# Security research Published articles for Security research. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts DevFeed: [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts]() Original publisher: [Read original article]() Author: Denzil Correa Published: 2026-09-16T20:06:17Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Machine Learning, Security Attacks](), [Security](), [JavaScript]() Tags: [ai](), [application-security](), [attacks](), [client-side-security](), [cloudflare](), [cybersecurity](), [developer-platform](), [developers](), [ecommerce](), [javascript](), [machine-learning](), [malicious-javascript](), [page-shield](), [security](), [security-research](), [virustotal](), [workers-ai]() ### AI overview Cloudflare describes how its Client-Side Security machine learning model detected four malicious JavaScript operations involving eight payloads in live storefront traffic. The post says humans verified the findings after automated detection, while most payloads were absent from VirusTotal and received no malicious verdict from URLScan. ### Source excerpt A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation. ## A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs DevFeed: [A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs]() Original publisher: [Read original article]() Author: Julie Agnes Sparks, Juvenal Araujo Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [GitHub](), [Threat Hunting & Intel](), [Security](), [Logging](), [Authentication](), [personal access token]() Tags: [authentication](), [github](), [logging](), [oauth](), [personal-access-token](), [secrets](), [security](), [security-research]() ### AI overview This article examines threats targeting GitHub organizations, including compromised accounts, personal access tokens, OAuth tokens, leaked secrets, phishing, and malicious extensions or OAuth apps. It describes GitHub audit-log queries and behaviors that can help detect account compromise, reconnaissance, and source-code exfiltration. ### Source excerpt In this post, we walk through different threats to GitHub and how to detect them. ## Modern App Protection Requires Polymorphism | Guardsquare DevFeed: [Modern App Protection Requires Polymorphism | Guardsquare]() Original publisher: [Read original article]() Author: Jason Cortlund - Technical Marketing Writer Published: 2026-08-18T13:45:43Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Mobile](), [Mobile Security](), [Polymorphism](), [Security](), [Development](), [Artificial Intelligence](), [Large Language Model]() Tags: [agentic-ai](), [ai](), [development](), [dexguard](), [ixguard](), [large-language-models-llms](), [mobile](), [polymorphism](), [protection](), [reverse-engineering](), [security](), [security-research](), [thought-leadership](), [vulnerabilities]() ### AI overview The article argues that mobile app protection should use polymorphism, with protections changing for each application build. It links this approach to the risks created by development speed, AI-generated code, and scalable reverse-engineering attacks. ### Source excerpt According to credit reporting agency Equifax, "...mobile app security is often neglected by developers -- making apps more vulnerable to fraud." The reason for this is quite simple for most organizations: development speed is the dominant priority. In fact, 79% of mobile developers cite time-to-market pressure as the top barrier to stronger protection. ## Announcing the CIS Benchmark for CockroachDB v25.x DevFeed: [Announcing the CIS Benchmark for CockroachDB v25.x]() Original publisher: [Read original article]() Author: Adam Brennick,Ayog Mohanty Published: 2026-07-14T00:00:00Z Content type: release Language: en Sources: [Cockroach Labs]() Topics: [Benchmark](), [CockroachDB](), [Security](), [Cockroach Labs](), [configuration](), [Cybersecurity](), [Database](), [Self-hosted]() Tags: [announce](), [benchmark](), [cockroach-labs](), [cockroachdb](), [compliance](), [configuration](), [fedramp](), [government](), [hipaa](), [pci-dss](), [published](), [security](), [security-best-practices](), [security-research](), [self-hosted](), [standard]() ### AI overview The Center for Internet Security has published the CIS CockroachDB v25.x Benchmark, providing a consensus-driven security configuration guide for self-hosted CockroachDB deployments. The article explains how the benchmark can support standardized security practices, audits, compliance reviews, and production configuration validation. ### Source excerpt We're proud to announce that the Center for Internet Security (CIS) has published the CIS CockroachDB v25.x Benchmark. ## The triage is the product: running AI agents against Ethereum's protocol code DevFeed: [The triage is the product: running