ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
Product
•2026-06-12
•8 min read
Introducing Automated Application Threat Modeling
AI changed who writes code. ZeroPath keeps your application secure and true to your design, evaluating every change at the agent, the PR, and the repo.
ZeroPath Team
Product
•2026-05-11
•6 min read
Zero: AI Assistant For AppSec
We built an AI agent that runs your AppSec program. Here's what it actually does — from triaging bug bounty reports in about 10 minutes to building scheduled security sprints in plain English.
Peter Purcell
Insights
•2026-03-05
•8 min read
How Aptos Labs Scales Application Security Across 1M+ Lines of Rust with AI-Powered SAST
How Aptos Labs automated security testing across 70 engineers, accelerated vulnerability discovery by 8x, and saved 20+ hours per week with AI-powered SAST on Rust codebases.
ZeroPath Team
Product
•2024-11-01
•15 min read
How ZeroPath Works
Technical deep-dive into ZeroPath's SAST methodology: From AST generation to AI-powered vulnerability discovery and automated patch generation.
Raphael Karger
Research
•2026-04-28
•7 min read
CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD
ZeroPath Research discovered a SQL injection in ProFTPD's mod_sql extension (CVE-2026-42167) that can allow remote code execution, authentication bypass, and privilege escalation depending on configuration — exploitable pre-auth in some cases. Affects ProFTPD <= 1.3.9; patched in 1.3.9a.
John Walker
Research
•2026-05-07
•6 min read
CVE-2026-39816 Allows Privesc And Code Execution In Apache NiFi
ZeroPath Research discovered CVE-2026-39816 in Apache NiFi: when the optional nifi-other-graph-services-nar bundle is installed, authenticated users without the EXECUTE_CODE privilege can run arbitrary code on the NiFi server via ExecuteGraphQuery against a TinkerPop target. Affects NiFi >= 2.0.0-M1 and < 2.9.0; patched in 2.9.0.
John Walker
Research
•2026-04-20
•12 min read
Critical Spinnaker Vulns Allow RCE And Production Compromise
ZeroPath Research discovered two separate RCE vulnerabilities in Spinnaker (CVE-2026-32604 and CVE-2026-32613) that let low-privilege authenticated users execute code on Clouddriver and Echo, enabling credential theft and pivots into production cloud environments.
John Walker
Research
•2026-04-02
•10 min read
Benchmarking Opus 4.6 For Vuln Detection: Flashes Of Brilliance But Lots of Noise
We tested Opus 4.6 against 435 known vulnerable C functions from real CVEs. With good prompting and tools, it found up to 28.5% of vulnerabilities — impressive compared to human review, but with high false positive rates and inconsistency that underline the need for more sophisticated systems.
John Walker
Security Research
•2026-04-09
•10 min read
Unpatched RAGFlow Vulnerability Allows Post-Auth RCE
A currently-unpatched vulnerability in RAGFlow 0.24 allows low-privilege authenticated users to execute arbitrary code on instances using Infinity for chunk storage. We walk through the discovery, exploitation, and our disclosure process.
John Walker
Research
•2026-03-02
•7 min read
ZeroPath Exploit Development CTFs
Learn to exploit complex real-world vulnerabilities with zeropath-ctf, a set of self-contained exploit development exercises based on CVEs from the CISA Known Exploited Vulnerabilities list, powered by ZeroPath's shapeshifter vulnerability generation suite.
John Walker
Product
•2026-08-20
•5 min read
Reachability-Aware SBOMs: VEX That Knows What's Actually Exploitable
ZeroPath builds CycloneDX, SPDX, VEX, and AI-BOM exports from your scan inventory, and marks every CVE reachable or not_affected so you fix what's exploitable first.
Gaurav Sarraf
Research
•2026-08-17
•13 min read
Learning to Cheat: Why an OpenAI Model Hacked Into Hugging Face
An OpenAI model under evaluation broke out of its sandbox and into Hugging Face's infrastructure to steal the answers to the benchmark it was being graded on. Reward hacking explains it better than any of the individual vulnerabilities do.
Martin Doyhenard
Product
•2026-08-17
•5 min read
Posture-Safe Dependency Remediation: Upgrade PRs That Don't Make Your Security Worse
Dependabot bumps the version. ZeroPath makes sure the upgrade doesn't add a new CVE, proves transitive fixes in a sandbox, and flags which of your call sites might break.
Gaurav Sarraf
Product
•2026-08-13
•5 min read
Continuous CVE Alerting for the Dependencies You Already Ship
ZeroPath watches the OSV feed continuously and alerts you within minutes when a new CVE hits a dependency you already ship, triaged for reachability instead of waiting for your next scheduled scan.
Gaurav Sarraf
Product
•2026-08-10
•5 min read
Beyond CVSS: Contextual Vulnerability Intelligence for CVEs
CVSS rates worst-case severity, not real risk. ZeroPath layers four signals on every dependency CVE: the real advisory CVSS, CISA KEV, FIRST EPSS, and an AI-derived contextual severity for your repo, refreshed daily and kept honest.
Gaurav Sarraf
Insights
•2026-08-06
•5 min read
Reachability and Exploitability Triage: Which Dependency CVEs Actually Matter?
Traditional SCA flags every CVE whose version range matches your lockfile, even when the vulnerable code never runs. ZeroPath's AI agent checks whether each dependency CVE is reachable and exploitable in your app, adds KEV and EPSS signal, and opens fix PRs.
Gaurav Sarraf
Product
•2026-08-03
•5 min read
Build-less Dependency Scanning: SCA Coverage You Can Actually Verify
SCA forces a bad trade: run a fragile build for full coverage, or scan manifests and miss the transitive majority. ZeroPath resolves the full graph build-lessly for npm, Maven, and pinned Python, and reports exactly how much of your supply chain each scan resolved.
Gaurav Sarraf
Reports
•2026-07-31
•60 min read
The CISO's Guide to EU Cybersecurity Regulation (2026 Edition)
NIS2, the Cyber Resilience Act, DORA, RED and the AI Act: which EU cybersecurity rules reach you, what each one actually requires, and the deadlines that have already passed.
Gaurav Sarraf
Research
•2026-07-27
•10 min read
Introducing CatastropheBench
CatastropheBench evaluates frontier agents with tasks to find and develop a zero-day RCE exploit against the most important software on the internet. Today's models score zero.
ZeroPath Team
