davis retweeted
Security backlogs can run into the thousands or millions, and most findings turn out to be false positives or not exploitable. CVSS, EPSS, KEV, and AI scoring help decide what to look at first, but none tell you whether a finding is exploitable in your environment.
On Thursday, October 29th, Co-Founder and CEO @ehrishiraj and @dnklin will make the case for moving from ranking to proof. You’ll leave with a clearer way to run your backlog, where every report is confirmed, merged, or closed with reasoning, and the metric you track is how long it takes each one to get a verdict.
Tune in live at 10 AM PT / 1 PM ET, or save your spot → go.projectdiscovery.io/backl…
Join @ehrishiraj and I next week :)
Security backlogs can run into the thousands or millions, and most findings turn out to be false positives or not exploitable. CVSS, EPSS, KEV, and AI scoring help decide what to look at first, but none tell you whether a finding is exploitable in your environment.
On Thursday, October 29th, Co-Founder and CEO @ehrishiraj and @dnklin will make the case for moving from ranking to proof. You’ll leave with a clearer way to run your backlog, where every report is confirmed, merged, or closed with reasoning, and the metric you track is how long it takes each one to get a verdict.
Tune in live at 10 AM PT / 1 PM ET, or save your spot → go.projectdiscovery.io/backl…
davis retweeted
Our research on how open models can get you pwned was featured today in a newsletter read by more than 90,000 security professionals.
Abliterated models are growing in popularity because getting cyber-approved access to frontier models is still a pain. So we backdoored a 7B open model for less than $50 and pointed Codex at it. The moment we used the trigger phrase, it silently stole credentials, working 100% of the time with zero false triggers on normal user prompts.
Read the full issue here: tldrsec.com/p/tldr-sec-351
davis retweeted
Security backlogs are huge, and most findings aren’t exploitable. Better ranking (CVSS, EPSS, KEV, AI) still doesn’t prove what’s real in your environment, so the queue just grows.
Join our CEO @ehrishiraj and @dnklin, Head of Technical Solutions, to see why triage should move from ranking to proof.
Every report gets a verdict: confirmed, merged, or closed with reasoning.
Streaming on X on 10/29 at 10 AM PT / 1 PM ET
xitter.cf/i/broadcasts/1nJOLQDjb…
Check for PHP for free, democratize security.
We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them.
Commands plus prompts for your coding agent.
We also started SecureTheWeb.org
It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.
Read: go.projectdiscovery.io/SIC1T…
It's easy w/ Neo
🚨 PHP2Shell: CVE-2026-109618 & CVE-2026-109619🚨
Two critical PHP remote code execution bugs, affecting apps built on PHP like WordPress, Drupal, Magento, Laravel, and Joomla.
Discover every PHP server you run and see which ones are exploitable.
Run directly with Neo: go.projectdiscovery.io/php2s…
davis retweeted
🚨 PHP2Shell: CVE-2026-109618 & CVE-2026-109619🚨
Two critical PHP remote code execution bugs, affecting apps built on PHP like WordPress, Drupal, Magento, Laravel, and Joomla.
Discover every PHP server you run and see which ones are exploitable.
Run directly with Neo: go.projectdiscovery.io/php2s…
davis retweeted
Detect PHP-powered websites & IPs using the updated php-detect nuclei template
Link : github.com/projectdiscovery/…
davis retweeted
subfinder. httpx. nuclei. katana. naabu. dnsx. interactsh. cvemap. neo.
this is projectdiscovery.
davis retweeted
Recurring security work can quietly burn through credits if you treat it like a lightweight check.
In @neo_ai_engineer, every Automation run is a full task.
What if your pentest kept moving while you slept?
In Episode 4 of Plugged In With Neo, Patrick shows how Projects preserve context, Automations repeat proven prompts, and Autopilot chooses the next security task plus a first look at Triage.
CHAPTERS
00:00 Welcome and episode overview
01:03 Give the Work a Home: Projects
02:24 Creating a project and setting shared context
04:23 Project tasks, issues, files, visibility, and secrets
06:56 When to use projects instead of personal tasks
08:18 Run Work on a Schedule: Automations
09:55 Full reports, changes-only output, and scan cadence
11:36 Choosing models, agents, credentials, and outputs
14:34 Reviewing automation runs and history
15:49 Project automations and Neo's API-first workflow
16:41 GitHub, GitLab, OAuth, and custom API integrations
19:41 Automation costs, failures, notifications, and limits
21:40 Let the Project Drive: Autopilot
24:05 Autopilot demo, guardrails, and downstream actions
26:04 Autopilot best practices and persistent project memory
27:44 Projects, Automations, and Autopilot recap
28:44 Triage preview: validating findings from every tool
29:48 Triage demo and on-the-fly connectors
32:55 Q&A: Autopilot quality and security backlogs
34:37 Free plan availability and closing
instead of worrying about the 'perfectly' engineered prompt, @neo_ai_engineer let's you kick off security tasks like you're speaking to a colleague, in the apps you're already using.
davis retweeted
What if your pentest kept moving while you slept?
In Episode 4 of Plugged In With Neo, Patrick shows how Projects preserve context, Automations repeat proven prompts, and Autopilot chooses the next security task plus a first look at Triage.
CHAPTERS
00:00 Welcome and episode overview
01:03 Give the Work a Home: Projects
02:24 Creating a project and setting shared context
04:23 Project tasks, issues, files, visibility, and secrets
06:56 When to use projects instead of personal tasks
08:18 Run Work on a Schedule: Automations
09:55 Full reports, changes-only output, and scan cadence
11:36 Choosing models, agents, credentials, and outputs
14:34 Reviewing automation runs and history
15:49 Project automations and Neo's API-first workflow
16:41 GitHub, GitLab, OAuth, and custom API integrations
19:41 Automation costs, failures, notifications, and limits
21:40 Let the Project Drive: Autopilot
24:05 Autopilot demo, guardrails, and downstream actions
26:04 Autopilot best practices and persistent project memory
27:44 Projects, Automations, and Autopilot recap
28:44 Triage preview: validating findings from every tool
29:48 Triage demo and on-the-fly connectors
32:55 Q&A: Autopilot quality and security backlogs
34:37 Free plan availability and closing
davis retweeted
We found live API keys from NVIDIA, Nutanix and AllenAI employees just sitting on public GitHub.
-> some could upload models under the company's name
-> some had been public for almost 2 years
-> 120k+ HuggingFace logins leaked in malware dumps
Anyone with one of these keys could upload a poisoned model as a real company. And there's no easy way to tell.
davis retweeted
🚨 CVE-2026-104935 🚨
Ivanti Connect Secure authentication bypass (CVSS 10.0).
Discover every Ivanti VPN you run and see which ones are exploitable.
Run directly with Neo: go.projectdiscovery.io/CVE-2…
davis retweeted
Every other Wednesday, we host a 45-minute live session on getting the most out of Neo.
The next session is on Wednesday, October 14th at 1 PM ET, covering how to schedule tasks, manage projects, and leverage Autopilot for efficient security testing
We'll also give one randomly selected attendee additional Neo usage 👀
Save your spot → go.projectdiscovery.io/plugg…
