We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
New York, NY
Joined March 2010
- Tweets4.4K
- Following267
- Followers40.2K
- Likes722
Pinned Tweet
October Trail of Bits Tribune: Releasing a PHP exploit demo, new plugins for patching, and package-integrity research. Plus Brotli-checker, SequenceHash, and six new public security reviews.
Read the Tribune: mailchi.mp/trailofbits/octob…
Attackers can drain wallets by abusing a signing service, even without stealing private keys. Our 4-step post-Binance hack guidance helps wallet teams test what their signing systems can authorize and what limits the damage if signing is compromised.
blog.trailofbits.com/2026/11…
Trail of Bits retweeted
I find the “patch the planet” initiative quite inspiring. openai and others are spending huge sums of money on updating and securing all modern open source software infrastructure. it will be a continual effort to make the world more robust
This is the "upcoming cyber model" from yesterday. Besides 948 Linux vulns, it found 111 renderer RCEs in Firefox, among which, 81 were novel. 30 were exploits for bugs known to developers that were thought to be unexploitable.
We are using this technology to scan more OSS projects and secure the Internet infrastructure.
This is just a start.
Trail of Bits retweeted
Read the interview about how we approached our audits with @trailofbits @OpenZeppelin and @spearbit
Auditing such a novel software stack like Miden comes with interesting challenges. Trail of Bits has written some nice tooling even to make their lives easier
Miden’s product marketer Gaylord Warner ( @zkGaylord) had a chat with cryptography engineering lead François Garillot ( @huitseeker) and protocol engineer Marti Górny ( @mmagician)
Trail of Bits retweeted
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Trail of Bits retweeted
fresh fuzzy echidna, anyone? 🦔
Echidna 2.4.0 is out 🎉
🤖 MCP support for interactive fuzzing
🔬 considerably improved symexec via @argotorg hevm
⛓️ library autolinking with crytic-compile
🐛 fixes, reduced mem usage, and more
👉 github.com/crytic/echidna/re…
🍺 also on brew by now
Trail of Bits retweeted
Very interesting work by the OpenAI Cyber team
Stronger models needing less orchestration is also something we quickly realized while building our main auditing harness at Trail of Bits (Auditron)
Instead of strong constraints from the harness, that were needed with previous models, we now focus on four things: using different model families, coordinating their work, enforcing persistence, and providing the right tools/skills at the right time rather than fixed recipes
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
A cryptographically verified tally doesn't mean every vote is legitimate. Paper ballots still matter: they provide an audit record independent of software. We explain how electronic voting works, and how cryptography can make paper-based elections more trustworthy. blog.trailofbits.com/2026/11…
We’ll be at Devcon in Mumbai from Nov 3–4 at booth Starter 06 (3rd floor). If you’re building smart contracts, blockchain infrastructure or cryptographic systems, come chat with our engineers.
Stable software often ships with known bugs because the fixes are never backported. That backlog is now an easy target for cyber-capable agents.
We used Codex to cut time per backport from days to ~30 min, with 149 Linux kernel CVE fixes applied so far.
blog.trailofbits.com/2026/11…
Crypto hacks in 2026 are already 71% above the 2022–25 annual average, per DefiLlama.
AI helps attackers find bugs faster, and defenders need the same edge to fix them. At @summit_defi in Mumbai, @nisedo is sharing lessons from our AI auditing work, including Patch the Planet.
Trail of Bits retweeted
THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.
The reason? An Ethereum reorg.
One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH.
This triggered an “emergency pause” on THORChain, preventing all users, including DPRK’s money launderers, from using cross-chain swaps.
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.
Trail of Bits retweeted
Update following the Binance incident:
All markets are now unfrozen across Aave V3 and V4.
They were frozen as a precaution after initial reports, which paused new deposits and borrows while withdrawals and repayments continued as normal.
Aave contracts were unaffected by the incident and positions remained fully collateralized.
Trail of Bits retweeted
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-…
Trail of Bits retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
We achieved RCE via Brotli in Linux labs:
• Node.js 24.22.0 + Express 5.3.0 (x86-64/ARM64) through its standard JSON parser
• Electron 41.10.7 (x86-64) using a custom-built decoding service
Getting it to work requires a carefully matched setup and can take repeated attempts.
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/brotl…
Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB.
We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
teapawt.net/dguido/status/21131291…
Trail of Bits retweeted
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
teapawt.net/dguido/status/21131291…
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
