more than $6 million have been awarded to security researchers hunting on the Cantina bug bounty platform. day and night, security researchers act as the digital vanguard of the tech world, protecting millions of users, preventing catastrophic scenarios and proving how much brilliant minds of all ages can safeguard the future of technology. we all thank you for your service.

we pointed Apex at a software used to secure billions of devices across VPNs, smart homes, and even healthcare billing systems. in its search, Apex found 2 ways that an attacker could have tricked applications using wolfSSL into exfiltrating sensitive information to a malicious server controlled by the bad actor, diverting it from its intended destination. wolfSSL responded quickly and fixed both in 5.9.4. if you use an affected configuration, update to 5.9.4 or later immediately. the technical breakdown of both vulns: cantina.review/wolfssl-resea…

when prompt injection hits an agent, it can trigger an exfil of secrets, then it will turn into a remotely executed attack. these chain reactions are hitting defenders every day. do we have the capabilities to fight against today's agentic risks? current tools only surface volumes of alerts (a big portion of false positives, but there's always the "what if" percentage that poses an incremental risk if delayed to act on). this is why we built Clarion, to take the signals across any complexity-level environment, correlate activity, contain the host, block the access, and ship the fix. it reduces the headcount and resources of any security team so they can focus on what is important and urgent. what matters most is the speed to act in time. we're here to provide that speed: cantina.review/clarion-57954…

catching bugs that let bad actors on the same Wi-Fi change people’s code without ever touching their laptop. Apex just found a high-severity bug in a tool that developers use to build, develop and test app interfaces. If the dev server was accessible over the network, someone on the same Wi-Fi could obtain its access credentials and use commands to inject malicious code into your project files. not only that, but if the Vitest addon was installed, the injection could also lead to remote code execution on the device. the Storybook team has fixed the issues. full writeup: cantina.review/storybook-3f8…

Apex Flash hit more than 2.8k downloads in just over a week. the future of security is ours to build. stay tuned as exciting news will be announced soon. try it out: cantina.security/apex-flash

people should not have to investigate a hospital’s software before asking for care. keeping their records private is the responsibility of the experts who build and run those systems. we’re talking about the most sensitive information that someone can ever share. Apex autonomously found 9 bugs in an open source electronic health records and medical management platform, with 2 rated high and 7 medium. one of the high-severity vulnerabilities let a patient who was logged in retrieve another patient’s file, while the other let a staff member with minimum access move a private file into a less protected environment and then download it. the team fixed those 2 in OpenEMR 8.3.0 and the 7 additional findings in 8.4.0. cantina.review/openemr-a245f…

open weights. open weights. open weights. Apex Flash is coming, trained for security research.

we will be giving away a limited amount of Apex credits for people to run a free vulnerability scan on a code base! this offer will only be available for 24 hours. register in the link below. cantina.review/free-scan

In 2011, researchers spent six CPU years stress testing CompCert and found zero bugs in its formally verified core. CompCert later added new x86-64 code. 15 years after, Apex found a vulnerability in the new code which followed another discovery of 3 CompCert bugs a few weeks earlier. CompCert’s mathematical model used the right values but the compiled code picked up leftover data in the processor’s register, causing a program crash or jump to the wrong location. if we want inherited software to stay safe we must keep challenging even after formal verification and years of fuzzing. we built Apex to help teams continuously test the software they rely on as new code is developed. full writeup: cantina.review/switch-miscom…

we've been asked several dozen times how we ended up at #1 on the @Hacker0x01 US leaderboard, and the answer is...Apex Black. we created an autonomous penetration testing system called APEX BLACK. it runs as a swarm of agents that can interact with applications like real users do. with hundreds of automated security capabilities, they can find any unexpected behavior and produce valid exploits. each time we point Apex at a target it finds a bug. we have not optimized to be #1, this is just a byproduct of our work. we will be talking more about our offensive security work so stay tuned!

security will win, no matter what.

we trust machines with our jobs, our finances, our health records, the things we most can’t do without. we rely on them to store and retrieve all that data and ensure everything is always in the correct location. we put Apex into Seagate’s openSeaChest storage toolkit. It found 3 ways the software could lose track of where its own memory ended. The only CVEs from Seagate this year: cantina.review/openseachest-…

Clarion now reads Claude Code telemetry and turns every MCP server your agents touch into an audited and tracked asset. For everything else new in the platform: cantina.review/claude-code-9…

Apex's intelligence compounds over time. We wanted to check the performance of Apex vs. other tools like Claude and Codex Security. We ran all three on the same codebase and applied a single quality bar to the findings that they generated . Results coming later today.