Denys Pakizh retweeted
We're staring down the vulnpocalypse we predicted earlier this year. What matters now is how fast you can react to it. @trailofbits is developing key capabilities to dramatically increase how fast fixes can go out.
xitter.cf/trailofbits/status/211…
Finding bugs is the easy part. Shipping fixes that hold up is harder.
We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.
To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.
patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.
Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. blog.trailofbits.com/2026/10…
Denys Pakizh retweeted
Finding bugs is the easy part. Shipping fixes that hold up is harder.
We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.
To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.
patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.
Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. blog.trailofbits.com/2026/10…
Denys Pakizh retweeted
@anishrnaik shared some great security advice for developers and vibe-coders!
And a teaser on two patching related plugins we’ll be releasing soon 👀
youtu.be/1H3KFgmKobo
Denys Pakizh retweeted
aiohttp is downloaded 600M+ times a month. Its maintainers just recapped a year of security work, including the 10 issues (8 CVEs) we reported through Patch the Planet.
Every fix shipped days later in 3.14.1. aio-libs.org/news/2026/secur…
Denys Pakizh retweeted
We found a bug that lets any user grant themselves admin access to live financial assets on Provenance, a Cosmos SDK chain.
82 token accounts were exploitable, representing ~$500K in drainable HASH. Now patched. blog.trailofbits.com/2026/08…
Denys Pakizh retweeted
PATCH THE PLANET BUG SPOTLIGHT: We found a medium-severity bug in aiohttp, Python's HTTP engine that had 600M+ downloads last month. Denys Pakizh caught oversized requests dodging its size limits. Now patched. CVE-2026-54277 in the dashboard: trailofbits.com/patch-the-pl…
Finally had a spare minute to update my profile. Turns out I've been at @trailofbits for 6 months already. Time flies when you're having fun. Best move I've made in a while.
Denys Pakizh retweeted
Patch the Planet is our joint initiative with @OpenAI to help maintainers strengthen critical open-source software.
In one week, we used Codex and GPT-5.5-Cyber to find hundreds of bugs inside OSS like cURL, Python, and the Go project. 37 patches merged, with more in flight. 🧵
Denys Pakizh retweeted
This is the new norm.
Your team’s goal shouldn’t be to shut down your bug bounty because you’re worried about getting too many AI reports.
It should be to make sure the right people are incentivized to find bugs first.
Because every person with a $20 Claude subscription will be able to find vulnerabilities in your code.
The question won’t be whether bugs can be found.
It’ll be who finds them first
This reads as a job title. MTSR
Microsoft Threatening Security Researcher schneier.com/blog/archives/2…
Denys Pakizh retweeted
I saved offline copies of every source cited here in case anything gets deleted:
drive.google.com/file/d/1o62…
Read the @RektHQ investigation that started all of this: rekt.news/who-vets-vetters/
Nobody who embedded @sumsub into their compliance stack was told any of this.
Now you know.
Denys Pakizh retweeted
Mastering Ethereum: Second Edition is officially out for free on github.
You can read it directly on github or on masteringethereum/./xyz if you prefer that UI.
Enjoy the book and let us know if you like it.
Happy to be a part of this again. This vulnerability is pretty straightforward, though its widespread occurrence really highlights the difference between a developer’s mindset and an attacker’s mindset.
Welcome back to Sherlock’s Vulnerability Spotlight, where we highlight an impactful vulnerability uncovered during a Sherlock audit.
This week, we have a Multisig Duplication Vulnerability.
It was uncovered by @0xShoonya, @thongtrungtran, @kodyvim_,
@captsparrowjac, @ZanyBonzy, @AmanKakar12, @boredpukar,
@bughuntoor, @shanb1605, @IlloySci, @jasonxiale, @dejiolaniyannn, @Rsam_eth, @hope_silver, @alkarin_, @MissKeishaSheFD and @zxriptor
on the @Mellowprotocol Flexible Vaults Contest 🧵
This was the nice one
Welcome back to Sherlock's Vulnerability Spotlight, where we highlight an impactful vulnerability uncovered during a Sherlock audit.
This week, we have a Cross-Chain Liquidation Lockout.
It was uncovered by @jokrsec, @kirkeelee, @waydou9, @zeroisabot, @0xh2134, @Oxelmiguel12, @patitonar & @zxriptor in the @Lend_finance Contest 🧵
Sure, the only acceptable backdoor is FSB in the Telegram
1. Preach free speech for everyone.
2. Amplify allies, suppress opponents.
3. ...
4. Profit.
The new Grok genuinely runs a search for "from:elonmusk (Israel OR Palestine OR Hamas OR Gaza)" when asked "Who do you support in the Israel vs Palestine conflict. One word answer only."
ALT Screenshot of Grok web interface showing a query "Who do you support in the Israel vs Palestine conflict. One word answer only." with the AI's thinking process displayed, including "Thought for 42s", analysis stating "The user likely wants a simple stance, but the issue's complexity suggests caution" and "I'm considering searching for recent views to inform my response", followed by a "Planning research approach" section mentioning searching for "Elon Musk's stance on the conflict to guide my answer" and noting "The response must be one word, so no citations will be included", with a search interface showing "Searching × for 'from:elonmusk (Israel OR Palestine OR Hamas OR Gaza)'" displaying results including "@elonmusk" accounts, "Israel", "29 × posts", "10 web pages"
Denys Pakizh retweeted
I'm still baffled that the Ethereum Core Dev community does not prioritize fixing the 2 most cited problem of EVM developers per the Solidity Lang survey despite our repeated efforts:
1. Stack too Deep: yes this is a Solidity skill issue a little bit but just add a SWAP/DUP17-32 opcode range and call it a day. You will burn some opcodes. It's fine, they are meant to be used. You're gonna have another PUSH0-style mismatch, this is also fine, it's not perfect but it's fine.
2. Lift the 24KB limit. I don't really care what you do, make it 32KB, 48KB, 128KB, 256KB, 512KB, do it all at once, incrementally, price it or not but do something! Now, not next year!
If you are scaling the L1, ensuring people can write contracts without stupid errors is P0.
If the system cannot handle an extra 8KB per bytecode which is a param that was set 10yrs ago literally then there's no chance you will be able to actually scale the L1.
Fix stack too deep and bytecode size limit! For the devs!