Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits audited Silence Laboratories' Silent Shard library, one of the first production implementations of the DKLs23 threshold signature scheme, in October 2023 and identified 15 security issues, including two high-severity flaws that could have...
Trail of Bits researcher Vasco Franco published a June 17, 2025 post describing how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly produced high-impact security issues in production systems. The post covers three attack...
Trail of Bits reports that Go's JSON, XML, and YAML parsers have unexpected behaviors it has repeatedly exploited during security assessments to bypass authentication, circumvent authorization, and exfiltrate data, citing CVE-2020-16250, a HashiCorp Vault...
Trail of Bits reports that private key compromise, not smart contract bugs, was the single biggest cause of crypto hacks last year, citing Chainalysis's 2024 report that 43.8% of all funds stolen via hacks stemmed from compromised keys - more than any...
DARPA's AI Cyber Challenge Finals scored round has begun, with Trail of Bits' Cyber Reasoning System, Buttercup, competing against six other teams to find and patch the most software vulnerabilities. Winners will be announced on the DEFCON 33 main stage on...
Trail of Bits released Deptective, an open-source tool that runs any Linux program, script, or command under strace in a Docker container and records failed file accesses to identify missing native dependencies. It then searches the distribution's...
Jack Dorsey released Bitchat, a Bluetooth-based end-to-end encrypted messaging app, and researcher Alex Radocea demonstrated a man-in-the-middle attack that exploits its broken identity authentication to impersonate trusted contacts. The app also lacks...
Trail of Bits released Vendetect, an open-source tool that uses semantic fingerprinting, based on the Winnowing algorithm used by Stanford's MOSS plagiarism detector, to detect copied and vendored code between repositories. The tool also reads version...
At EthCC[8] in Cannes, Trail of Bits blockchain security engineer Nicolas Donboly outlined a path to becoming a smart contract auditor built on four disciplines: programming fundamentals, blockchain technology, Web3 security, and continuous practice. He...
Trail of Bits researchers fully exploited two discontinued network devices, a Netgear WGR614v9 router and a Bitdefender Box V1, at DistrictCon's inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique....
Trail of Bits released a beta security wrapper called mcp-context-protector that proxies tool calls between an LLM app and any MCP server, targeting "line jumping" attacks where a malicious server hides prompt injection in tool descriptions or server...
Trail of Bits released pajaMAS, a set of demos showing 'MAS hijacking,' an attack that manipulates the control flow of multi-agent systems by exploiting how agents communicate, described as a variant of prompt injection targeting MAS control flow and...
Trail of Bits is establishing the Unconventional Innovator Scholarship, a $2,500 award at Mineola High School for students who teach themselves technical skills and explore technology beyond the classroom. The first recipient is Joe Malone, recognized for...
A Trail of Bits AI/ML security engineer, in his first month on the job, found two remotely accessible memory corruption bugs in NVIDIA's Triton Inference Server by running the Semgrep static analysis tool against the codebase and then using HTTP chunked...
Trail of Bits designed a prompt injection exploit that hides instructions in an HTML <picture> tag inside a GitHub issue, invisible to maintainers but readable by GitHub Copilot, so that Copilot inserts a backdoor into a project's uv.lock file when...
This is an author index page for Trail of Bits researcher Trent Brunson, listing posts on topics including the DARPA AIxCC finals, bug bounty economics, and fuzzing research quality. The page's most recent listed post, dated August 07, 2025, notes that...
DARPA's AI Cyber Challenge finals will name a winner this week for the $4 million first prize for the best AI system that automatically finds and fixes vulnerabilities in real-world code, with seven finalists split among four university teams and three...
Trail of Bits has released Buttercup, its Cyber Reasoning System, as open source now that DARPA's AI Cyber Challenge (AIxCC) has officially ended. Buttercup competed in AIxCC's scored round against six other teams to find and patch the most software...
Trail of Bits placed second in DARPA's AI Cyber Challenge and has released its cyber reasoning system, Buttercup, as open source, including a standalone version that runs on a typical laptop and the versions entered in the semifinal and final rounds....
At DEF CON 33 in Las Vegas on August 8, 2025, DARPA announced Trail of Bits took second place and $3M in the AI Cyber Challenge finals with its Buttercup cyber reasoning system, behind Team Atlanta's $4M win and ahead of Theori's $1.5M. In the final round,...
Trail of Bits traces Ruby Marshal deserialization exploits from Hailey Somerville's January 31, 2013 bug tracker issue through Luke Jahnke's 2018 universal RCE gadget chain to Jahnke's November 2024 Ruby 3.4 gadget chain, which was patched before Ruby...
Trail of Bits researchers Kikimora Morozova and Suha Sabi Hussain published a post detailing how attackers can exploit image scaling against production AI systems including Gemini CLI, Vertex AI Studio, Gemini's web and API interfaces, Google Assistant,...
Trail of Bits published research detailing how attackers can exploit image scaling to attack production AI systems including Gemini CLI, Vertex AI Studio, Gemini's web and API interfaces, Google Assistant, and Genspark. The post covers mitigation and...
Trail of Bits researchers achieved data exfiltration on production AI systems including Google Gemini CLI, Vertex AI Studio, Gemini's web and API interfaces, Google Assistant, and Genspark by embedding prompt injections in images that are invisible at full...
Trail of Bits attributes the $1.5 billion Bybit hack to a compromised supply chain and a failure to verify signatures on a separate device, and notes that the signed transaction changed an operation type from 0 (normal call) to 1 (delegate call) along with...
A Trail of Bits business operations intern built two Claude-based automation tools during a summer internship: a podcast workflow that monitors upwards of 50 weekly podcasts (about 2,500 episodes a year) and saves an estimated 1,250 hours of listening...
Trail of Bits researcher Darius Houle reported on September 03, 2025 that a vulnerability in Electron applications lets attackers bypass code integrity checks by tampering with V8 heap snapshot files. The technique enables local backdoors in applications...
Trail of Bits researchers found that Electron's integrity-checking fuses, EnableEmbeddedAsarIntegrityValidation and OnlyLoadAppFromAsar, did not cover V8 heap snapshot files, allowing unsigned JavaScript to be loaded into any V8 isolate. They demonstrated...
Trail of Bits Director of Engineering for Blockchain Benjamin Samuels argued at EthCC[8] that exchanges should move Ethereum cold storage from key-only multisig custody to purpose-built smart contracts that enforce security policies at the protocol level....
Trail of Bits analyzed DeepBookV3's flash loan implementation on Sui and found that Move's "hot potato" model enforces repayment at the language level rather than through Solidity-style callbacks and runtime balance checks. A struct with no abilities...