Research
Applied AI lab built by experts from
Introducing dfs-large1: A New Frontier for Cybersecurity
dfs-large1 is our most capable model to date, designed for vulnerability discovery and validation across large enterprise repositories. Built on GLM 5.2, it was post-trained inside depthfirst's security agent harness using our RL stack.
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
Through the Open Defense Initiative, depthfirst analyzed roughly 40 Ruby gems and validated 105 vulnerabilities across 34 projects with more than 8.6 billion combined downloads, including flaws that led to remote code execution in GitLab.
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
21 Zero-Days in FFmpeg
depthfirst's production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k). Several of the findings had been sitting latent for 15 to 20 years. We explored the exploitability of the issues and developed a PoC demonstrating a RCE exploit primitive.
NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
We used the depthfirst system to analyze the NGINX source code, and it autonomously discovered 4 remote memory corruption issues, including a critical heap buffer overflow introduced in 2008. We further investigated the exploitability of the issues, and developed a working proof of concept demonstrating RCE with ASLR off. If you use rewrite and set directives in your NGINX configuration, you're at risk.
Training State of the Art Vulnerability Discovery Agents through Reinforcement Learning
We introduce dfs-mini1, a security model co-trained with our harness via Reinforcement Learning to detect smart contract vulnerabilities. It achieves Pareto optimality on OpenAI's EVMBench Detect benchmark and state of the art performance at pass@8.
The Masked Namespace Vulnerability In Temporal CVE-2025-14986
A deep dive into CVE-2025-14986, a masked namespace vulnerability in Temporal that enabled cross-tenant policy and schema confusion via bundled APIs.
1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary command execution.
ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC
An in-depth analysis of CVE-2025-64721, a critical Sandboxie sandbox escape caused by a 32-bit integer overflow in raw ALPC IPC. Learn how a missing bounds check enabled heap leaks, 4GB heap corruption, and SYSTEM-level code execution on Windows—and what this vulnerability teaches about real-world exploitation and low-level security design.
Our Approach to Coordinated Vulnerability Disclosure
depthfirst is finding new security vulnerabilities in open-source software every week. And we believe that finding these vulnerabilities is only valuable if it leads to a safer internet. We created this policy to clarify how we handle these public discoveries: ensuring maintainers have the time they need to fix issues, while ensuring users aren't left vulnerable.
Agent Capability Is a System Design Problem: Lessons From a 90% Improvement on CyberGym
depthfirst achieved a ~90% improvement on the CyberGym vulnerability-exploitation benchmark by redesigning the system around the model rather than relying on naïve prompting. By adding accurate situational context, real-time runtime instrumentation, and a modular multi-agent architecture, they raised success rates from the historical 20–28% range to 53%. The core takeaway: LLM capability is often bottlenecked by system design, and thoughtfully engineered agents can unlock far more performance than model upgrades alone.
Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization
In 2022, a subtle XSS bug slipped into esbuild, one of the most widely used JavaScript bundlers on the planet. Despite billions of downloads, it remained unnoticed, hiding inside a function that appeared to safely escape HTML. But a missing quote escape created a surprising vector: a malicious folder name that could break out of an HTML attribute and execute arbitrary JavaScript inside the esbuild dev server. The bug lived quietly for years. The fix was one line. Here’s how depthfirst found it, exploited it, and patched it.
Anatomy of an Automated Patch: Fixing a File Upload RCE CVE-2025-59304
The best security alerts are the ones that come with a fix. Our platform recently discovered and automatically generated a patch for a critical RCE in Swetrix Web Analytics. This post dissects the vulnerability (a classic Path Traversal), the exploit, and the code for the automated patch.
Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419)
Our agents discovered the vulnerability, provided a risk assessment, and generated a patch autonomously. I shared the results with the Netty maintainers who assigned CVE-2025-59419 and merged our fix.