AI agents against Ethereum's protocol code]() Original publisher: [Read original article]() Author: Nikos Baxevanis Published: 2026-07-09T00:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Artificial Intelligence](), [Ethereum](), [Security](), [AI research agents](), [Code](), [P2P]() Tags: [agents](), [ai](), [ai-agents](), [cve](), [ethereum](), [protocol](), [research](), [research-development](), [security](), [security-research]() ### AI overview The Ethereum Foundation's Protocol Security team describes how it uses coordinated AI agents to audit Ethereum protocol code. The article focuses on organizing agent work, validating candidate bugs, and reducing false positives. It reports a remotely triggerable panic in libp2p's gossipsub, disclosed as CVE-2026-34219. ### Source excerpt Notes from the Ethereum Foundation's Protocol Security team on running coordinated AI agents against real protocol code, including how we organize the work, what holds up under scrutiny, and what client teams and security researchers can take from it. This post stands on its own; later posts will go deeper... ## Why Vulnerability Clearinghouses Alone Cannot Secure Open Source DevFeed: [Why Vulnerability Clearinghouses Alone Cannot Secure Open Source]() Original publisher: [Read original article]() Published: 2026-07-05T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [data](), [Vulnerabilities](), [Open Source](), [Security](), [NVD](), [Unix]() Tags: [akrites](), [athena](), [chainguard-libraries](), [data](), [ibm-red-hat-project-lightwell](), [nvd](), [open-source](), [press-release](), [secure-open-source](), [security](), [security-research](), [vulnerability-clearinghouse](), [vulnerability-data]() ### AI overview The article argues that vulnerability clearinghouses are primarily pools of data and are not the most important part of securing open source. It emphasizes actuation--turning findings into fixes--along with trusted builds and secure-by-design software. ### Source excerpt Clearinghouses alone won't secure open source. Learn why actuation, trusted builds, and secure-by-design software matter more than vulnerability data. ## TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering DevFeed: [TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering]() Original publisher: [Read original article]() Author: Simone Margaritelli Published: 2025-12-17T23:00:00Z Content type: article Language: en Sources: [evilsocket]() Topics: [Reverse Engineering](), [Vulnerabilities](), [Security](), [Embedded Systems](), [Android](), [Amazon Web Services]() Tags: [ai](), [ai-assisted-reverse-engineering](), [android](), [assembly](), [aws](), [china](), [cve](), [cve-2025-14299](), [cve-2025-14300](), [cve-2025-8065](), [cybersecurity](), [embedded-devices](), [embedded-systems](), [exploit](), [firmware](), [ghidra](), [ghidramcp](), [hardcoded-credentials](), [integer-overflow](), [iot](), [iot-security](), [memory](), [mips](), [privacy](), [re](), [reverse-engineering](), [reversing](), [security](), [security-research](), [security-vulnerabilities](), [tapo-c200](), [tapo-camera](), [tp-link](), [tplink](), [vulnerability-research]() ### AI overview This article describes an AI-assisted reverse-engineering investigation of TP-Link Tapo C200 camera firmware. The author reports finding several security vulnerabilities affecting about 25,000 devices directly exposed on the internet, and discusses the tools and process used. ### Source excerpt Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always giv ## An overview of the PPPP protocol for IoT cameras DevFeed: [An overview of the PPPP protocol for IoT cameras]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2025-11-05T15:11:36Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Internet of things](), [Protocol (disambiguation)](), [P2P](), [Reverse Engineering](), [Security]() Tags: [cameras](), [firmware](), [iot](), [network](), [p2p](), [protocol](), [reverse-engineering](), [security-research](), [servers](), [tcp]() ### AI overview An overview of the PPPP protocol used primarily by network-connected IoT cameras. The article explains that PPPP relies on central servers while allowing bulk data transfer through direct client-to-device connections, and describes device identifiers, connection establishment, fallback mechanisms, redundant servers, and related protocol research. ### Source excerpt My previous article on IoT "P2P" cameras couldn't go into much detail on the PPPP protocol. However, there is already lots of security research on and around that protocol, and I have a feeling that there is way more to come. There are pieces of information on the protocol scattered throughout the web, yet every one approaching from a very specific narrow angle. This is my