Anvil delivers high-quality infosec consulting services. To work with the industry's finest or to simply get more information contact us [email protected].
Seattle, WA
Joined February 2017
- Tweets301
- Following503
- Followers203
- Likes372
🛰️ Houston, we have a vulnerability...
This Saturday at @BSidesPDX, @anvil_secure's Riccardo Nannini will share his findings on security vulnerabilities in miniature satellite communications. If you're headed to #BSidesPDX, be sure to check it out!
Oct 24 | 11:30 AM
#InfoSec #Cybersecurity
⛵ Anvil Secure's Jason Tyler and Julie Kipp are swapping their desks for the open water!
The J/105 North American Championship starts today in Seattle, with Jason and Julie racing on separate boats.
These pics show a glimpse of last weekend's warm-up, including Julie getting slammed by a wave! 🌊
Good luck to you both!
🛰️ What started as a side research project led @anvil_secure engineer Riccardo Nannini to uncover eight vulnerabilities in NASA’s ION-DTN, resulting in eight security advisories from @NASAJPL.
Read the full story: anvilsecure.com/blog/nasa-io…
#SecurityResearch #Fuzzing
Awesome work, Alessandro! 👏
An impressive disclosure from Alessandro Fanio Gonzalez targeting Chroma with a 2 N-days & 1 collision in the AI Infrastructure category for a net total win of $4,500 and 1 Master of Pwn points #Pwn2Own
From the forge at @anvil_secure, we’re excited to introduce Field Notes 📝
Issue 1 looks at predictable usernames and passwords in a healthcare platform’s temporary account system.
Both were generated from the same weak random string. Read why the two weren’t actually independent, and why fixing the RNG wouldn’t have solved it.
🔗 anvilsecure.com/blog/predict…
#AppSec #CodeReview #CyberSecurity
🔐 Passkeys resist credential stuffing and AiTM phishing. But the attack surface doesn't end there.
In Part 3 of his passkey series, Matteo Giordano maps it into a practical testing framework.
📄 Read it here: anvilsecure.com/blog/passkey…
#Passkeys #WebAuthn #AppSec
Before we try to break a system, we need to understand how it’s meant to work. That’s not something you can do if you rely on scanners alone.
☁️ Learn more about how we approach App & Cloud Security testing: anvilsecure.com/application-…
#AppSec #CloudSecurity #Cybersecurity
Anvil Secure retweeted
But they’re more dangerous with AI. theverge.com/science/997834/…
This week, @anvil_secure Senior Operations Manager Dimitra Pechlivanidou attended the W4C Cybersecurity Conference in Brussels. 🔐
The event explored some of the key issues shaping our industry, including AI, emerging threats and the human side of security.
Thanks to Women4Cyber for putting together such an insightful event! 👏
#W4C2026 #Cybersecurity #W4C
Our engineers recently bypassed a hardware-backed validation step on a device.
It's exactly why we have a dedicated Embedded Security Lab: to catch flaws before deployment (especially the ones firmware can’t fix later!).
🔬 Learn how the lab works: anvilsecure.com/embedded-sec…
#EmbeddedSecurity #FaultInjection
Your servers might support PQC algorithms. But are your connections actually using them?
PQCDump analyzes real SSH and TLS traffic to find out.
Built by Anvil Senior Security Engineer Nicholas O’Shea as a companion to PQCScan.
Read more + try it: anvilsecure.com/blog/pqcdump…
#PQC #Cybersecurity
Anvil Secure retweeted
A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine. wired.com/story/atm-flaws-re…
The latest Anvil Signal is out! 📰
This month: following interesting problems and seeing where they lead, from our AI Adoption Hackathon to passkey tooling, DEF CON, and SAP research.
🔗 Read: 46916957.hs-sites.com/anvil-…
🔗 Subscribe: anvilsecure.com/research-upd…
#CyberSecurity #SecurityResearch #InfoSec
A @defcon debut and a new open-source tool! ⚙️
Last weekend, Anvil Engineer Matteo Giordano introduced Passkey Editor, his new @Burp_Suite extension for attacking WebAuthn.
See how it works + check out the tool: anvilsecure.com/blog/passkey…
#DEFCON34 #WebAuthn #cybersecurity
Anvil Secure retweeted
The whitepaper is live! Read "Can AI Do Novel Security Research? Meet the HTTP Terminator" here ->
portswigger.net/research/htt…
Anvil Secure retweeted
‼️ ALERT - Windows malware could silently sign in to passkey-protected accounts.
Researchers found 3 post-compromise paths in Chrome's Google Password Manager that could bypass user verification, plant an attacker-controlled key, or recover the secret protecting an account's synced passkeys.
Two give reusable access from another machine.
Here's how the attacks work: thehackernews.com/2026/08/go…
Passkeys are marketed as phishing-resistant. But the WebAuthn ceremony is only part of the story.
On Aug. 9 at @defcon, Anvil engineer Matteo Giordano debuts Passkey Editor and explores where passkey deployments really break down.
If you're going to DEF CON, be sure to swing by!
#DEFCON34 #Passkeys #WebAuthn
Rather than keep debating AI, we put it to the test.
We recently ran an internal AI adoption hackathon to explore real use cases. Our latest blog post covers what we learned and how you can run your own.
🔗 anvilsecure.com/blog/ai-adop…
#CyberSecurity #AISecurity #Hackathon
Interesting write-up from @CharlieEriksen (@AikidoSecurity) on dormant #RubyGems accounts used to slip malware into trusted packages.
Feels timely: last month, our CTO scanned 180K RubyGems packages and found a surprising number of secrets sitting out in the open.
Read the research: anvilsecure.com/blog/finding…
We're calling it SleeperGem. Full writeup by @CharlieEriksen aikido.dev/blog/sleepergem-r…
Our Director of Research, Tao Sauvage, is back with his third SAP blog post. It's a practical look at persistence, careful root-cause analysis, and pulling on one technical thread until it leads somewhere unexpected. 🧵
Take a trip down the rabbit hole with him and check out his slides from his talk at LeHACK!
🔗: anvilsecure.com/blog/identif…
#SAPSecurity #AppSec
