NEW#0001
Trail of Bits2 days ago5 min▣LLM reportlow Signal introduced Automatic Key Verification, a key transparency mechanism that creates a globally consistent, auditable map of phone numbers to public keys. This mitigates man-in-the-middle attacks where a compromised Signal server substitutes a false public key. Trail of Bits operates one of three independent auditors that sign Merkle tree heads, ensuring clients can verify they see the same key set as all other users. A malicious server can sustain a split view for at most seven days before clients raise warnings.
#0002Trail of Bits9 days ago8 min▣LLM reportmedium This article catalogs passive and active attack classes against the communication channel between AWS Nitro Enclaves and AWS KMS. Passive attacks include data swap attacks on encrypted data keys, CMK substitution via manipulable metadata, key commitment issues, and replay attacks within the 5-minute attestation validity window. Active attacks exploit the lack of cryptographic binding between attestation documents and request parameters, requiring enclave-initiated TLS with a pinned CA for mitigation. The authors also identify vulnerabilities in the aws-nitro-enclaves-sdk-c library and recommend alternative SDKs.
#0003Trail of Bits15 days ago8 min▣LLM reportmedium Trail of Bits analyzed dozens of audit findings and real-world exploits to identify seven recurring failure patterns in Uniswap v4 hook development. The Cork ($12M) and Bunni ($8.4M) exploits demonstrate that while the v4 PoolManager enforces protocol-level settlement invariants, application-specific hook code remains vulnerable to missing caller checks, unvalidated pool trust, accounting bugs, hook timing errors, permission bit mismatches, callback blocking, and state mutation during nested callbacks. These patterns serve as a secure-development checklist for builders and a review framework for auditors.
#0004Trail of Bits17 days ago5 min▣LLM reportlow This article is a methodology writeup from Trail of Bits describing how they leverage OpenAI Codex's '/goal' autonomous agent feature within the 'Patch the Planet' initiative to conduct large-scale vulnerability research and variant analysis against major open-source projects (Rust, curl, zlib, Keycloak, kubernetes-client). It details prompt-engineering lessons learned (letting the model draft its own goal, defining outcomes precisely without prescribing method, and assigning one outcome per agent) and describes an automated Rust P-critical variant-analysis pipeline with a two-pass validation gate before human review. No specific exploit details, IOCs, or CVE numbers for the discovered bugs are disclosed in this post.
#0005Trail of Bitsabout 1 month ago4 min▣LLM reportlow Trail of Bits has published a comprehensive new chapter in their Testing Handbook dedicated to security testing of Rust programs. The chapter covers dynamic analysis (Miri, proptest, coverage, mutation testing), static analysis (Clippy lints), manual review checklists for Rust-specific footguns, memory zeroization techniques, model checking with Kani, and supply chain vetting tools. Additionally, a Claude Code plugin called rust-review was released for automated Rust security reviews.
#0006Trail of Bitsabout 1 month ago6 min▣LLM reporthigh Trail of Bits and OpenAI's Patch the Planet initiative used GPT-5.5-Cyber to autonomously build a bespoke fuzzing harness for zlib in a single day, discovering multiple vulnerabilities now undergoing coordinated disclosure. The model independently chose dynamic fuzzing over static review, wrote C/C++ harnesses across a dozen entrypoints, used ASan/UBSan builds and compile-time variants, and demonstrated disciplined reporting by filtering out unreachable crashes. This represents a significant shift in the threat model: the expertise barrier for bespoke fuzzing has collapsed, making large-scale vulnerability discovery accessible to both skilled researchers and low-skill attackers.
#0007Trail of Bitsabout 1 month ago5 min▣LLM reportlow Trail of Bits, funded by the Sovereign Tech Agency, has implemented NIST-standardized post-quantum primitives ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in pyca/cryptography version 48, making them available across the Python ecosystem via pip. The release includes Rust bindings, a cross-binding API, and AWS-LC backend support. Migration to post-quantum cryptography is not a drop-in replacement due to significantly larger key, signature, and ciphertext sizes that require protocol-level changes, and integration into real-world protocols like TLS and SSH is still ongoing.
#0008Trail of Bitsabout 2 months ago4 min▣LLM reportinfo Trail of Bits introduced the 'Patch the Planet' initiative, leveraging frontier AI models to identify and remediate vulnerabilities across critical open-source projects. The effort highlights a paradigm shift where AI accelerates bug discovery, making triage, patching, and disclosure the primary challenges for maintainers.
#0009Trail of Bits2 months ago4 min▣LLM reporthigh Researchers identified a cryptographic vulnerability in the wild where 'short-sleeve' RSA and DSA keys contain heavily biased zero bits, allowing rapid factorization using polynomial-based cryptanalysis. The flaw was traced to a type mismatch in the key generation code of older CompleteFTP versions, prompting the release of detection and remediation tools.
