ProjectDiscovery

The open models your team runs could get you pwned, and today’s tl;dr sec newsletter shared our research on how. We backdoored a 7B open model for under $50 and pointed Codex at it. It silently stole credentials 100% of the time, with zero false triggers. Read: tldrsec.com/p/tldr-sec-351

securetheweb.orgPHP2Shell: Is your PHP site affected?Two flaws in PHP itself allow unauthenticated remote code execution. Check your version and patch.

We wrote up how to find every PHP service you run, plus tips on patching and verifying them. We also started SecureTheWeb.org. It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix. go.projectdiscovery.io/php-2-shell

We found live API keys from NVIDIA, Nutanix and AllenAI employees sitting on public GitHub. -> some could upload models under the company's name -> some had been public for ~2 years -> 120k+ HuggingFace logins leaked in malware dumps Read the research: go.projectdiscovery.io/pwning-ailabs

Neo doesn't just run scans. It thinks through problems like a hacker would. That's a Neo user talking, not us. Try now: go.projectdiscovery.io/tryit

We backdoored a 7B open model for under $50. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain. Read the blog -> projectdiscovery.io/research/how...

🚨 CVE-2026-87902: WordPress remote code execution. Discover every WordPress site you run and see which ones are exploitable. Try for free with Neo: neo.projectdiscovery.io/sign-up?utm_... "Find my WordPress sites and test them for CVE-2026-87902. Ask me for my domains, CIDRs, or ASNs."

15 Sept

Factorial's cloud footprint grew faster than their security team could track by hand. Neo now scans their full external surface daily, and their researchers spend time on novel findings instead of toil. New case study on how they got there → https://bit.ly/3SQydqq

9 Sept

Every other week, we host 30-minute episodes of our Neo webinar series, Plugged In. Register once and you're set for the whole series. Tomorrow, September 9th at 10 AM PT / 1 PM ET, we're covering how to spend your credits wisely. Hope you can join us: https://bit.ly/4qY5DzQ

3 Sept

Confirmed findings with a working proof of concept. That's what a good night's rest looks like for Emma Sleep's security team 😴

bit.lyCode Smells and Verification Gaps – Communications of the ACM

2 Sept

There's an emerging gap between the amount of AI-generated code and security team capacity. Check out our co-founder's latest interview for his take on how we close the gap → https://bit.ly/4yg0DJe

31 Aug

Benchmark scores are a false flag. We ran open and closed models against 54 black-box web targets with no hints or source code, then read every run by hand. We'll uncover findings live on Tuesday, September 8th at 10 AM PT / 1 PM ET. Register: https://bit.ly/3SCK6QC

6 Aug

Nuclei, httpx, and subfinder got you this far. Neo takes it further, same tools, same team, running at scale. For the hackers of the world. Try it yourself → neo.projectdiscovery.io/sign-up

27 July

Pipe your dependency list into depx before you run install. One shortlist, one command, a verdict on every package across npm, PyPI, Go, Cargo, and RubyGems in a single pass.

github.comGitHub - projectdiscovery/depx: Malicious package & supply-chain intelligenceMalicious package & supply-chain intelligence. Contribute to projectdiscovery/depx development by creating an account on GitHub.

27 July

Try it here 👇

25 July

Neo reduces false positives by 90% and outperforms traditional scanners in speed, accuracy, and context awareness making it a much better choice over traditional tools. Try Neo → https://projectdiscovery.io/request-demo Check out the full video → https://www.youtube.com/watch?v=RsR7pPMDLEE

23 July

Check out our latest tool, depx! Seven days of malicious packages, pulled straight from OpenSSF's database and a live feed refreshed hourly. One command replaces manual advisory tracking. You see a compromised package the day it's flagged, not after it's already in a lockfile.

23 July

Try it here 👇

22 July

For Neo, we built a pipeline where multiple agents constantly test your attack surface. If an assessment comes up empty or hits a false positive, the loop automatically re-triggers to dig deeper. The results are incredible. https://projectdiscovery.io/request-demo https://youtu.be/RsR7pPMDLEE

bit.lyOh My Rogue Agent — ProjectDiscovery BlogYesterday, Hugging Face came out saying they'd detected an AI autonomous-agent-powered cyberattack and that they had to use open-source models to actually investigate and remediate it. Later we heard ...

22 July

The first public case of an AI agent hacking into someone else's production. We'd already reproduced this internally, on models 30x smaller. The industry calls it unprecedented. It isn't. Drop your worst agent story below. Full writeup: https://bit.ly/4gMo73j

bit.lyIntroducing Internal Network Scanning: see your network the way an attacker inside it would — ProjectDiscovery BlogMost breaches don't begin with a zero-day but with something ordinary like a forgotten server, an unmanaged network device, a service reachable across a segment that was supposed to be isolated. Inter...

22 July

Annual CVE volume is closing in on 50,000. Most scanners hand you thousands of findings; only a handful matter. Internal Network Scanning brings Nuclei's detection engine inside your network. Skip the backlog, fix a short list in hours. https://bit.ly/4x05j5y

Developing Neo from a single prototype into a multi-agent system taught us six core engineering truths: 1. Start with one agent. You learn the domain faster. Neo’s early months on a single sandbox agent taught us which tools and workflows mattered before we paid the "coordination tax."

