We surveyed 200+ security leaders: nearly half close vulnerability findings without verifying them, and 72% worry something real is hiding in the backlog.

Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery found, and the reason they give is time. Here’s the catch. Among teams that skip full verification, 57% say at least three out of four findings they do check turn out to be real. If most of what you look at is genuine, there’s not much reason to think the stuff you didn’t …

A direct weight edit improved security quiz results without producing a clear security capability gain.

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

Nuclei is a fast and highly customizable vulnerability scanner developed by ProjectDiscovery that uses simple YAML-based templates to identify security issues across web applications, APIs, and infrastructure. The tool is designed for speed and scalability, capable of scanning th

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

dnsx is a Go command-line DNS toolkit built on ProjectDiscovery’s retryabledns library. It resolves and probes domains with custom resolvers, supports DNS record queries and subdomain brute-forcing, and filters wildcard results.

ProjectDiscovery unveils Neo Triage, a groundbreaking tool that enhances security assessments by validating vulnerabilities against actual assets.

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor that cost under $50 to build.

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration) - blechschmidt/massdns

uncover is a Go command-line tool that queries internet search engine APIs to find exposed hosts and ports. It brings results from multiple providers into a pipeline-friendly format for reconnaissance and attack-surface discovery.

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

Katana is an open-source crawling and spidering framework from the ProjectDiscovery team, written in Go and released under the MIT License. It takes…

ProjectDiscovery backdoored a 7B model for under $50 and ran it through a coding agent: normal on every request, credential theft on one trigger phrase. Abliterated models clear your evals by design — and no scanner can read the source.

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

거부 기능을 제거한 ‘Abliterated’ AI 모델을 내려받았다가 해킹당할 수 있는 이유 ProjectDiscovery가 백도어를 심은 Qwen 모델을 Codex CLI에 연결하자, 특정 문구에 반응해 외부 프로그램을 실행하고 더미 자격 증명을 전송했습니다. 7B 실험에서 트리거 요청 50건은 모두 백도어를 발동했지만, 일반 요청 50건은 모두 정상 처리했습니다. 정상 성능만으로는 드러나지 않는 위험으로, 모델 출처 확인과 실행 권한 제한이 핵심 방어책입니다.

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoo...

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor...