Anvil Secure

Introducing PQCDump: A Real Look at PQC Adoption

Anvil Secure — Wed, 09 Sep 2026 01:34:23 +0000

Senior Security Engineer Nicholas O'Shea introduces PQCDump, a passive analysis tool that parses SSH and TLS captures to show what post-quantum algorithms were actually negotiated, not just advertised, giving a fuller picture of real-world PQC adoption than active scanning alone.

The post Introducing PQCDump: A Real Look at PQC Adoption appeared first on Anvil Secure.

Passkey Editor: a Burp Suite Extension for Attacking WebAuthn

Anvil Secure — Mon, 10 Aug 2026 15:52:52 +0000

Security Engineer Matteo Giordano introduces Passkey Editor, a Burp Suite extension that decodes and edits WebAuthn ceremonies, drives one-click attacks against them, and re-signs across eleven COSE algorithms, all inside Burp itself.

The post Passkey Editor: a Burp Suite Extension for Attacking WebAuthn appeared first on Anvil Secure.

Internal AI Adoption Hackathon: What We Learned

Anvil Secure — Wed, 22 Jul 2026 06:55:43 +0000

Anvil Secure's internal AI adoption hackathon gave engineers dedicated time to explore practical AI use cases. Technical Director Antonios Papadopoulos shares what the team learned and what comes next.

The post Internal AI Adoption Hackathon: What We Learned appeared first on Anvil Secure.

Identifying and Chasing RCE in SAP’s CommonCryptoLib

Anvil Secure — Thu, 16 Jul 2026 07:06:42 +0000

Director of Research Tao Sauvage shares the latest chapter in his SAP research, chasing a bug from SAP's archive tool into CommonCryptoLib, a flaw reachable before authentication on SAP HANA. He breaks down the root cause and his attempts to exploit it.

The post Identifying and Chasing RCE in SAP’s CommonCryptoLib appeared first on Anvil Secure.

Finding Crown Jewels: Hunting Through 180,000 Ruby Gems

Anvil Secure — Wed, 17 Jun 2026 05:28:28 +0000

CTO Vincent Berg mirrored more than 180,000 Ruby gems and built a scanner to analyse them at scale. What he uncovered offers a fascinating look at the hidden risks and exposed data scattered throughout the Ruby ecosystem.

The post Finding Crown Jewels: Hunting Through 180,000 Ruby Gems appeared first on Anvil Secure.

How We Use LLMs in Secure Code Review

Anvil Secure — Thu, 04 Jun 2026 01:00:39 +0000

Director of Research Tao Sauvage breaks down how Anvil uses LLMs during secure code review, keeping human judgment at the center. He compares two approaches across three open-source targets to show why a structured workflow catches more vulnerabilities.

The post How We Use LLMs in Secure Code Review appeared first on Anvil Secure.

How We Test AI: LLM & GenAI Security Methodology at Anvil Secure

Anvil Secure — Wed, 27 May 2026 16:59:31 +0000

From threat modeling and attack surface mapping to jailbreaks and prompt injection, Security Engineer George Damiris walks through how Anvil Secure tests LLM and GenAI systems for security vulnerabilities.

The post How We Test AI: LLM & GenAI Security Methodology at Anvil Secure appeared first on Anvil Secure.

Demystifying Passkeys — Under the Hood: The Architecture

Anvil Secure — Wed, 13 May 2026 09:00:57 +0000

In Part 2 of a three-part series, Security Engineer Matteo Giordano explores passkey architecture, covering origin binding, synced vs. device-bound credentials, authenticator types, and deployment quirks like key wrapping and signature counters.

The post Demystifying Passkeys — Under the Hood: The Architecture appeared first on Anvil Secure.

Demystifying Passkeys — Under the Hood: The Protocol

Anvil Secure — Thu, 07 May 2026 01:00:22 +0000

In Part 1 of a new series, security engineer Matteo Giordano walks through the mechanics behind passkeys, from the FIDO2 protocol stack to the raw data structures exchanged during registration and authentication.

The post Demystifying Passkeys — Under the Hood: The Protocol appeared first on Anvil Secure.

Introducing OffTempo, Statistical Timing Side-Channel Analysis for Burp Suite

Anvil Secure — Wed, 29 Apr 2026 09:51:18 +0000

Senior Security Engineer Riccardo Nannini introduces OffTempo, a Burp Suite extension designed to identify timing-based information leaks by comparing request patterns and analysing subtle differences in response times.

The post Introducing OffTempo, Statistical Timing Side-Channel Analysis for Burp Suite appeared first on Anvil Secure.