English
Spearbit
Report

Spearbit✓

@spearbit

Industry Leading Web3 Security. Request a security review here ➡ https://t.co/gqs2f17Yhd

34 Following14.4K Followers2.2K Posts
  1. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: more than $6 million have been awarded to security researchers hunting on the Cantina bug bounty platform. day and night, security researchers act as the digital vanguard of the tech world, protecting millions of users, preventing catastrophic scenarios and proving how much brilliant minds of all ages can safeguard the future of technology. we all thank you for your service.
    050132
  2. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: we pointed Apex at a software used to secure billions of devices across VPNs, smart homes, and even healthcare billing systems. in its search, Apex found 2 ways that an attacker could have tricked applications using wolfSSL into exfiltrating sensitive information to a malicious server controlled by the bad actor, diverting it from its intended destination. wolfSSL responded quickly and fixed both in 5.9.4. if you use an affected configuration, update to 5.9.4 or later immediately. the technical breakdown of both vulns:
    040115
  3. Spearbit✓@spearbit
    we've been busy.
    Cantina 🪐 @cantinasecurity
    we’ve been shipping! two weeks ago we announced our very first open-weights model: apex-flash-1, powered by the same security research behind Apex’s bug discoveries in Apple, Coinbase and many others. on top of this, we've added several enhancements to make any security expert's life easier: - now you can chat with Clarion to generate a security agent and write its skills. just tell it what you want it to do. - Apex's Connection Panel makes getting started with your coding agent easier, as does finding scores for your policy. - Clarion now categorizes results from Amazon Inspector that have the same fix, drastically reducing the amount of sorting you have to do. check all updates:
    0071.3K
  4. Cantina 🪐✓@cantinasecurity
    we’ve been shipping! two weeks ago we announced our very first open-weights model: apex-flash-1, powered by the same security research behind Apex’s bug discoveries in Apple, Coinbase and many others. on top of this, we've added several enhancements to make any security expert's life easier: - now you can chat with Clarion to generate a security agent and write its skills. just tell it what you want it to do. - Apex's Connection Panel makes getting started with your coding agent easier, as does finding scores for your policy. - Clarion now categorizes results from Amazon Inspector that have the same fix, drastically reducing the amount of sorting you have to do. check all updates:
    Download
    54353.5K
  5. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: when prompt injection hits an agent, it can trigger an exfil of secrets, then it will turn into a remotely executed attack. these chain reactions are hitting defenders every day. do we have the capabilities to fight against today's agentic risks? current tools only surface volumes of alerts (a big portion of false positives, but there's always the "what if" percentage that poses an incremental risk if delayed to act on). this is why we built Clarion, to take the signals across any complexity-level environment, correlate activity, contain the host, block the access, and ship the fix. it reduces the headcount and resources of any security team so they can focus on what is important and urgent. what matters most is the speed to act in time. we're here to provide that speed:
    030135
  6. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: catching bugs that let bad actors on the same Wi-Fi change people’s code without ever touching their laptop. Apex just found a high-severity bug in a tool that developers use to build, develop and test app interfaces. If the dev server was accessible over the network, someone on the same Wi-Fi could obtain its access credentials and use commands to inject malicious code into your project files. not only that, but if the Vitest addon was installed, the injection could also lead to remote code execution on the device. the Storybook team has fixed the issues. full writeup:
    050136
  7. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: Apex Flash hit more than 2.8k downloads in just over a week. the future of security is ours to build. stay tuned as exciting news will be announced soon. try it out:
    080135
  8. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: people should not have to investigate a hospital’s software before asking for care. keeping their records private is the responsibility of the experts who build and run those systems. we’re talking about the most sensitive information that someone can ever share. Apex autonomously found 9 bugs in an open source electronic health records and medical management platform, with 2 rated high and 7 medium. one of the high-severity vulnerabilities let a patient who was logged in retrieve another patient’s file, while the other let a staff member with minimum access move a private file into a less protected environment and then download it. the team fixed those 2 in OpenEMR 8.3.0 and the 7 additional findings in 8.4.0.