#0010Trail of Bits2 months ago6 min▣LLM reporthigh Security researchers successfully bypassed multiple AI agent skill scanners, including ClawHub, Cisco's skill-scanner, and skills.sh integrations, using techniques like file truncation, embedded payloads, Python bytecode poisoning, and prompt injection. The findings highlight that automated scanning of AI agent skills is fundamentally flawed due to the complex mix of natural language, code, and limited scanner context windows, necessitating a shift towards curated, trusted skill repositories.
#0011Trail of Bits3 months ago4 min▣LLM reportinfo Trail of Bits collaborated with the maintainers of zizmor, a GitHub Actions static analyzer, to improve its parsing capabilities and robustness. By testing against a massive corpus of real-world workflows, they identified and fixed multiple YAML anchor handling bugs, deserialization edge cases, and expression evaluator flaws, significantly enhancing zizmor's ability to detect CI/CD misconfigurations.
#0012Trail of Bits3 months ago3 min▣LLM reportinfo Trail of Bits has released gosentry, an enhanced fork of the Go toolchain designed to significantly improve native Go fuzzing capabilities by integrating LibAFL and Nautilus. The tool allows security researchers and developers to perform struct-aware and grammar-based fuzzing, successfully identifying complex vulnerabilities such as integer overflows, data races, and goroutine leaks that standard Go fuzzing often misses.
#0013Trail of Bits3 months ago6 min▣LLM reporthigh The article details two C/C++ security vulnerabilities based on code challenges. The first is a Linux command injection flaw caused by the inetntoa function's global buffer reuse and inetaton accepting trailing garbage. The second is a Windows driver Local Privilege Escalation (LPE) vulnerability stemming from missing RTLQUERYREGISTRYTYPECHECK flags during RtlQueryRegistryValues API calls. This omission allows attackers to leverage registry type confusion (e.g., using REGBINARY or REGSZ instead of REGDWORD) to overwrite kernel stack memory via writable keys in trusted system hives.
#0014Trail of Bits3 months ago2 min▣LLM reportinfo Trail of Bits detailed the technical process of integrating the LibAFL fuzzing engine into Ruzzy, their coverage-guided fuzzer for Ruby. The integration required resolving ELF linker constraints with .preinit_array sections and adjusting shared object loading to satisfy LibAFL's strict coverage map initialization requirements.
#0015Trail of Bits3 months ago3 min▣LLM reportinfo Trail of Bits has released Trailmark, an open-source library that converts source code into queryable call graphs to enhance AI-assisted security analysis. By integrating with Claude Code, Trailmark enables advanced mutation testing triage, blast radius analysis, and the identification of architectural bottlenecks in cryptographic libraries.
#0016Trail of Bits3 months ago4 min▣LLM reporthigh Trail of Bits researchers successfully forged a zero-knowledge proof for a quantum circuit by exploiting memory safety and logic vulnerabilities in Google's Rust-based zkVM prover. By leveraging unsafe deserialization and register aliasing, they bypassed resource counters and quantum reversibility constraints, demonstrating critical attack surfaces in modern zero-knowledge proof implementations.
#0017Trail of Bits3 months ago4 min▣LLM reportinfo Trail of Bits has published a new C/C++ security checklist in their Testing Handbook, detailing common bug classes, API gotchas, and environment-specific vulnerabilities across Linux and Windows. The guide serves as a foundation for manual code review and highlights specific issues like libc quirks, Windows driver registry flaws, and seccomp/BPF sandbox bypasses.
#0018Trail of Bits3 months ago4 min▣LLM reporthigh An audit of WhatsApp's Private Inference feature revealed critical implementation flaws in its Trusted Execution Environment (TEE) deployment. Vulnerabilities included unmeasured environment variables, unverified ACPI tables, and missing attestation freshness guarantees, which could have allowed attackers to bypass privacy protections and access plaintext data before Meta patched the issues.
#0019Trail of Bits3 months ago3 min▣LLM reportlow Trail of Bits has open-sourced CoBRA, a highly effective tool designed to deobfuscate Mixed Boolean-Arithmetic (MBA) expressions commonly used by malware authors and software protectors. Available as a CLI tool, C++ library, and LLVM pass, CoBRA successfully simplifies nearly 100% of complex MBA expressions, significantly aiding reverse engineering and malware analysis efforts.
#0020Trail of Bits3 months ago3 min▣LLM reportlow Trail of Bits has introduced MuTON and mewt, advanced mutation testing tools designed to identify untested code paths in smart contracts and blockchain applications. These tools leverage Tree-sitter for accurate syntax parsing and integrate with AI agents to optimize testing configurations and triage results, addressing the historical performance limitations of mutation testing.
