Trail of Bits

We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.

[Trail of Bits @trailofbits]

September Trail of Bits Tribune: Fact-checking 1Password's AI patching benchmark, and a signature-forgery bug in Miden's zkVM. Also: a string-slicing bug in Lean, 27 advisory submissions to OpenClaw, and seven new security reviews.

https://t.co/P2His9ZSY8

[Jason Koebler @jason_koebler]

wrote about "Black October," the PHP vulnerability, and the AI-fueled dread and panic I'm seeing among almost all of the cybersecurity experts I've ever known:

https://t.co/hBpkhlGxci

[Reuters @Reuters]

Five ways to keep safe online in the wake of AI-supercharged hacking https://t.co/nJ0jrQOWNF https://t.co/nJ0jrQOWNF

[Trail of Bits @trailofbits]

We got a PHP exploit working against MediaWiki, but getting freed memory reused just right takes some tinkering under normal traffic.

LLMs struggle here without an expert's guidance, which may help explain the attempts but no confirmed successes.

[Dan Guido @dguido]

Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
https://t.co/mSr6Vkc4pj

[Dan Guido @dguido]

Attackers have agents hunting for bugs. We need agents writing patches just as fast. @trailofbits is doing the work to make this happen reliably:
https://t.co/4tLL7kAntD

[The Modern Market Show @modernmarket_]

Giving AI access to your money? Start by limiting the blast radius.

@anishrnaik, Principal Security Engineer at @trailofbits, on giving AI agents access to wallets, code and infrastructure.

00:00 Meet Anish from Trail of Bits
02:46 Patch the Planet
05:06 Package managers and hidden dependencies
09:34 Dependency alerts and package selection
12:27 Limiting an AI agent’s blast radius
15:47 Can AI fix bugs without creating new ones?
21:54 Hardware wallets and the wider security stack
26:43 AI attackers and defenders
28:53 OpenAI reports and what comes next

[Trail of Bits @trailofbits]

“You want to find the bugs, but it’s only good if you can also fix them.”—@anishrnaik on Risky Biz.

Many open-source projects have only a handful of maintainers, and fixes are falling behind. We’re building a reusable toolkit to help.

Full pod: https://t.co/iRUTXnGnTr

[Trail of Bits @trailofbits]

Yesterday, rumors started circulating about two unpatched critical-severity bugs in PHP.

Within 17 hours, Cloudflare was blocking attacks and Patchstack reported active exploitation.

When AI can develop a working exploit in hours, bugs need to be patched just as fast.

Each day without a fix carries the risk that an attacker will find and exploit the bug. But it takes time to create a working patch, and PHP's patch was more complex than most.

The patch changed 402 files and added more than 11,000 lines, reworking core engine behavior that dozens of extensions depended on. The bug was reported on Aug 11, and fixes were shipped 71 days later. But less than a day after details leaked, systems running PHP were already under attack.

Patching needs to keep up with the pace of bug discovery. For the past four months, we’ve worked directly with open-source projects as part of Patch the Planet to understand how AI can expedite patching. Our ongoing research and work show that project-specific documentation, skills, and plugins can be embedded at the repo level to give agents and contributors access to the context maintainers carry in their heads: what counts as a bug, how a fix should look, and what can't break.

Our two new open-source plugins, patching-bugs and regression-hunt, are a first step toward a generalized set of tools and guidance for getting a working patch out faster: https://t.co/OjS56EB3pg

PHP’s account of the incident: https://t.co/bLrmTmBkA9

[Dan Guido @dguido]

We're staring down the vulnpocalypse we predicted earlier this year. What matters now is how fast you can react to it. @trailofbits is developing key capabilities to dramatically increase how fast fixes can go out.
https://t.co/4tLL7kAntD

[Trail of Bits @trailofbits]

Finding bugs is the easy part. Shipping fixes that hold up is harder.

We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.

To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.

patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.

Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. https://t.co/OjS56EAvzI

[Trail of Bits @trailofbits]

We’re heading to Mumbai for @EFDevcon 8 to talk security with Ethereum builders. Meet our team at booth Starter 06, November 3–4, to talk about what you're building, where it can fail, and how to test it.

[Devcon 8 | Mumbai, India 🇮🇳 @EFDevcon]

We're excited to welcome @trailofbits as a supporter of Devcon 8!🎉

With over a decade of experience in security research, Trail of Bits helps teams identify vulnerabilities, strengthen their code & build more secure systems.

