before any tool is invoked. The researchers say the...
Trail of Bits researchers demonstrated an attack in which a malicious MCP server plants a trigger phrase in its tool description, causing the model to forward the user's entire conversation history to the attacker once the user organically types that...
Trail of Bits researchers found that ANSI terminal escape codes can hide malicious instructions in MCP server tool descriptions and outputs, and that version 0.2.76 of Claude Code applies no filtering or sanitization to ANSI escape sequences. The hidden...
Trail of Bits researcher Keith Hoodlet published three posts in April 2025 on vulnerabilities in MCP software: one on storing long-term third-party API keys in plaintext on the local filesystem, often with world-readable permissions; one on using ANSI...
Trail of Bits found that many MCP environments store long-term API keys for third-party services in plaintext on the local filesystem, often with world-readable permissions, across tools including official servers for GitLab, Postgres, and Google Maps and...
Trail of Bits cut the Warehouse test suite that powers PyPI from 163 seconds to 30 seconds, an 81% improvement, while the test count grew from 3,900 to over 4,700. The gains came from parallelizing tests with pytest-xdist, switching coverage to the...
Trail of Bits released Datasig, a lightweight tool that generates compact MinHash-based fingerprints of AI/ML datasets so training data can be compared with high accuracy without access to the raw data. In experiments on the MNIST vision dataset,...
Trail of Bits explains that passkeys are key pairs used to produce digital signatures, where the website stores only a public key and an identifier, and WebAuthn adds origin binding so a passkey created for bank.com cannot be used by a phishing site at...
Trail of Bits reports that custodial stablecoins reached $27.6 trillion in transaction volume last year, surpassing Visa and Mastercard combined, and proposes a "Rekt Test" of due diligence questions for issuers. The post cites the Bybit and Radiant...
Trail of Bits reviewed Axiom's blockchain system across two audits in 2023; the system computes over the entire history of Ethereum, verified by zero-knowledge proofs on-chain using ZK-verified elliptic curve and SNARK recursion operations. It is built on...
Trail of Bits reviewed Axiom's Halo2 circuits over two audits, from February 10 to May 17, 2023 and September 11 to September 29, 2023, covering low-level primitives, SNARK verification logic, and Axiom's changes between assessments. The reviews identified...