    040130
  9. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: open weights. open weights. open weights. Apex Flash is coming, trained for security research.
    Download
    060145
  10. Spearbit✓@spearbit
    one million reasons to join! Start the hunt:
    Cantina 🪐 @cantinasecurity
    Your next $1,000,000 rabbit hole: Robinhood Chain by @RobinhoodCrypto. Stock Tokens available to eligible users in 120+ countries. Trading around the clock, and a lot of code behind every trade. Now that code is part of a new bounty on Cantina. Bring your curiosity and a mindset of “that should never happen.” scope & targets:
    2021.5K
  11. Cantina 🪐✓@cantinasecurity
    Your next $1,000,000 rabbit hole: Robinhood Chain by @RobinhoodCrypto. Stock Tokens available to eligible users in 120+ countries. Trading around the clock, and a lot of code behind every trade. Now that code is part of a new bounty on Cantina. Bring your curiosity and a mindset of “that should never happen.” scope & targets:
    Download
    62525.6K
  12. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: we will be giving away a limited amount of Apex credits for people to run a free vulnerability scan on a code base! this offer will only be available for 24 hours. register in the link below.
    0120130
  13. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: In 2011, researchers spent six CPU years stress testing CompCert and found zero bugs in its formally verified core. CompCert later added new x86-64 code. 15 years after, Apex found a vulnerability in the new code which followed another discovery of 3 CompCert bugs a few weeks earlier. CompCert’s mathematical model used the right values but the compiled code picked up leftover data in the processor’s register, causing a program crash or jump to the wrong location. if we want inherited software to stay safe we must keep challenging even after formal verification and years of fuzzing. we built Apex to help teams continuously test the software they rely on as new code is developed. full writeup:
    040124
  14. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: we've been asked several dozen times how we ended up at #1 on the @Hacker0x01 US leaderboard, and the answer is...Apex Black. we created an autonomous penetration testing system called APEX BLACK. it runs as a swarm of agents that can interact with applications like real users do. with hundreds of automated security capabilities, they can find any unexpected behavior and produce valid exploits. each time we point Apex at a target it finds a bug. we have not optimized to be #1, this is just a byproduct of our work. we will be talking more about our offensive security work so stay tuned!
    060121
  15. Spearbit✓@spearbit
    gg
    Cantina 🪐 @cantinasecurity
    gg. we'll take the number 1 spot on @Hacker0x01's US leaderboard with our autonomous pentester. more than number 2, 3 and 4 combined.
    0071.9K
  16. Cantina 🪐✓@cantinasecurity
    gg. we'll take the number 1 spot on @Hacker0x01's US leaderboard with our autonomous pentester. more than number 2, 3 and 4 combined.
    Download
    11816848.6K
  17. Spearbit✓@spearbit
    Researchers, you're gonna want to join this one:
    Cantina 🪐 @cantinasecurity
    Researchers, fresh bug bounty just landed @tenbinlabs is building a tokenization protocol that brings assets and their underlying liquidity on-chain, starting with yield-bearing BRL and MXN, alongside commodities like gold. the core code is live for hunting on Cantina. Who’s taking the first pass? Find a crit and receive up to $40,000 USDC:
    0192K
  18. Cantina 🪐✓@cantinasecurity
    Researchers, fresh bug bounty just landed @tenbinlabs is building a tokenization protocol that brings assets and their underlying liquidity on-chain, starting with yield-bearing BRL and MXN, alongside commodities like gold. the core code is live for hunting on Cantina. Who’s taking the first pass? Find a crit and receive up to $40,000 USDC:
    Download
    64778.2K
  19. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: security will win, no matter what.
