Pinned Tweet
‼️ MAJOR ANNOUNCEMENT
TLDR:
- Trust Security is now TrustSec. New name, new logo, new website.
- We’re setting industry standards on how security teams communicate their work. Our entire portfolio is now on open display - every audit, bounty, contest win. Full transparency, ng further, we present every competitor audit ran in parallel to us, on same commit. No cherry picking. It’s a pure measure of skill, and the results are conclusive.
- Same team, same standard, same depth. The quality never changed. Now the visibility catches up. Everything's in place to hit entirely new ceilings.
Full breakdown below ⤵️
TLDR:
- Trust Security is now TrustSec. New name, new logo, new website.
- We’re setting industry standards on how security teams communicate their work. Our entire portfolio is now on open display - every audit, bounty, contest win. Full transparency, ng further, we present every competitor audit ran in parallel to us, on same commit. No cherry picking. It’s a pure measure of skill, and the results are conclusive.
- Same team, same standard, same depth. The quality never changed. Now the visibility catches up. Everything's in place to hit entirely new ceilings.
Full breakdown below ⤵️
11
16
122
20,123
Incredible work by the teams finding PHP2Shell and disclosing responsibly!
While many see this as a case study of how white hats and vendors collaborate to protect users, we want to share a more realistic take.
The log shows the finding was discoverable by AI tooling for 2 months prior to the public patch. That's an eternity for malicious actors to infiltrate ~70% of the world's servers, where they can steal data, launch watering hole attacks and pivot into organization networks. Companies like CrowdStrike reported in-the-wild exploitation prior to the announcement.
To believe that only a couple of WH teams knew about it is beyond wishful thinking. It will take years (if ever) to get a real damage report. If we ran PHP on our stack we would probably assume compromise and work from there.
The entire software mitigation paradigm needs to be rethought. Third-party software that is deployed everywhere should not be treated the same as first-party code that can be patched within hours and without a public trace.
The big players must show leadership in working towards mandatory atomic patching operations. Anything else will simply not be good enough when AI is able to parallel-discover 0days, or to read patch diff and develop exploits in minutes. We'll probably lose that fight too, but at least it will be a closer one than what we have now.
While many see this as a case study of how white hats and vendors collaborate to protect users, we want to share a more realistic take.
The log shows the finding was discoverable by AI tooling for 2 months prior to the public patch. That's an eternity for malicious actors to infiltrate ~70% of the world's servers, where they can steal data, launch watering hole attacks and pivot into organization networks. Companies like CrowdStrike reported in-the-wild exploitation prior to the announcement.
To believe that only a couple of WH teams knew about it is beyond wishful thinking. It will take years (if ever) to get a real damage report. If we ran PHP on our stack we would probably assume compromise and work from there.
The entire software mitigation paradigm needs to be rethought. Third-party software that is deployed everywhere should not be treated the same as first-party code that can be patched within hours and without a public trace.
The big players must show leadership in working towards mandatory atomic patching operations. Anything else will simply not be good enough when AI is able to parallel-discover 0days, or to read patch diff and develop exploits in minutes. We'll probably lose that fight too, but at least it will be a closer one than what we have now.
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP
WordPress pre-auth RCE: ✅
Drupal pre-auth RCE: ✅
Joomla pre-auth RCE: ✅
Remote memory disclosure of any PHP application: ✅
Read more ⬇️🧵
1
1
21
2,392
TrustSec retweeted
Anthropic continues to abstract away any notion of hands-on control over their codebase.
How reassuring is it for world leaders, tech companies, or to the average person, that some of the most consequential software in history is not even read by a human?
What is even the AI safety models in a world where AI giants delegate their implementation to yet more AI? What does human-in-the-cockpit achieve when no one understands how the engine works? How many catastrophes have to happen before we stop sci-fi LARPing and come back to a sane accountability mindset?
How reassuring is it for world leaders, tech companies, or to the average person, that some of the most consequential software in history is not even read by a human?
What is even the AI safety models in a world where AI giants delegate their implementation to yet more AI? What does human-in-the-cockpit achieve when no one understands how the engine works? How many catastrophes have to happen before we stop sci-fi LARPing and come back to a sane accountability mindset?
New on our Engineering blog: Creating in-house source control.
In May, we merged around 2,500 code changes per day. In September, we merged more than 30,000 per day. As a result, we became bottlenecked by developer infrastructure built for human (rather than agent) scale.
Here, we share how we built a new version control system—and fully migrated our monorepo from git—in five months: anthropic.com/engineering/re…
0
1
7
761
We're proud to be making such a profound impact on the DeFi landscape.
Being recognized by the leading platform as the #1 team on the leaderboard is a huge motivator to continue securing the space 🫡
Being recognized by the leading platform as the #1 team on the leaderboard is a huge motivator to continue securing the space 🫡
This security researcher just made $300,000 for finding a Critical vulnerability in a smart contract 🔥
@TrustSecAudits now sits at #1 on the @immunefi 90-day leaderboard.
He’s a Top Ranking security researcher who has found 6 Critical vulnerabilities and a staggering 22 High code, including bugs that could have led to the direct theft of funds.
