Adding Build Provenance to Homebrew

Security flaws in an SSO plugin for Caddy

Holy Macroni! A recipe for progressive language enhancement

Pitfalls of relying on eBPF for security monitoring (and some solutions)

Announcing the Trail of Bits Testing Handbook

The future of Clang-based tooling

Finding bugs in C code with Multi-Level IR and VAST

Trusted publishing: a new benchmark for packaging security

Real World Crypto 2023 Recap

Improving messages and types in GDB’s Python API

Escaping misconfigured VSCode extensions

Curl audit: How a joke led to significant findings

Readline crime: exploiting a SUID logic bug

Announcing a stable release of sigstore-python

ABI compatibility in Python: How hard could it be?

Look out: Divergent representations are everywhere

We sign code now

Stranger Strings: An exploitable flaw in SQLite

Porting the Solana eBPF JIT Compiler to ARM64

Are blockchains decentralized: New Trail of Bits research report examines

Themes from Real World Crypto 2022

Vulnerabilities Affecting Girault, Bulletproofs, and PlonK

Seriously, Stop Using RSA

Part 2 of 2: Implementing constant-time crypto using LLVM’s optnone

The Life of an Optimization Barrier

Disclosing Shamir’s Secret Sharing vulnerabilities and announcing ZKDocs

MUI: Visualizing symbolic execution with Manticore and Binary Ninja

A Year in the Life of a Compiler Fuzzing Campaign

Un-bee-lievable Performance: Fast Coverage-guided Fuzzing with Honeybee and Intel Processor Trace

Exploiting machine learning Pickle files

More →