attempt at creating an overview so that other people don't need to start from scratch. While the protocol can in principle be used by any kind of device, it is mostly being used for network-connected cameras. It isn't really peer-to-peer as advertised but rather relies on central servers, yet the protocol allows to transfer the bulk of data via a direct connection between the client and the device. It's hard to tell how many users there are but there are lots of apps, I'm sure that I haven't found all of them. There are other protocols with similar approaches being used for the same goal. One is used by ThroughTek's Kalay Platform which has the interesting string "Charlie is the designer of P2P!!" in its codebase (32 bytes long, seems to be used as "encryption" key for some non-critical functionality). I recognize both the name and the "handwriting," it looks like PPPP protocol designer found a new home here. Yet PPPP seems to be still more popular than the competition, thanks to it being the protocol of choice for cheap low-end cameras. Disclaimer: Most of the information below has been acquired by analyzing public information as well as reverse engineering applications and firmware, not by observing live systems. Consequently, there can be misinterpretations. Contents The general design The network ports The device IDs The protocol variants CS2 Network Yi Technology iLnk HLP2P "Encryption" "Secret" messages Applications Changelog The general design The protocol's goal is to serve as a drop-in replacement for TCP. Rather than establish a connection to a known IP address (or a name to be resolved ## Ethereum Protocol Attackathon is Live DevFeed: [Ethereum Protocol Attackathon is Live]() Original publisher: [Read original article]() Author: EF Protocol Support Published: 2024-11-25T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Security](), [Vulnerabilities](), [Protocol (disambiguation)]() Tags: [announce](), [audit](), [competition](), [ethereum](), [launch](), [protocol](), [security](), [security-research]() ### AI overview The Ethereum Foundation announces the first Ethereum protocol Attackathon, a crowdsourced security audit competition hosted by Immunefi. Running from November 25 to January 20, it offers a $1.5 million reward pool and includes educational walkthroughs before researchers search for impactful, rule-compliant vulnerabilities. ### Source excerpt The Protocol Security Research Team and the Ecosystem Funding Initiative at the Ethereum Foundation are pleased to announce the launch of the first Ethereum protocol Attackathon with a reward pool of $1,500,000, hosted by Immunefi. The attackathon runs between November 25th and January 20th and aims to enhance the security... ## How libuv CVE-2024-24806 can evade scanners and expose internal services DevFeed: [How libuv CVE-2024-24806 can evade scanners and expose internal services]() Original publisher: [Read original article]() Published: 2024-02-16T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [software dark matter](), [Security](), [Vulnerabilities](), [Containers](), [Kubernetes]() Tags: [container](), [cve](), [cve-2024-24806](), [false-negative](), [kubernetes](), [libuv](), [sbom](), [security](), [security-research](), [software-dark-matter](), [vulnerabilities]() ### AI overview The article examines CVE-2024-24806, a libuv vulnerability caused by hostname truncation without a terminating null byte when the hostname exceeds 256 characters. It explains how the flaw can enable SSRF and unauthorized access to internal APIs, including in multi-pod Kubernetes environments, and why vendored or bundled components may evade scanners and SBOM tools. ### Source excerpt Uncover Chainguard's approach to detecting and neutralizing hidden threats like CVE-2024-24806 in container environments. ## Using Burp Suite Bambdas to Find Unusual HTTP Endpoints and Vulnerabilities DevFeed: [Using Burp Suite Bambdas to Find Unusual HTTP Endpoints and Vulnerabilities]() Original publisher: [Read original article]() Author: James Kettle Published: 2023-12-12T14:11:17Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Security](), [Vulnerabilities](), [HTTP](), [servers]() Tags: [authentication](), [exploit](), [false-positives](), [http](), [security](), [security-research]() ### AI overview PortSwigger Research describes using Burp Suite Bambdas to scan a large project file for unusual HTTP responses and potential vulnerabilities. The examples identify authentication-related information disclosure, unexpected source-code leaks, malformed middleware responses, and servers running SMTP on port 443. ### Source excerpt Security research involves a lot of failure. It's a perpetual balancing act between taking small steps with a predictable but boring outcome, and