A site with no feed of its own. Its index page is checked for new posts, which are read the same way. What Trove read and did not keep stays on file, not shown.
dfbench is a held-out benchmark maintained by depthfirst that scores frontier LLMs on defensive security work: vulnerability detection, validation (precision) and differential analysis between commits. It reports recall, precision, F1 and cost per task by model and thinking level, split by application, low-level and smart-contract code and by single or multi-repo scope. Overall detection recall runs from about 21% to 69%, with the top figure at $99.19 per task for Mythos 5; validation precision mostly falls between 15% and 49%.
Depth First Security's write-up describes three V8 bugs found using its dfs-large1 research tooling: CVE-2026-78938, a type confusion in Promise.prototype.finally that lets an internal helper be constructed and return a primitive; CVE-2026-79236, a TurboFan load-elimination bug that keeps a stale property-array pointer after object migration; and a shared WebAssembly memory sandbox escape (issue 546253900) caused by mismatched backing-store registration during serialization. It walks through turning each memory bug into addrof/fakeobj primitives, chaining either with the sandbox escape to reclaim a freed V8 isolate via a WebSocket allocation, and pivoting through a CFI-constrained ROP chain to achieve Chrome renderer code execution, earning two v8CTF flags. Fixes landed between August 20 and 25, 2026.
depthfirst describes a vulnerability scanner built on Jev, a classifier architecture that returns probabilities per option instead of generating tokens. The harness splits a repository into chunks, triages likely vulnerable code, then asks parallel true/false questions per CWE and for the attacker input path. Jev costs $0.042 per million input tokens, a scan takes about 2 seconds, and the context window is 32k tokens. Limitations include no multi-component reasoning.
dfbench v1 is depthfirst's held-out benchmark for AI agents doing defensive security work: 253 examples, 910 real vulnerabilities, 17 languages and 27 weakness classes. It scores detection recall, validation precision (estimated with a Kaplan-Meier "hotspot" analysis) and differential analysis across commits. Results show recall rising as precision falls for stronger models, and "closed" recall dropping at higher thinking levels.
dfs-large1 is depthfirst's vulnerability discovery and validation model, post-trained from GLM 5.2 with multi-task RL inside its security agent harness, in partnership with Fireworks AI. The report covers the reward design (effort penalty, finding budget), masked importance-sampling optimization, task-level advantage normalization, summarization-based context compaction and the sandboxed evaluation setup. It reports that the learned audit strategy moved from broad enumeration to hypothesis testing with executable harnesses. Benchmark numbers and the dfbench methodology are not given.
depthfirst's Open Defense Initiative scanned about 40 Ruby gems with native C extensions and validated 105 vulnerabilities across 34 projects, which together have over 8.6 billion RubyGems downloads. The post walks through four cases: a Nokogiri 32/64-bit index truncation (CVE-2026-57235), an Oj garbage-collection use-after-free (CVE-2026-54902), a concurrent-ruby read/write lock bit overflow (CVE-2026-54905) and an sqlite3-ruby block lifetime bug (CVE-2026-54619). It also states that this work led to the earlier GitLab RCE chain through Oj.
RubyRubyGemsNokogiri+6
CVE-2026-57235CVE-2026-54902CVE-2026-54905+6
AppSec, Supply Chain, AI Security· 2026-07-27T12:00:00+00:00
Depthfirst's research describes an RCE chain against GitLab CE/EE (versions 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1) built from two memory-corruption bugs in the Oj Ruby JSON gem, reachable through the ipynbdiff notebook-rendering feature. It walks through an out-of-bounds write that corrupts a parser callback pointer, a heap-pointer disclosure used to defeat ASLR, and the gadget chain that reaches system() as the git user, plus nine additional Oj CVEs found during the same review.
depthfirst reports 21 zero-day memory-safety bugs in FFmpeg found by its autonomous security agent for about $1k, nine with CVEs (CVE-2026-39210 to CVE-2026-39218). Bugs span the TS, DASH, AVI and CAF demuxers, RTP/RTSP depacketizers, swscale and the VP9 decoder, some latent since 2003. It details the AV1 RTP depacketizer heap overflow, which overwrites AVBuffer.free to reach PC control from one 183-byte packet.
