Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits researchers exploited inadequate isolation in multiple agentic browsers to carry out attacks functionally similar to cross-site scripting and cross-site request forgery, including planting false information (such as claims that Yuri Gagarin...
Trail of Bits collaborated with the Sigstore community to build cryptographic agility into the software signing ecosystem, letting organizations use different signing algorithms while maintaining security through predefined algorithm suites and out-of-band...
Trail of Bits worked with the Sigstore community over two years to replace Sigstore's hard-coded ECDSA P-256 and SHA-256 with a centralized algorithm registry in the Protobuf specifications, configurable algorithm restrictions in Rekor and Fulcio, and a...
Trail of Bits engineers submitted over 375 pull requests that were merged into non-Trail of Bits repositories in 2025, touching more than 90 projects from cryptography libraries to the Rust compiler. Most of these contributions came out of client work,...
Trail of Bits found that the AES libraries aes-js and pyaes supply a default IV of 0x00000000_00000000_00000000_00000001 when none is given in CTR mode, and their documentation shows this as normal use, producing key/IV reuse bugs across projects that npm...
Perplexity hired Trail of Bits to test its Comet browser's AI-powered browsing features before launch, and the firm used its TRAIL threat model to develop four prompt injection techniques that extracted users' private Gmail data to an attacker's server...
Trail of Bits is open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information, announced by Alessandro Gario on February 25, 2026. The same author's earlier posts cover step-by-step methods for applying BPF...
Trail of Bits has open-sourced mquire, a Linux memory forensics tool that analyzes memory dumps without external debug symbols by extracting type information from BTF and symbol addresses from Kallsyms embedded in the dump itself. The tool provides an...
Trail of Bits, after auditing dozens of ERC-4337 smart accounts, identified six recurring vulnerability patterns, including execute functions callable by anyone, gas fields omitted from the signed payload, and state written during validateUserOp. The post...
Trail of Bits researcher Coriolan Pinhas published a March 24, 2026 post describing how dimensional analysis from physics can be applied to DeFi smart contracts to catch arithmetic and logic bugs by keeping formulas consistent across tokens, prices, and...
Trail of Bits describes applying dimensional analysis, the physics practice of checking that both sides of an equation share the same dimensions, to catch logic and arithmetic bugs in DeFi formulas without code changes. The post cites a real vulnerability...
Trail of Bits released a Claude Code plugin that uses an LLM to annotate a codebase with dimensional types and then flags mismatches mechanically, rather than asking the model to find bugs directly. In testing against dimensional mismatch issues from...
Trail of Bits reports that a year after roughly 5% of the company backed its AI initiative, it now runs 94 plugins, 201 skills, and 84 specialized agents, with AI-augmented auditors finding 200 bugs a week on some engagements. The firm describes a six-part...
Trail of Bits announced MuTON and mewt, two new mutation testing tools optimized for agentic use, in a post dated April 01, 2026. The post is filed under blockchain, mutation-testing, tool-release, and open-source. What's compelling: Trail of Bits frames...
Trail of Bits announced MuTON and mewt, two open-source mutation testing tools built for agentic use, with MuTON supporting the TON blockchain languages FunC, Tolk, and Tact and mewt serving as a language-agnostic core that also covers Solidity, Rust, and...
Trail of Bits released CoBRA, an open-source tool that simplifies the full range of Mixed Boolean-Arithmetic (MBA) expressions used in the wild. The release is categorized under tool-release, open-source, reversing, c/c++, llvm, and...
Trail of Bits released CoBRA, an open-source tool that simplifies Mixed Boolean-Arithmetic obfuscation by routing each expression through a worklist-based orchestrator managing 36 passes across linear, semilinear, polynomial, and mixed families. CoBRA...
Trail of Bits published a pre-launch audit of WhatsApp's Private Inference feature, which processes encrypted messages inside AMD SEV-SNP and Nvidia confidential GPU enclaves, and identified 28 issues including eight high-severity findings that could have...
Trail of Bits added a chapter to its Testing Handbook: a security checklist for C and C++ code organized into five areas covering general bug classes, Linux usermode and kernel, Windows usermode and kernel, and seccomp/BPF sandboxes. The chapter catalogs...
Trail of Bits published a zero-knowledge proof that improves on Google Quantum AI's quantum circuit cost estimates on all metrics, not through a quantum advance but by exploiting memory safety and logic vulnerabilities in Google's Rust prover code built on...
Trail of Bits published a series of posts by Scott Arciszewski, including a November 14, 2025 release of open-source Go implementations of the post-quantum signature schemes ML-DSA and SLH-DSA, and an April 23, 2026 release of Trailmark, a tool that turns...
Trail of Bits open-sourced Trailmark, an Apache-2.0 library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, exposed through a Python API that Claude skills call directly, supporting 17...
Trail of Bits added LibAFL support to Ruzzy, its coverage-guided fuzzer for pure Ruby code and Ruby C extensions, by building LibAFL as a standalone library and linking libFuzzer.a into Ruzzy's C extension. Two problems had to be worked around: GNU ld...
Trail of Bits published a walkthrough of its solutions to two C/C++ security challenges from a new Testing Handbook chapter: a Linux ping program with an inet_ntoa global buffer gotcha and command injection, and a Windows driver with registry type...
Trail of Bits walked through a Windows driver registry handler that calls RtlQueryRegistryValues with RTL_QUERY_REGISTRY_DIRECT set but without RTL_QUERY_REGISTRY_TYPECHECK, letting a REG_QWORD MajorVersion value overwrite four bytes past a stack integer....
Trail of Bits released gosentry, a fuzzing-oriented fork of the Go toolchain that preserves the standard fuzzing workflow while using a stronger stack underneath. The firm also released go-panikint, a modified Go compiler that turns silent integer...
Trail of Bits built gosentry, a fuzzing-oriented fork of the Go toolchain that runs LibAFL by default under the existing go test -fuzz interface, so existing Go fuzz harnesses need no rewriting. It adds native struct fuzzing, grammar-based fuzzing via...
Trail of Bits worked with zizmor's maintainers over three months to bring the GitHub Actions static analyzer's YAML anchor support to full coverage, fixing parsing bugs that caused crashes, wrong-location findings, and mishandled aliased values, and filing...
Trail of Bits researchers Samuel Judson and Tjaden Hess report that they bypassed ClawHub's malicious skill detector, Cisco's agent skill scanner, and all three scanners integrated into skills.sh. The post is filed under machine-learning, vulnerabilities,...
Trail of Bits researchers bypassed ClawHub's malicious skill detector, Cisco's agent skill scanner, and all three scanners integrated into skills.sh, building three of four malicious skills in under an hour using standard tricks and inspection of the...