This blog post details security risks to consider when integrating AWS Nitro Enclaves with AWS KMS.

This blog post identifies seven recurring failure patterns in application and hook code, including missing caller checks and accounting bugs that still satisfy the PoolManager’s settlement invariant.

Over the first few weeks of Patch the Planet, our engineers found three techniques for using /goal, which hands Codex an open-ended objective and lets it work independently toward a success condition.

We’ve added a new chapter to our Testing Handbook: a comprehensive guide to security testing Rust programs.

In April we released Mewt, our open-source mutation-testing engine that finds the gaps in your test suite. Today we’re expanding it with support for DAML, the language Canton Network applications are written in.

A Patch the Planet field report: GPT-5.5-Cyber built a bespoke zlib fuzzing campaign in a single day, work that once took skilled researchers weeks.

We added post-quantum cryptography support to pyca/cryptography, the eleventh most-downloaded Python package on PyPI, putting quantum-resistant ML-KEM and ML-DSA algorithms one pip install away for the entire Python ecosystem.

Patch the Planet is our joint initiative with OpenAI to assist critical open-source software in the age of machine-speed vulnerability research.

We found hundreds of weak RSA and DSA keys with biased bits that we could quickly factor using a new polynomial-based cryptanalytic technique.

We recently bypassed ClawHub’s malicious skill detector, Cisco’s agent skill scanner, and all three of the scanners integrated into skills.sh.

We improved YAML anchor support in zizmor and tested it against 41,253 real-world GitHub Actions workflows from high-value open-source projects.

We built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard fuzzing workflow while using a stronger stack underneath.

Here is a walkthrough of our solutions to two C/C++ security challenges from the new C/C++ chapter in the Testing Handbook: a Linux ping program with an inet_ntoa global buffer gotcha and command injection, and a Windows driver with registry type confusion bugs that can escalate from local DoS to a kernel write primitive.

We added LibAFL support to Ruzzy, our coverage-guided fuzzer for pure Ruby code and Ruby C extensions. This gives Ruby developers and security researchers access to a more advanced and actively maintained fuzzing engine without changing how they write their fuzzing harnesses.

Trailmark turns source code into a security-analysis graph, powering eight Claude Code skills for blast radius, taint propagation, and mutation test triage.

Trail of Bits discovered and exploited memory safety and logic vulnerabilities in Google’s Rust zero-knowledge proof code to forge a proof claiming better quantum circuit performance metrics than Google’s original results, demonstrating unique security risks in zkVM systems.

We released a new Testing Handbook chapter providing a comprehensive security checklist for C and C++ code review, covering Linux, Windows, and seccomp environments.

Our audit of WhatsApp’s new “Private Inference” feature shows that trusted execution environments (TEEs) aren’t a silver bullet.

We’re releasing CoBRA, an open-source tool that simplifies the full range of Mixed Boolean-Arithmetic (MBA) expressions used in the wild.

Today, we’re announcing MuTON and mewt, two new mutation testing tools optimized for agentic use.

We had 5% buy-in and 95% resistance. A year later, AI-augmented auditors are finding 200 bugs a week on the right engagements. Here’s the six-part operating system we built, open sourced, and are giving away.

We released a Claude plugin that uses LLMs to annotate code with dimensional types and mechanically detect mismatches, achieving 93% recall versus 50% for baseline prompts when tested against real audit findings.

Dimensional analysis from physics can be applied to DeFi smart contracts to catch arithmetic and logic bugs by ensuring formulas maintain consistent dimensions across tokens, prices, and liquidity calculations. The post demonstrates how explicit dimensional annotations in code comments, like those used in Reserve Protocol, can prevent vulnerabilities and improve auditability.

After auditing dozens of ERC‑4337 smart accounts, we’ve identified six vulnerability patterns that frequently appear.

We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.