We tested 25 package managers against a simulated malicious repository. Without a lockfile, only Go and vcpkg cryptographically verified every download in our tests. Fewer than half checked for tampering through lockfiles by default.

Keegan Ryan explains where hashes and signature verification fall short, and how identity-based signing and transparency logs could help.

https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/

#supplychain #cryptography

Hashing several values together is easy to get wrong, and the mistakes can lead to forgeries. TupleHash only works with Keccak. Outside SHA-3, people roll their own multihashing, often insecurely.

We built SequenceHash to fix that for any hash function, with length-suffix encoding and protection against length-extension attack. https://blog.trailofbits.com/2026/10/02/sequencehash-multihashing-for-the-rest-of-us/

#cryptography #infosec #C2SP

MPC inside a Trusted Execution Environment (TEE) adds defense in depth, but the two make different bets on trust. MPC spreads trust across independent parties, while TEEs concentrate it in the hardware manufacturer and its attestation infrastructure. Our new post covers what TEE attestation can and can't fix in MPC deployments, the pitfalls we see most often in audits, and how to combine the two without undermining either.

https://blog.trailofbits.com/2026/09/25/dont-let-tees-break-your-mpc/

#infosec #cryptography #TEE

SAML was created in 2002 by merging four rival XML security protocols into one spec. That design still generates vulnerabilities: a canonicalization flaw via XML comments in 2018, XML round-trip bugs in Go's stdlib in 2020, a GitHub Enterprise SAML auth bypass in 2025, and more.

Matt Schwager breaks down 5 design flaws behind the pattern and makes the case for moving to OIDC.

https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/

#SAML #OIDC

Auditing Miden's zkVM core library (MASM, a custom assembly language), we found zero developer tooling: no editor, linter, or static analyzer.

We had Claude and Codex build an LSP server, decompiler, and static-analysis engine from scratch. 100+ AI commits later, it flagged 400+ unvalidated inputs, including one that could've forged Falcon signatures and drained accounts.

https://blog.trailofbits.com/2026/09/18/auditing-in-the-age-of-good-enough-ai/

#cryptography #staticanalysis

In the above blog, we share findings from our patch reviews and release two new agent skills: one to help agents test fixes and another to help engineers review them. Both are now available in our skills repo. https://github.com/trailofbits/skills

1Password's FLAWED report puts the AI clean-fix rate at 26%. That figure includes trials where agents were told to apply the wrong fix (22% of the data), trials with no build or test access (36%), and six CVEs selected for difficult fixes.

We analyzed 186 agent-authored Patch the Planet PRs. Maintainers merged 126 (67.7%). In 72% of merged PRs, maintainers kept the security fix we proposed. https://blog.trailofbits.com/2026/09/15/1passwords-ai-patching-benchmark-is-misleading/

Anthropic formalized Fermat's Last Theorem in 13M lines of Lean. We "proved" it in 20 lines by exploiting a bug we found in Lean.

Root cause: Lean's string slicing has two implementations, the logical definition and the compiled C++. At position 2^63 they disagree: one returns "", the other the whole input. This bug causes Lean to accept two contradictory facts, which then lets you "prove" anything, including FLT. https://blog.trailofbits.com/2026/09/09/a-proof-of-fermats-last-theorem-that-fits-the-margin/

#lean

OpenSSL's latest advisory covers 9 patched vulnerabilities. Our engineers Filipe Casal and Opal Wright found 4 of them as part of Patch the Planet.

The headline finding is CVE-2026-63072: a deterministic 8-byte heap overflow in CMS key unwrapping that an attacker triggers by changing one byte in a legitimate message. Reachable from CMS_decrypt() on every supported branch back to 1.1.1.

https://openssl-library.org/news/secadv/20260825.txt

#openssl #infosec

aiohttp is downloaded 600M+ times a month. Its maintainers just recapped a year of security work, including the 10 issues (8 CVEs) we reported through Patch the Planet.

Every fix shipped days later in 3.14.1. https://aio-libs.org/news/2026/security-at-aio-libs/

We gave GPT 5.6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents.

It escaped three times. The final escape came from three 0-days the agent found on its own and built into a working exploit after we patched known bugs and rebuilt QEMU from upstream.

