Published file metadata, source observations, indicators, and research history in one bounded catalog.
35Reachable catalog records
2 / 2Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_b06996690e944145a1Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
35 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
What happens when you clear dozens of Trail of Bits engineers’ schedules, pair them with every open-source maintainer they can contact, and unleash the latest frontier models like GPT-5.5-Cyber on critical open-source targets? Thanks to our partnership with OpenAI and its Daybreak initiative, we can report that the impact is hundreds of discovered bugs, 64 pull requests, and 51 issues filed across
First reported Jun 22, 2026 16:50 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Uniswap v4 hooks let developers add custom behavior to pools, including dynamic fees, custom accounting, and external integrations. This flexibility moves some security responsibilities into application and hook code. The Cork and Bunni exploits are two app-level incidents that show what can go wrong in that code. Together, they account for more than $20M in losses. Neither incident stemmed from a
First reported Jul 30, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Public skill marketplaces are being flooded with malicious skills that steal credentials, exfiltrate data, and hijack agents. In response, a segment of the security industry released skill scanners, a new family of tools designed to detect malicious skills before they’re installed. But we tested them, and they don’t work. We recently bypassed ClawHub’s malicious skill detector, Cisco’s agent skill
First reported Jun 03, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
We’ve added a new chapter to our Testing Handbook: a comprehensive guide to security testing Rust programs. This chapter covers the tools and techniques we use at Trail of Bits to validate the security of Rust programs and systems. fn main() {(|f:&dyn Fn(u128)->Box< dyn Iterator+'static>|f(*[&( 0x7B736D70683F73u1288) ).take_while(|&n|n>0).map(|n|((n as u8)^0x1F)as char))as _)))} What’s in the chap
First reported Jul 13, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes. As part of our goal to “fix software, not bugs,” Trail of Bits is introducing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to de
First reported Oct 02, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning sin
First reported Sep 21, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.