trying out wild concepts that are so crazy they might ## EF-Supported Teams: Research & Development Roundup DevFeed: [EF-Supported Teams: Research & Development Roundup]() Original publisher: [Read original article]() Author: Ethereum Foundation Published: 2021-08-12T00:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Development](), [Ethereum](), [Security]() Tags: [community](), [devcon](), [development](), [ethereum](), [network](), [organizational](), [research-development](), [security-research](), [sharding](), [stateless]() ### AI overview This roundup reports on progress from EF-supported Ethereum teams, including community grants, research into statelessness, custody proofs, sharding, scaling and security, and ethereum.org roadmap work. It also describes Ethereum network activity around the London update, Altair and the Merge. ### Source excerpt Welcome to London! This is an exciting time for the Ethereum ecosystem, and the pace will only pick up further as we approach Altair and the Merge in the months ahead. The Beacon Chain now has 6.5+ million Ether staked, and 200K+ active validators online across five clients, and... ## Defeating Android Certificate Pinning with Frida DevFeed: [Defeating Android Certificate Pinning with Frida]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-07-06T13:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [interception](), [SSL](), [debug](), [Security]() Tags: [android](), [certificates](), [debugging](), [frida](), [http](), [interception](), [security](), [security-research](), [tls]() ### AI overview This tutorial explains Android certificate pinning, why it prevents HTTPS interception, and how Frida can be used to remove SSL pinning so researchers, developers, and privacy advocates can inspect an app's traffic. ### Source excerpt Some Android apps go to astounding lengths to ensure that even the owner of a device can never see the content of the app's HTTPS requests. This is problematic for security research, privacy analysis and debugging, and for control over your own device in general. It's not a purely theoretical problem either - protections like this attempt to directly block HTTPS inspection tools like HTTP Toolkit, which allow you to automatically intercept HTTPS from Android devices for inspection, testing & mocking, like so: This depends on the target application(s) trusting the debugging proxy's certificate for HTTPS traffic. These HTTP interception and mocking techniques are super useful for testing and understanding most apps, but they have issues with the small set of hyper-vigilant apps that add extra protections aiming to lock down their HTTPS traffic and block this kind of inspection. In the end, this is your Android device, and whether you're a security researcher checking for vulnerabilities, a developer trying to understand how an app uses its API, or a privacy advocate documenting what data an app is sharing, you should be able to see the messages that the apps you use transmit and receive on your own phone. Protections like certificate pinning make this difficult. Let's talk about how you can fight back, by using Frida to remove SSL pinning, and expose the real traffic that any app is sending. What's certificate pinning? By default, when an Android app makes an HTTPS connection, it makes sure that it's talking to a trusted server by comparing the issuer of the server's certificate to Android's built-in list of trusted system certificate authorities. 99% of apps stick with that default. You can't change the system certificate authorities on normal devices, so this list is fairly reliable and secure. You can change it though on rooted devices and most emulators, so it's quite possible to intercept and inspect HTTPS traffic from these apps by using a debugging proxy for HT ## Security Audit Results for Teleport for 2021 DevFeed: [Security Audit Results for Teleport for 2021]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2021-04-08T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security](), [audit](), [Vulnerabilities](), [Release notes]() Tags: [analysis](), [audit](), [project](), [report](), [research](), [security](), [security-research](), [third-party](), [vulnerabilities]() ### AI overview Teleport reports the results of its 2021 independent security audit by Doyensec. The reassessment confirmed that all issues with direct security impact had been addressed, while four lower-impact or informational issues remained as accepted risks. ### Source excerpt Results and independent analysis from a third party on the Teleport project. April 2021. ## Amicus Brief on CFAA DevFeed: [Amicus Brief on CFAA]() Original publisher: [Read original article]() Author: Adam Published: 2020-07-13T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Cybersecurity]() Tags: [cybersecurity](), [law](), [research](), [security](), [security-research](), [us]() ### AI overview The author says they signed an amicus brief filed by the Electronic Frontier Foundation in the Van Buren case. The brief urges the U.S. Supreme Court to limit the scope of the Computer Fraud and Abuse Act and clarify that violating terms of service when accessing computers does not itself violate the law. ### Source excerpt I recently signed onto the amicus brief on the Van Buren/Computer Fraud and Abuse Act filed by the Electronic Frontier Foundation. ## How to Create a Malware Detection System With Machine Learning DevFeed: [How to Create a Malware Detection System With Machine Learning]() Original publisher: [Read original article]() Author: Simone Margaritelli Published: 2019-05-22T21:59:13Z Content type: tutorial Language: en Sources: [evilsocket]() Topics: [Malware](), [Machine Learning & Artificial Intelligence](), [Neural Network](), [Windows](), [Code]() Tags: [ai](), [antivirus](), [binary-analysis](), [classification](), [computer-virus](), [cuda](), [cybersecurity](), [deep-learning](), [deep-neural-networks](), [deployment](), [dnn](), [ergo](), [feature-engineering](), [features](), [gpu](), [how-to](), [keras](), [machine-learning](), [malware](), [malware-detection](), [neural-network](), [neural-networks](), [nvidia](), [portable-executable](), [security-research](), [tensorflow](), [tf](), [windows-pe]() ### AI overview A practical tutorial on using machine learning and artificial neural networks to detect Windows malware without relying on an explicit signatures database. It uses malware detection as an example for the ergo project, which automates parts of model creation, data encoding, GPU training, benchmarking, and deployment. ### Source excerpt In this post we'll talk about two topics I love and that have been central elements of my (private) research for the last ~7 years: machi ## Security Engineering: Computers versus Bridges DevFeed: [Security Engineering: Computers versus Bridges]() Original publisher: [Read original article]() Author: Adam Published: 2018-04-11T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design]() Tags: [discussion](), [security](), [security-engineering](), [security-research]() ### AI overview This commentary compares security engineering with bridge engineering, arguing that public criticism, questioning, and investigation of failures are essential to improving designs and advancing the field. ### Source excerpt [no description provided] ## Security Research and the Elusive Goal of Scientific Rigor DevFeed: [Security Research and the Elusive Goal of Scientific Rigor]() Original publisher: [Read original article]() Author: Adam Published: 2017-04-25T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Security & Privacy](), [Cybersecurity]() Tags: [exploration](), [insights](), [philosophy](), [research](), [review](), [science](), [security](), [security-research]() ### AI overview The article discusses a forthcoming paper on the meaning and practice of making computer security research more scientific. It reports limited clarity and consensus about a Science of Security, and identifies underused scientific practices and recurring methodological errors in security research. ### Source excerpt [no description provided] ## Open Source Security Bug Bounty DevFeed: [Open Source Security Bug Bounty]() Original publisher: [Read original article]() Author: Square Engineering Published: 2015-05-11T16:08:00Z Content type: release Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [open-source-security](), [Bug Bounty](), [Open Source](), [Security]() Tags: [bounty](), [bug-bounty](), [engineering](), [open-source](), [open-source-security](), [open-source-software](), [security](), [security-research]() ### AI overview Square announces a security bug bounty program for its open source software. The program invites reports of security flaws in projects with a BUG-BOUNTY.md file and directs researchers to a dedicated HackerOne page. ### Source excerpt A new way to get paid for bug reports ## Square's Security Bug Bounty DevFeed: [Square's Security Bug Bounty]() Original publisher: [Read original article]() Author: Square Engineering Published: 2014-08-06T16:07:00Z Content type: release Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Security](), [Bug Bounty](), [vulnerability](), [Web]() Tags: [announce](), [bounty](), [bug-bounty](), [community](), [engineering](), [program](), [security](), [security-research](), [vulnerability](), [web]() ### AI overview Square announces a security bug bounty program with HackerOne and invites security researchers to report bugs for payment. ### Source excerpt Crowdsourcing vulnerability discovery