Huge win. Congrats @TrustSecAudits, well deserved! 🚀
6
1
85
2,766
TrustSec is heading to Singapore for @token2049, the world’s largest crypto gathering.
We’re looking forward to meeting builders, investors and partners shaping Web3.
Want to discuss premium-grade security? DM or find us around. Side event invites welcome.
We’re looking forward to meeting builders, investors and partners shaping Web3.
Want to discuss premium-grade security? DM or find us around. Side event invites welcome.
0
0
5
1,201
Proud to partner with @Morpho again to secure the latest Midnight assets!
Morpho Midnight audit reports are now available in the Github repo
Thanks to @spearbit @cantinasecurity @blackthornxyz @TrustSecAudits @StErMi
See the reports via the link below
github.com/morpho-org/mid…
0
1
15
1,926
TrustSec has completed a security audit for @NDAChain_VN , Vietnam’s national blockchain platform 🔒
Our review focused on core contracts, which form the foundation for all on-chain activity and define the rules by which the broader system operates.
While our findings remain significantly contributed to strengthening the security of NDAChain’s underlying infrastructure.
Our review focused on core contracts, which form the foundation for all on-chain activity and define the rules by which the broader system operates.
While our findings remain significantly contributed to strengthening the security of NDAChain’s underlying infrastructure.
1
1
14
1,770
@NDAChain_VN In HCMC for @Convictionvn ? Find us to discuss bespoke security for your protocol or fund.
0
0
1
664
We’re excited to meet builders, investors and partners at one of Web3’s biggest hotspots.
Looking to discuss how premium-grade Web3 security works in 2026? DM or find us around.
Looking to discuss how premium-grade Web3 security works in 2026? DM or find us around.
0
0
14
1,259
TrustSec retweeted
Amazing finding @TrustSecAudits & @ZeroCool_AI
Disclosing a critical theft of funds exploit we identified and disclosed to @AlchemixFi in June!
Their ETH MYT vault integrated unsafely with Tokemak strategy - we chained several primitives to trigger loss of $3M within a consecutive 1-min attack. 🧵
3
2
44
3,592
Disclosing a critical theft of funds exploit we identified and disclosed to @AlchemixFi in June!
Their ETH MYT vault integrated unsafely with Tokemak strategy - we chained several primitives to trigger loss of $3M within a consecutive 1-min attack. 🧵
Their ETH MYT vault integrated unsafely with Tokemak strategy - we chained several primitives to trigger loss of $3M within a consecutive 1-min attack. 🧵
8
13
140
14,197
Alchemix handled it with speed and precision, fixing within a day and awarding the max bounty of $300k.
Major credit to @ZeroCool_AI for the scan that led us down this path.
All the details and live PoC below 📔 :
Major credit to @ZeroCool_AI for the scan that led us down this path.
All the details and live PoC below 📔 :
2
1
44
25,456
Thrilled to announce our partnership with @ZeroCool_AI !
We bring: bounty selection, weak spots alpha, triaging, novel escalation paths, platform gotchas
They provide: raw audit intelligence at almost unlimited scale and speed, served in triage-ready format
Result: tens of millions of $ rescued, several projects live another day
Huge bounty reveal coming up 🤯🚀
Meanwhile, here’s our blog post 👇 :
We bring: bounty selection, weak spots alpha, triaging, novel escalation paths, platform gotchas
They provide: raw audit intelligence at almost unlimited scale and speed, served in triage-ready format
Result: tens of millions of $ rescued, several projects live another day
Huge bounty reveal coming up 🤯🚀
Meanwhile, here’s our blog post 👇 :
5
1
38
2,695
TrustSec retweeted
Was a pleasure to collaborate with folks at TrustSec🔒Would recommend to anyone looking to challenge design decisions and economic design of their protocol.
@TrustSecAudits 🤝@Morpho 🤝@TenorFinance
It was fantastic to audit the final piece of the Midnight trilogy (Core, Bundle & Tenor Periphery). Four prior reviews & FV did not stop us from delivering unique finds & value.
Glhf with the launch!
0
1
11
1,014
@TrustSecAudits 🤝@Morpho 🤝@TenorFinance
It was fantastic to audit the final piece of the Midnight trilogy (Core, Bundle & Tenor Periphery). Four prior reviews & FV did not stop us from delivering unique finds & value.
Glhf with the launch!
It was fantastic to audit the final piece of the Midnight trilogy (Core, Bundle & Tenor Periphery). Four prior reviews & FV did not stop us from delivering unique finds & value.
Glhf with the launch!
We’re building Tenor with a strong commitment to security.
That means a codebase built on @Morpho Midnight 🕛, 5 independent audits by leading firms, formal verification using the Certora prover, AI-assisted reviews, a bug bounty program, and ongoing monitoring using @blockaid_
Learn more about our approach to security:
1
2
17
3,681
Proud to announce the completion of our security engagement with @Morpho ! Even after multiple T1 audits and comprehensive FV, our team identified meaningful issues and helped shape the security of Morpho Midnight. Wishing the team a great launch!
Links👇
Links👇
2
1
49
3,410