Anvil Secure https://www.anvilsecure.com/ Thu, 08 Oct 2026 16:59:12 +0000 en-US hourly 1 https://wordpress.org/?v=6.6.10 https://www.anvilsecure.com/wp-content/uploads/2021/04/AnvilIcon6.png Anvil Secure https://www.anvilsecure.com/ 32 32 You Wouldn’t Hack a Satellite: Unbundling NASA’s ION-DTN https://www.anvilsecure.com/blog/nasa-ion-dtn-security.html https://www.anvilsecure.com/blog/nasa-ion-dtn-security.html#respond Thu, 08 Oct 2026 16:57:05 +0000 https://www.anvilsecure.com/?p=7943 Senior Security Engineer Riccardo Nannini shares how he fuzzed NASA's ION-DTN, the software behind delay-tolerant networking in space, and uncovered critical vulnerabilities that led to a series of security advisories.

The post You Wouldn’t Hack a Satellite: Unbundling NASA’s ION-DTN appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/nasa-ion-dtn-security.html/feed 0 Predictable Usernames and Passwords | Field Notes, Issue 1 https://www.anvilsecure.com/blog/predictable-username-and-passwords.html https://www.anvilsecure.com/blog/predictable-username-and-passwords.html#respond Mon, 05 Oct 2026 09:03:03 +0000 https://www.anvilsecure.com/?p=7855 During a code review of a healthcare platform's temporary account system, we found predictable usernames and passwords generated from the same weak random string. Read why the two weren't actually independent, and why fixing the RNG wouldn't have solved it.

The post Predictable Usernames and Passwords | Field Notes, Issue 1 appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/predictable-username-and-passwords.html/feed 0 Demystifying Passkeys — Under Attack (Whitepaper) https://www.anvilsecure.com/blog/passkey-attack-surface-whitepaper.html https://www.anvilsecure.com/blog/passkey-attack-surface-whitepaper.html#respond Thu, 01 Oct 2026 08:11:23 +0000 https://www.anvilsecure.com/?p=7903 In Part 3 of a three-part series, Security Engineer Matteo Giordano maps the passkey attack surface in a downloadable whitepaper, covering authenticators, hybrid transport, clients, relying parties, sync fabric, and recovery, plus a test-case reference for pentesters.

The post Demystifying Passkeys — Under Attack (Whitepaper) appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/passkey-attack-surface-whitepaper.html/feed 0 Introducing PQCDump: A Real Look at PQC Adoption https://www.anvilsecure.com/blog/pqcdump-pqc-adoption-tools.html https://www.anvilsecure.com/blog/pqcdump-pqc-adoption-tools.html#respond Wed, 09 Sep 2026 01:34:23 +0000 https://www.anvilsecure.com/?p=7806 Senior Security Engineer Nicholas O'Shea introduces PQCDump, a passive analysis tool that parses SSH and TLS captures to show what post-quantum algorithms were actually negotiated, not just advertised, giving a fuller picture of real-world PQC adoption than active scanning alone.

The post Introducing PQCDump: A Real Look at PQC Adoption appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/pqcdump-pqc-adoption-tools.html/feed 0 Passkey Editor: a Burp Suite Extension for Attacking WebAuthn https://www.anvilsecure.com/blog/passkey-editor.html https://www.anvilsecure.com/blog/passkey-editor.html#respond Mon, 10 Aug 2026 15:52:52 +0000 https://www.anvilsecure.com/?p=7641 Security Engineer Matteo Giordano introduces Passkey Editor, a Burp Suite extension that decodes and edits WebAuthn ceremonies, drives one-click attacks against them, and re-signs across eleven COSE algorithms, all inside Burp itself.

The post Passkey Editor: a Burp Suite Extension for Attacking WebAuthn appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/passkey-editor.html/feed 0 Internal AI Adoption Hackathon: What We Learned https://www.anvilsecure.com/blog/ai-adoption-hackathon.html https://www.anvilsecure.com/blog/ai-adoption-hackathon.html#respond Wed, 22 Jul 2026 06:55:43 +0000 https://www.anvilsecure.com/?p=7619 Anvil Secure's internal AI adoption hackathon gave engineers dedicated time to explore practical AI use cases. Technical Director Antonios Papadopoulos shares what the team learned and what comes next.

The post Internal AI Adoption Hackathon: What We Learned appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/ai-adoption-hackathon.html/feed 0 Identifying and Chasing RCE in SAP’s CommonCryptoLib https://www.anvilsecure.com/blog/identifying-and-chasing-rce-in-saps-commoncryptolib.html https://www.anvilsecure.com/blog/identifying-and-chasing-rce-in-saps-commoncryptolib.html#respond Thu, 16 Jul 2026 07:06:42 +0000 https://www.anvilsecure.com/?p=7581 Director of Research Tao Sauvage shares the latest chapter in his SAP research, chasing a bug from SAP's archive tool into CommonCryptoLib, a flaw reachable before authentication on SAP HANA. He breaks down the root cause and his attempts to exploit it.

The post Identifying and Chasing RCE in SAP’s CommonCryptoLib appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/identifying-and-chasing-rce-in-saps-commoncryptolib.html/feed 0 Finding Crown Jewels: Hunting Through 180,000 Ruby Gems https://www.anvilsecure.com/blog/finding-crown-jewels-hunting-through-180000-ruby-gems.html https://www.anvilsecure.com/blog/finding-crown-jewels-hunting-through-180000-ruby-gems.html#respond Wed, 17 Jun 2026 05:28:28 +0000 https://www.anvilsecure.com/?p=7526 CTO Vincent Berg mirrored more than 180,000 Ruby gems and built a scanner to analyse them at scale. What he uncovered offers a fascinating look at the hidden risks and exposed data scattered throughout the Ruby ecosystem.

The post Finding Crown Jewels: Hunting Through 180,000 Ruby Gems appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/finding-crown-jewels-hunting-through-180000-ruby-gems.html/feed 0 How We Use LLMs in Secure Code Review https://www.anvilsecure.com/blog/how-we-use-llms-in-secure-code-review.html https://www.anvilsecure.com/blog/how-we-use-llms-in-secure-code-review.html#respond Thu, 04 Jun 2026 01:00:39 +0000 https://www.anvilsecure.com/?p=7454 Director of Research Tao Sauvage breaks down how Anvil uses LLMs during secure code review, keeping human judgment at the center. He compares two approaches across three open-source targets to show why a structured workflow catches more vulnerabilities.

The post How We Use LLMs in Secure Code Review appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/how-we-use-llms-in-secure-code-review.html/feed 0 How We Test AI: LLM & GenAI Security Methodology at Anvil Secure https://www.anvilsecure.com/blog/llm-genai-security-methodology-at-anvil-secure.html https://www.anvilsecure.com/blog/llm-genai-security-methodology-at-anvil-secure.html#respond Wed, 27 May 2026 16:59:31 +0000 https://www.anvilsecure.com/?p=7444 From threat modeling and attack surface mapping to jailbreaks and prompt injection, Security Engineer George Damiris walks through how Anvil Secure tests LLM and GenAI systems for security vulnerabilities.

The post How We Test AI: LLM & GenAI Security Methodology at Anvil Secure appeared first on Anvil Secure.

]]> https://www.anvilsecure.com/blog/llm-genai-security-methodology-at-anvil-secure.html/feed 0