FFmpegCAnthropic
CVE-2026-39210CVE-2026-39211CVE-2026-39212+22
AppSec, Offensive Security, AI Security· 2026-06-02T12:00:00+00:00
dfs-mini1 is a vulnerability detection agent from depthfirst, built on gpt-oss-120b and post-trained with reinforcement learning on thousands of Kubernetes sandboxes of historical smart contract audits. On OpenAI's EVMBench Detect it reaches state of the art at pass@8, at 10-30x lower total cost than frontier models. The post covers 32k context with summarization-based compaction, a shell-only toolset that discourages Slither, transfer to an internal CVE benchmark, and a rise in false positives.
CVE-2025-14986 is an identity-binding flaw in Temporal's ExecuteMultiOperation endpoint. The outer request was authorized for one namespace, but inner StartWorkflow operations carried a different namespace that the server used for policy and schema preparation while persisting under the authorized one. The post shows the Go code, two exploits (cross-tenant schema access and policy bypass), and the v1.27 fix, with timeline December 2025 to January 2026.
CVE-2026-25253 is a 1-click RCE chain in OpenClaw (formerly Moltbot/ClawdBot), found by depthfirst. A gatewayUrl query parameter is persisted and auto-connected, leaking the auth token to an attacker's WebSocket server. The author then uses Cross-Site WebSocket Hijacking against ws://localhost:18789 and disables exec approvals and sandboxing through the API to run commands. Versions up to v2026.1.24-1 are affected; the patch adds a confirmation modal.
CVE-2025-64721 is a Sandboxie vulnerability in the SYSTEM service SboxSvc.exe, reachable over the raw ALPC port \RPC Control\SbieSvcPort. The RC4Crypt handler never checks value_len against the message length, giving an out-of-bounds heap read and, via a 32-bit integer overflow (0xFFFFFFF1), a 4GB heap write. The post explains a two-thread vtable-hijack plan to escape the sandbox. It was reported and patched on 12 November 2025.
SandboxieWindowsALPC+1
CVE-2025-64721sandbox escapeinteger overflow+4
Offensive Security, Malware & RE, AppSec· 2025-12-23T00:00:00+00:00
depthfirst describes how it raised its agent's success rate on the CyberGym vulnerability-reproduction benchmark from about 22-30% to about 53%, against a prior best of about 28% (Sonnet-4.5). Gains came from telling the agent about the fuzz harness, running it in the same image as the PoC with edit and recompile tools, a dedicated instrumentation agent, and subagents. Results use a 50-example dev set and the ARVO subset; the post notes the system is tuned to CyberGym.
OSS-FuzzARVOGPT-5+2
CyberGymdepthfirst
AI Security, Offensive Security· 2025-11-24T00:00:00+00:00
An XSS in esbuild's dev server, present since 2022: escapeForHTML does not escape double quotes, yet its output was placed inside an href attribute in the directory listing. A folder name containing a quote breaks out of the attribute, and the payload adds a full-screen style plus an onmouseover handler. The fix swapped in escapeForAttribute. Maintainers merged it but said the dev server assumes a trusted environment, so it was not a security vulnerability.
CVE-2025-59304 is a critical path traversal (CWE-22) in Swetrix Web Analytics. CdnService.uploadFile built a temp file path from the unsanitized file.originalName, so ../ sequences let an attacker overwrite files such as the app entrypoint and get RCE on restart. The depthfirst platform generated the fix, which replaces the name with a UUID and keeps only the extension (Pull Request #397).
CVE-2025-59419 is an SMTP command injection in Netty's SMTP codec, found by depthfirst's autonomous security agent. The codec accepted \r\n in user input such as the RCPT TO recipient, letting an attacker inject extra SMTP commands and forge senders. The forged mail passes SPF, DKIM and DMARC, enabling BEC and phishing. Maintainers merged the agent-generated patch, citing Netty's existing HTTP codec validation.
CVE-2025-59305 is a missing authorization flaw in Langfuse's tRPC background-migrations router. Endpoints for retry, list and status used protectedProcedure, which checks login but not admin role, so any self-registered user could restart migrations and cause data corruption or denial of service. Reported and patched on 9 September 2025 with a new adminProcedure; disclosed 15 September 2025. The post also argues SAST tools and AI code assistants miss AuthN vs AuthZ gaps.
depthfirst.comarticle