Our takeaway is off-the-shelf VMs cannot contain a modern, cyber-capable agent.

https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/

#infosec #AIsecurity #linux

On Provenance (a Cosmos SDK chain), a user could administer a token account if they held 100% of its supply. A check compared their balance to the total supply.

But for many accounts that supply field was frozen at zero, so it just asked "is the balance zero?". Which meant any user that held zero tokens could get admin access.

We found 82 exploitable accounts holding ~$500K in drainable HASH. Now patched. https://blog.trailofbits.com/2026/08/25/state-divergence-enables-unauthorized-access/

#infosec #cosmos

We're a day-one auditor for Signal's new Automatic Key Verification, which lets your Signal app confirm it got your contact's real key.

The feature only holds if everyone sees the same key directory. As an external auditor, we check the directory everyone gets against our own.

We built our auditing software from scratch, open-sourced it, and run it as a public good. Github link in the blog.

https://blog.trailofbits.com/2026/08/11/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats

#signal #cryptography

A malicious host can attack your AWS Nitro Enclave through its connection to KMS.

It can't see inside the enclave, but it can swap encrypted data keys in storage, feed the enclave arbitrary plaintext, force the wrong CMK, replay attestations, and more. We wrote down the fixes in the blog: https://blog.trailofbits.com/2026/08/05/a-few-notes-on-aws-nitro-enclaves-kms-integration/

#infosec #cryptography

Both Black Hat keynotes this year are about AI and vulnerability research: "The End of Rare" and "Vulnerability Research in the Agentic Age."

Our entire company restructured around AI a year ago. Select engagements went from 15 bugs a week to 200. In just the past two months we found 1,000+ issues in cURL, Python, Go, and other open-source projects.

We'll be in Vegas this week. Book time: https://meetings.hubspot.com/trailofbits/blackhat-defcon-scheduling

#BHUSA #DEFCON

Patch the Planet update: 1,137 issues found (+279 since July 20), 866 awaiting a patch, 125 fixes open upstream, 146 merged across 46 open-source projects.

https://trailofbits.com/patch-the-planet/dashboard/

#infosec #opensource

PATCH THE PLANET BUG SPOTLIGHT: We found a high-severity use-after-free bug in nginx, the web server handling over 30% of all websites in the world. Now patched.

Remote and unauthenticated, it can crash nginx and potentially run code, all through HTTP/3. Engineer Evan Hellman found it with Codex after roughly 14 hours of automated analysis. CVE-2026-42530 in the dashboard: https://trailofbits.com/patch-the-planet/dashboard/

#infosec #nginx #http3

Agentic AI headlines Black Hat's keynotes and DEF CON's main stage next week, and it's a topic we've been researching for years. We've hijacked multi-agent systems with one web page, pulled Gmail data from Perplexity's Comet via prompt injection, and built image-scaling attacks invisible to humans but not models. All documented on blog.trailofbits.com.

We'll be in Vegas Aug 4-6. If you're around, we'd love to chat: https://meetings.hubspot.com/trailofbits/blackhat-defcon-scheduling

#infosec #aisecurity

Attackers drained $20M+ from protocols built around Uniswap v4 hooks.

The two largest were Cork (~$12M) and Bunni ($8.4M). Neither came from bugs in the PoolManager, Uniswap v4's central contract. The failures came from application and hook code.

We analyzed dozens of audit findings to isolate seven ways hooks break, and created a checklist for keeping these bugs out of production. https://blog.trailofbits.com/2026/07/30/building-secure-uniswap-v4-hooks/

#infosec #DeFi #smartcontracts

858 potential bugs found, 595 awaiting patches, 120 fixes open upstream, 143 merged.

Patch the Planet's latest numbers are now on a public dashboard that covers 41 codebases, including curl, OpenSSL, Keycloak, containerd, and kubernetes-client.

The 13 CVEs assigned so far include a high-severity nginx bug (CVE-2026-42530) and findings in curl, aiohttp, go-jose, and cryptography.

Every accepted fix links to its upstream PR.

https://trailofbits.com/patch-the-planet/dashboard

#opensource #security