AI Offensive and Defensive Security https://xitter.cf/t.co/zOBnfCjX2D
San Francisco Bay Area
Joined January 2024
- Tweets148
- Following3
- Followers478
- Likes337
Martian just released the industry's first independent code review benchmark. 12+ tools evaluated on real security patches.
CodeAnt AI: #1
We've disclosed 84 zero-day vulnerabilities in the last 1.5 months.
This is what we learned.
Every security tool you use runs on the same backbone CVEs and the NVD database. Your tool pulls those CVEs, scans your code, and tells you if you're affected.
That's it. That's the whole game.
But there's no single authority enforcing when vulnerabilities get disclosed. Google says 90 days. Some says 120 days.
And 67% of medium and low vulnerabilities aren't even reported as security issues, they are filed as performance fixes. Severity downgraded. Buried in changelogs.
Attackers don't wait for CVEs.
They don't care if it's disclosed or not. Offensive security is growing like crazy. If a vulnerability exists, someone will find it and weaponize it.
Your app is exposed. Your dashboard shows green.
We're going to change it!
Yesterday we published CVE-2026-29000, a CVSS 10 authentication bypass in pac4j-jwt.
An attacker with just the server's RSA public key can forge a JWT and log in as admin. No secrets needed. No user interaction. The key that's designed to be public is enough.
That was the finding.
Today we did something harder: we mapped the blast radius.
We scanned every downstream dependent of pac4j-jwt across Maven Central, GitHub, and build files across the ecosystem. Here's what we found:
→ 1000+ projects identified (just in opensource)
→ Including enterprise SSO servers used by universities and governments
→ Including health research infrastructure
→ Including national archival systems
The two currently maintained CAS release branches, 7.2.x and 7.3.x are both affected. CAS is the SSO server used by hundreds of institutions worldwide.
We're not publishing the list. That's a target menu.
Instead we're privately notifying every affected maintainer this week, with the CVE details, the patched versions, and our steps-to-verify guide. Our job is to help them fix it, not to help attackers find them.
17 projects have already patched. CAS master branch has updated to 6.3.3.
We'll publish the full patch adoption curve once maintainers have had time to respond.
Our AI Code Review just found a CVSS 10.0 vulnerability.
CVE-2026-29000
The highest possible severity.
It had been sitting in pac4j, a widely used Java authentication library, for nearly 6 years.
No static scanner found it.
No human reviewer found it.
Our AI code reviewer did.
This was a full authentication bypass caused by a logic gap between the JWT spec and the implementation in pac4j-jwt.
What this means:
An attacker can craft a malicious token and log in as any user, even admin.
no password
no credentials
no stolen session
They only need the server’s RSA public key, which is public by design.
Root cause:
the library accepts a class of token that should never bypass signature verification.
When it receives one, it skips the signature check entirely and builds an authenticated session from attacker-controlled claims.
Full technical write-up + working PoC below.
We don’t publish random benchmark claims.
We publish real world threats.
This is one of 87 vulnerabilities we’ve found so far, including issues affecting packages with 500M+ weekly downloads.
Kudos to @VulnCheckAI team for helping expedite the CVE assignment process.
@DezervHQ (Series B) x @CodeAntAI
Proud to support 100+ engineers with AI code reviews that ship faster & safer code!
Every morning should be like this 🚀
@CodeAntA - Your AI Code Quality & Security Reviewer.
Loved by 50+ fast-moving teams and enterprises.