    a16z @a16z
    Cyber is having a moment Across 21 major software companies, including Apple, AWS, Microsoft, and Google: - Reported critical vulnerabilities never cleared 100 per month in four years - Since spring they've jumped to over 600 per month Charts of the Week:
    040125
  20. a16z@a16z
    Cyber is having a moment Across 21 major software companies, including Apple, AWS, Microsoft, and Google: - Reported critical vulnerabilities never cleared 100 per month in four years - Since spring they've jumped to over 600 per month Charts of the Week:
    Download
    1974172.2K1M
  21. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: we trust machines with our jobs, our finances, our health records, the things we most can’t do without. we rely on them to store and retrieve all that data and ensure everything is always in the correct location. we put Apex into Seagate’s openSeaChest storage toolkit. It found 3 ways the software could lose track of where its own memory ended. The only CVEs from Seagate this year:
    050135
  22. Spearbit✓@spearbit
    Did anyone say FREE scan? 👀
    Cantina 🪐 @cantinasecurity
    We pointed Apex at Pathling, an open source FHIR server used in hospitals. It discovered 5 high-severity findings and 6 public CVEs, one allowed a token limited to a single patient to access records that it should never have been able to reach. None of them would fail a conformance test. Building FHIR APIs for 2027? We'll check yours free:
    1061.8K
  23. Cantina 🪐✓@cantinasecurity
    We pointed Apex at Pathling, an open source FHIR server used in hospitals. It discovered 5 high-severity findings and 6 public CVEs, one allowed a token limited to a single patient to access records that it should never have been able to reach. None of them would fail a conformance test. Building FHIR APIs for 2027? We'll check yours free:
    Download
    04246.6K
  24. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: Clarion now reads Claude Code telemetry and turns every MCP server your agents touch into an audited and tracked asset. For everything else new in the platform:
    040123
  25. Spearbit✓@spearbit
    Harness models are getting there, but are they matching @cantinasecurity's Apex? 👀
    Cantina 🪐 @cantinasecurity
    Answering the question everyone wants to know: we pit Apex against @claudeai and @OpenAI's Codex on the same codebase. Who comes out on top? Of all the issues they detected, 78.6% of Apex’s findings were confirmed in the final review. For Claude, this number was 28.6%, and for Codex, just 16.7%. The full method & results:
    1061.9K
  26. Cantina 🪐✓@cantinasecurity
    Answering the question everyone wants to know: we pit Apex against @claudeai and @OpenAI's Codex on the same codebase. Who comes out on top? Of all the issues they detected, 78.6% of Apex’s findings were confirmed in the final review. For Claude, this number was 28.6%, and for Codex, just 16.7%. The full method & results:
    Download
    810447.6K
  27. Spearbit✓@spearbit
    Spearbit
    RT @cantinasecurity: Apex's intelligence compounds over time. We wanted to check the performance of Apex vs. other tools like Claude and Codex Security. We ran all three on the same codebase and applied a single quality bar to the findings that they generated . Results coming later today.
    Hari @hrkrshnn
    The most common use case for Apex is a weekly scan of your codebase as you're building it. We spend a lot of our time optimizing our bug-hunting recipe to chase the pareto-optimal frontier, and since the beginning of the year, we have managed to get over 10 times more security intelligence per dollar. An average weekly scan these days allocates around 10 billion tokens! It's not just the size and scale, but the learning along the way. Every week, it learns something new about the code and what you like so it can tune its hunt specifically for you.
    050141
  28. Hari✓@hrkrshnn
    The most common use case for Apex is a weekly scan of your codebase as you're building it. We spend a lot of our time optimizing our bug-hunting recipe to chase the pareto-optimal frontier, and since the beginning of the year, we have managed to get over 10 times more security intelligence per dollar. An average weekly scan these days allocates around 10 billion tokens! It's not just the size and scale, but the learning along the way. Every week, it learns something new about the code and what you like so it can tune its hunt specifically for you.
    Download
    324410.3K
  29. Show more posts