Meet their team in Mumbai at their booth on Nov 3–4.

[Orange Zone @OrangeZoneAI]

Google tried to keep a quantum weapon secret using zero-knowledge proofs. It lasted 63 days.

In March, Google Quantum AI published a new version of Shor's algorithm aimed at secp256k1, the elliptic curve that protects every Bitcoin and Ethereum wallet. It needs roughly 1,200 logical qubits, a dramatic improvement over everything before it.

Then Google did something no one had done before. It didn't publish the circuit. It published a zero-knowledge proof that the circuit exists, which certifies the attack is real without revealing the attack.

Then the experiment started to break.

Six weeks later, @trailofbits found memory bugs in Google's Rust prover. They forged a valid proof for a circuit that claimed zero Toffoli gates, an attack that cannot exist. It passed verification with the same key as the original. Google patched it.

On day 63, André Schrottenloher of Inria published his own circuits, rebuilt independently from Google's public papers. They matched Google's qubit counts and needed fewer gates. The hidden weapon was now open source, and slightly better.

Google researcher Craig Gidney confirmed the match and wrote: "We should just publish openly."

Zero-knowledge proofs were built to hide your balance, your identity, your vote. Here, a cryptographic tool was used to hide a weapon against cryptography, and both the hiding and the secret failed within one quarter.

The lesson isn't that ZK is broken. A proof is only as honest as the code that checks it. And in mathematics, a secret doesn't stay a secret just because it's hidden: once the world knows an answer exists, someone finds it.

The only thing still protecting Bitcoin from this attack isn't secrecy. It's hardware, and hardware gets better every year.

[josh avant @joshavant]

@GeoffreyHuntley @bot @poteto We've been taking security very seriously at OpenClaw for a while now. We just completed a Trail of Bits audit, publish our security advisories unlike every other agent product, and have alot more coming in this department!
https://t.co/kAsy5IGg4y

[Dan Guido @dguido]

You’d expect a lockfile to make a dependency immutable. But often it doesn’t: a hacked repository can swap in malicious code for the **same package and version**, and most package managers install it anyway.
https://t.co/D0WvK0yUb2

[Colin O'Brien @InsanityBit]

prompt: "Read the last year of Trail of Bits posts and consider implications for witchy."

It's free security.

[Trail of Bits @trailofbits]

We tested 25 package managers against a simulated malicious repository. Without a lockfile, only Go and vcpkg verified every download in our tests. With a lockfile, it's fewer than half.

https://t.co/bFh0NIfhmG

[Trail of Bits @trailofbits]

"Every one of these maintainers has these two wolves in them."

@thebensams on @hackaday's FLOSS Weekly, on why some maintainers go all-in on AI agents and others, a lot of them in Rust, won't unless they're forced to. https://t.co/pkAmIox1KG

[breakpoint @breakpointblog]

Hash several inputs by concatenation and the boundaries vanish: different sequences give the same SHA-256 digest.

Trail of Bits' SequenceHash appends each input's length as a fixed 128-bit integer, so every sequence encodes one way. Rust, Go and Python.

https://t.co/yDu0WNiDwI

[Nik Kale @nik_kale]

Credit to Trail of Bits for showing where agents pay off before a security review even starts.

For one audit they spent six months having agents build the tooling first: an LSP server, a decompiler, a static analysis engine and a Lean model of the VM. The analyses flagged 400+ places where type validation could be tightened. The Lean work produced 95 machine-checked correctness proofs.

Their line: "Today, a failed side project only costs tokens."

https://t.co/eE9zxEwpbt

[Kamui Finance @KamuiFinance]

We're excited to announce that @trailofbits, an independent security research firm, has completed a security review of Kamui's RWA infrastructure.

[Arbitrum @arbitrum]

We’re bringing together some incredible teams across the Arbitrum ecosystem to support founders building at Founder House Singapore.

> @Dune
> @Paxos
> @ZeroDev
> @GMX_IO
> @trailofbits
> @pendle_fi
> @Quicknode
> @RobinhoodCrypto
> SBI Digital Markets

Innovating across tokenization, AI and programmable finance?

Join us and Robinhood Chain in Singapore from October 23rd-25th.

Register here:

https://t.co/CiPUAk7Z16