We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
October Trail of Bits Tribune: Releasing a PHP exploit demo, new plugins for patching, and package-integrity research. Plus Brotli-checker, SequenceHash, and six new public security reviews.
Read the Tribune: mailchi.mp/trailofbits/oc…
Attackers can drain wallets by abusing a signing service, even without stealing private keys. Our 4-step post-Binance hack guidance helps wallet teams test what their signing systems can authorize and what limits the damage if signing is compromised.
A cryptographically verified tally doesn't mean every vote is legitimate. Paper ballots still matter: they provide an audit record independent of software. We explain how electronic voting works, and how cryptography can make paper-based elections more trustworthy.
Stable software often ships with known bugs because the fixes are never backported. That backlog is now an easy target for cyber-capable agents.
We used Codex to cut time per backport from days to ~30 min, with 149 Linux kernel CVE fixes applied so far.
Crypto hacks in 2026 are already 71% above the 2022–25 annual average, per DefiLlama.
AI helps attackers find bugs faster, and defenders need the same edge to fix them. At @summit_defi in Mumbai, @nisedo is sharing lessons from our AI auditing work, including Patch the Planet.