Engineering notes, research, and deep dives from the team building Tolmo.
In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack in six weeks. The code never changed. The cost of looking at it did.
In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack in six weeks. The code never changed. The cost of looking at it did.
F5 just patched CVE-2026-93479, a heap off-by-one in nginx's script engine we reported in July. The bug took four days to fix and 81 to disclose. That gap made sense when critical bugs were scarce. They are not anymore.
Regular pentests, also known as black box pentests, require auditors to infer how a system works through reconnaissance, experimentation, as well as trial and error. A white box pentest gives them direct access to most of that information instead.
In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack in six weeks. The code never changed. The cost of looking at it did.
F5 just patched CVE-2026-93479, a heap off-by-one in nginx's script engine we reported in July. The bug took four days to fix and 81 to disclose. That gap made sense when critical bugs were scarce. They are not anymore.
Regular pentests, also known as black box pentests, require auditors to infer how a system works through reconnaissance, experimentation, as well as trial and error. A white box pentest gives them direct access to most of that information instead.
MikroTrick, an unauthenticated MikroTik RouterOS takeover chain, was exploited in the wild before the advisory shipped. We rebuilt the full exploit from the public advisory and patch diff in approximately three hours.
Fable 5 wrote a booting, NT-shaped kernel in Rust in 38 minutes. The code is impressive; the signal is what it tells us about AI-authored trust, and the verification frontier that decides whether the internet's critical infrastructure gets rewritten by models.
We are introducing Tolmo and announcing $22M from Accel and Y Combinator to build an always-on fleet of AI security agents for production environments.
A field guide to the techniques attackers hide inside npm, PyPI, and Crates packages, and the benign look-alikes that make them hard to catch.
