Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits and the badkeys project found hundreds of unique RSA keys in the wild whose bits are heavily biased toward 0, and many can be quickly factored by converting the integer to a polynomial and factoring that instead. They traced one pattern to a...
Trail of Bits' Patch the Planet initiative paired its engineers with open-source maintainers and frontier models like GPT-5.5-Cyber, producing in its first week hundreds of discovered bugs, 64 pull requests, and 51 issues across 19 projects including cURL,...
Trail of Bits added post-quantum cryptography support to pyca/cryptography, the eleventh most-downloaded Python package on PyPI, making the quantum-resistant ML-KEM and ML-DSA algorithms available through a pip install for the Python ecosystem. The same...
With funding from the Sovereign Tech Agency, Trail of Bits implemented support for ML-KEM and ML-DSA in pyca/cryptography, shipping in version 48 as Rust bindings with a cross-binding API and AWS-LC backend support. The release follows a June 22, 2026...
In Trail of Bits' Patch the Planet collaboration with OpenAI, GPT-5.5-Cyber built a bespoke zlib fuzzing campaign in a single day that the firm says would have taken a skilled researcher weeks, producing harnesses across a dozen entrypoints, sanitizer and...
Trail of Bits announced that its open-source mutation-testing engine Mewt, released in April, now supports DAML, the language used to write Canton Network applications. The tool is designed to find gaps in a test suite. What's compelling: Canton Network...
Trail of Bits added DAML support to Mewt, its open-source mutation-testing engine, generating mutants including two built for DAML's authorization primitives - controller party swap and controller party removal - and running them through an existing test...
Trail of Bits added a chapter to its Testing Handbook covering security testing of Rust programs, spanning a security overview of what Rust's guarantees do and don't cover, dynamic analysis tools including Miri and proptest, static analysis with Clippy,...
Trail of Bits published a series of posts on AI and software security, including its audit of WhatsApp's "Private Inference" feature, which found that trusted execution environments are not a silver bullet. Its February 2026 audit of Perplexity's Comet...
Trail of Bits engineers, working through Patch the Planet with OpenAI, pointed Codex's /goal feature at heavily audited codebases including Rust, curl, and zlib, and converged on three techniques for goal-based prompting. One engineer, Kevin Valerio, built...
Trail of Bits blockchain security engineer Nicolas Donboly published a post identifying seven recurring failure patterns in Uniswap v4 application and hook code, including missing caller checks and accounting bugs that still satisfy the PoolManager's...
Trail of Bits analyzed dozens of audit findings plus public reports and the Solodit database to identify seven recurring failure patterns in Uniswap v4 hook and application code, including missing caller checks and accounting bugs that still satisfy the...
Trail of Bits' third post on AWS Nitro Enclaves catalogs passive and active attack classes against the enclave-KMS communication channel, noting that KMS validates attestation timestamps to be at most five minutes old and that the Encrypt operation lacks...
Signal launched Automatic Key Verification, a key transparency feature that creates a globally consistent view of the public keys associated with each phone number so a compromised server cannot quietly substitute a false key. Trail of Bits built and...
Trail of Bits researchers Paweł Płatek and Denys Pakizh reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. The...
Trail of Bits researchers Paweł Płatek and Denys Pakizh found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single...
Trail of Bits found a bug in Provenance Blockchain, a Cosmos SDK proof-of-stake chain, that let any user grant themselves admin control over marker accounts without holding any tokens, affecting 82 markers representing live financial assets on mainnet. The...
Trail of Bits gave GPT 5.6-Cyber preview access and tasked it with escaping a QEMU/KVM VM on a Debian 12, AMD Zen3 Linux host; the agent escaped three times, first via the Januscape kernel bug (CVE-2026-53359), then by combining libslirp CVE-2026-9539 with...
Trail of Bits found a bug in Lean's low-level string-slicing function, String.Pos.Raw.extract, where extracting a one-byte slice at an astronomically large position returns the empty string in Lean's logical definition but the entire original string in...
Trail of Bits published a post by Anish Naik, Dan Guido, Benjamin Samuels, and Marcelo Morales arguing that 1Password's AI patching benchmark is misleading. The post says the firm shares real-world data on human and agent patch quality from its consulting...
This is a Trail of Bits author index page for Benjamin Samuels, listing posts on topics including 1Password's AI patching benchmark, a GPT-5.5-Cyber zlib fuzzing campaign, Slither-MCP, and analyses of the $100M Balancer and $1.5B Bybit hacks. The page...
Trail of Bits published a rebuttal on its blog arguing that 1Password's August 6, 2026 report, which reported a 26% clean-fix rate for AI-generated patches, included trials where agents were deliberately instructed to apply the wrong fix and trials where...
Trail of Bits spent six months before a Miden VM audit having AI agents build an LSP server, a decompiler, a static analysis engine, and a Lean model of the VM executor from scratch, since the zero-knowledge VM's custom MASM assembly language had almost no...
Trail of Bits' Matt Schwager writes that SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed by XML complexity, canonicalization issues, enveloped signatures, and design ossification, leaving it open to...
A Trail of Bits post argues that SAML, created in 2002 by the OASIS Security Services Technical Committee, should be deprecated in favor of OpenID Connect because it is built on XML signature validation and canonicalization that remain vulnerable to XML...
Trail of Bits published a post by Paul Bottinelli on September 25, 2026, arguing that combining threshold signature schemes with trusted execution environments can strengthen MPC deployments. The post's stated position is that the TEE should be treated as...
Trail of Bits examines what happens when threshold signature schemes, a form of multi-party computation, run inside trusted execution environments, and finds that a malicious host can roll back the filesystem after a signer deletes a used pre-signature,...
Trail of Bits introduced SequenceHash and SequenceMAC, hash-agnostic multihashing constructions that work with SHA256/384/512, BLAKE, and RIPEMD rather than being tied to Keccak like NIST's TupleHash. The specification is open source and now part of the...
Trail of Bits tested 25 popular package managers against a simulated malicious repository and found fewer than half used lockfiles that checked for tampering by default, while only two verified the integrity of every package downloaded. Only Go verified...
Trail of Bits published two plugins, patching-bugs and regression-hunt, that let engineers delegate patch development and regression checks to AI agents. The post is framed around the question of what else an agent changes when it fixes a bug, and it...