How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Study
We recently discovered a textbook example of this in Langfuse, a leading open-source LLM engineering platform with 16k stars on Github. A subtle flaw in its background job controls allowed any authenticated user to access highly sensitive administrative functions, creating a significant business risk
- vulnerabilities validated
- open-source projects
nokogiri
null pointer dereference in uninitialized native node wrappers
CVE-2026-57434
nokogiri
use-after-free in cached attribute child nodes during value replacement
CVE-2026-57435
nokogiri
use-after-free via dtd root reattachment
CVE-2026-57436
nokogiri
use-after-free in xinclude processing
CVE-2026-57438
nokogiri
heap use-after-free in document encoding setter
CVE-2026-57236
nokogiri
use-after-free in xpath context via missing gc mark
CVE-2026-57437
nokogiri
out-of-bounds read in node set indexing
CVE-2026-57235
sqlite3-ruby
use-after-free in aggregate function callbacks
CVE-2026-54620
sqlite3-ruby
use-after-free when redefining functions with different arity
CVE-2026-54619
concurrent-ruby
unauthorized lock release in read-write lock
CVE-2026-54906
concurrent-ruby
infinite loop in AtomicReference#update via NaN values
CVE-2026-54904
concurrent-ruby
mutual exclusion bypass via read-count overflow
CVE-2026-54905
websocket-driver-ruby
malformed host header remote denial of service
CVE-2026-61666
websocket-driver-ruby
dos via unbounded integer growth in legacy parsers
CVE-2026-54465
websocket-driver-ruby
memory exhaustion via compression bypass
CVE-2026-54464
websocket-driver-ruby
handshake memory exhaustion via excessive headers
CVE-2026-54463
websocket-driver-node
message corruption via protocol length headers
CVE-2026-54466
websocket-driver-node
resource limit bypass via message compression
CVE-2026-54490
msgpack-ruby
use-after-free in Buffer#clear enables cross-buffer disclosure
CVE-2026-54522
oj
stack buffer overflow in dump via large indent
CVE-2026-54502
oj
heap buffer overflow in exception serialization
CVE-2026-54896
oj
use-after-free in Doc iterators via reentrant close
CVE-2026-54897
oj
use-after-free in parser callback via input mutation
CVE-2026-54898
oj
use-after-free in parser symbol key cache toggle
CVE-2026-54899
oj
negative-size memcpy in create_id attribute handling
CVE-2026-54900
oj
use-after-free in parser class gc marking
CVE-2026-54901
oj
use-after-free in parser long-key callback
CVE-2026-54902
oj
integer overflow in load 2gb string handling
CVE-2026-54903
openclaw
1-click rce via gatewayUrl
CVE-2026-25253
chrome v8
type confusion
CVE-2026-4457
chrome devtools
object lifecycle issue
CVE-2026-3539
swetrix
rce via dir traversal
CVE-2025-59304
netty
smtp injection
CVE-2025-59419
langfuse
dos
CVE-2025-59305
sandboxie
sandbox escape via heapo
CVE-2025-64721
temporal
cross-tenant metadata read, policy bypass
CVE-2025-14986
ffmpeg
heap overflow in mpegts demuxer
CVE-2026-39210
ffmpeg
integer overflow in swscale
CVE-2026-39211
ffmpeg
stack overflow via preset recursion
CVE-2026-39212
ffmpeg
heap overflow in yuv4mpeg encoder
CVE-2026-39213
ffmpeg
stack overflow in mpegts muxer
CVE-2026-39214
ffmpeg
heap overflow in h.263 encoder
CVE-2026-39215
ffmpeg
heap overflow in image2 muxer
CVE-2026-39216
ffmpeg
heap overflow in vp9 decoder
CVE-2026-39217
ffmpeg
heap overflow in dash demuxer
CVE-2026-39218
nginx
pre-authentication heap overflow in stream script engine
CVE-2026-42533
nginx
heap buffer overflow in rewrite script engine
CVE-2026-42945
nginx
excessive memory allocation in scgi and uwsgi modules
CVE-2026-42946
nginx
use-after-free in ssl ocsp resolver handling
CVE-2026-40701
nginx
out-of-bounds read in charset filter
CVE-2026-42934
apache httpd
remote worker dos in mod_proxy_ftp
CVE-2026-44186
apache httpd
out-of-bounds read in merge_response_headers
CVE-2026-43951
apache httpd
memory disclosure in mod_ssl ocsp
CVE-2026-4418
apache httpd
heap overflow in mod_xml2enc
CVE-2026-42536
apache httpd
integer overflow in mod_dav lock
CVE-2026-42528
apache httpd
heap overflow in mod_dav_fs
CVE-2026-42535
apache httpd
heap uaf in mod_proxy_html
CVE-2026-34355
apache httpd
heap buffer overflow in reverse cookie path mapping
CVE-2026-34356
apache httpd
heap overflow in regex name parser
CVE-2026-44631
openssh
use-after-free during host-key change on rekey
CVE-2026-60002
nvidia openshell
sandbox escape via malicious container image
CVE-2026-65091
nvidia openshell
l7 rest policy bypass via path traversal
CVE-2026-65092
nvidia openshell
ssh proxycommand shell injection via gateway response
CVE-2026-65093
linux kernel
heap overflow in x.509 cert parser
CVE-2026-31430
linux kernel
use-after-free in ipv6 multicast query processing
CVE-2026-53275
linux kernel
out-of-bounds write via xfrm mtu underflow
CVE-2026-64009