View full thread

6. Architecture and cost optimization are coupled. We could not have shipped a plan → execute → verify pipeline at scale without aggressive prompt caching. Design with token economics in mind from day one. We are not done.

docs.neo.projectdiscovery.ioWelcome to Neo - neo

Learn more at:

View full thread

4. Execution and verification are different jobs. An agent optimized to "keep going" is wrong for judging whether to stop. We needed separate prompts, tools, and step budgets for each phase.

5. Parallelism belongs at the worker layer. Multiple orchestrators making independent decisions will fight each other. One Execution agent dispatching parallel workers scales better.

2. Split when context or duration breaks. Compaction and truncation are your signals to decouple. Parallelizing before the product explicitly demands it is premature complexity.

3. Subagents trade context for coordination. Working memory, scoped persistence, handoff envelopes, and transient streaming are not optional polish—they are the glue that makes delegation work.

20 July

Vegas is where we put Neo in front of the people who've shaped our work for years. We'll be at BSidesLV, Black Hat, and DEF CON Aug 2-7. 🤖 Booth 5108, AI Zone, Black Hat 📣 Two research talks, BSidesLV + DEF CON 🪩 NoiseFest with GreyNoise Thursday night Schedule: https://bit.ly/4vu4mkB

17 July

How accelerated exploitation HELPS⚡ The quicker you realize that your system is vulnerable (and can be exploited), the quicker you’ll be able to react and fix it. Our CEO shares exactly how we help companies detect vulnerabilities faster. Watch the full interview → https://youtu.be/798Sy04FM6c

17 July

If you've used an AI agent for recon or vulnerability scanning, there's a good chance LLMs ran our tools in the background. Neo is the harness we’ve built around LLMs and the tools you know and love. See it live at booth 5108, AI Zone, Black Hat. Save your spot with our team: https://bit.ly/4vu4mkB

16 July

You can build an AI security tool in a weekend. Getting it to prove findings are real at scale is the hard part. We wrote a breakdown of our research, including how prompt caching cut our own LLM costs by more than half. Check out our latest whitepaper to learn more: https://bit.ly/4bNNNcm

15 July

Exploitation speed has reached record highs, with the window between CVE announcement and attack shrinking from months to mere hours.

15 July

Attackers are now reverse-engineering repositories to exploit vulnerabilities before they are even public, while AI agents are discovering and exploiting zero-days in a continuous loop.

podcasts.apple.comProject Discovery | CEO Rishi Sharma on AI Disruption in Software ExploitationPodcast Episode · Secure Ventures with Kyle McNulty · June 2 · 44m

15 July

Link to the full podcast:

4 July

Neo as a Threat Hunter... We planted some test evidence of a compromise and asked Neo to check if the remote server is compromised, and it found it, along with more findings that we never considered👇

projectdiscovery.ioShould you build or buy your AI security tool? | ProjectDiscoverySee why building your own AI security tool is easy until the bill arrives. Join our next webinar to see where the build vs. buy math really lands.

29 June

Can you build an AI security tool in a weekend? Yes. Can you run it for a year? That's the question we're unpacking. Join the conversation: Watch the breakdown: projectdiscovery.io/webinars/build-vs-buy Read the analysis: projectdiscovery.io/whitepapers/build-vs-buy

When we started building Neo, the product was a single agent with sandbox and a large toolset. Today, a typical task runs through optional planning, an Execution agent that delegates to parallel specialized subagents, and a verification loop that can re-run work before the user sees a final answer.

View full thread

3. Verification Phase: A dedicated vulnerability-verifier-agent validates findings, generates PoCs, and strips out false positives before writing results to the database.

projectdiscovery.ioHow Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify — ProjectDiscovery Blog Our first engineering post covered prompt caching, the infrastructure change that made long-running agentic tasks economically viable. That post assumed a multi-step, multi-agent system already existed. It did not exist on day one. When we started building Neo, the product was a single agent with a sandbox and a large toolset. Today, a typical task runs through optional planning, an Execution agent that delegates to parallel specialized subagents, and a verification loop that can re-run w

Read the full engineering breakdown here →

Here is how the three-phase evolution works: 1. Planning Phase: Neo maps out the entire task, explores multiple paths, and resolves context gaps with the user upfront before executing a single command.

2. Execution Phase: A central orchestrator ("the conductor") delegates hyper-focused tasks to parallel, specialized subagents (recon, sandbox, browser) using structured working memory.

24 June

Building your own AI security tool feels easy until the bill arrives. Token burn climbs with every guarantee you add: validation, dedup, memory. June 30th we run the build vs. buy math live and take one finding from suspicion to verified. 10 AM PT / 1 PM ET → bit.ly/3SjaJcT

24 June

Why is Nuclei so popular? It's simple. Here’s our CEO, Rishi, elaborating on how Nuclei’s simplicity solves crucial exploitation problems Watch the full video → https://youtu.be/798Sy04FM6c?si=vZg59NBOajqM7WuQ

23 June

SSH into your server with Neo to further your capabilities 👇 Neo can use remote connection and the commands will now run in the remote device instead of Neo sandbox.

spectrum.ieee.orgHow Did Two Prompts Turn Into Potent Vibe Hacking Malware“Vibeware” is forcing new anti-malware strategies

23 June

"Hash matching is pointless. Defenders must go fully behavioral and use AI themselves to catch such malware." Our research lead @princechaddha in @IEEESpectrum on why vibecoded malware breaks traditional detection... and what actually works now. spectrum.ieee.org/vibecoding-m...

22 June

Is there an existential threat to ProjectDiscovery? We aren’t buying into the AI "psychosis" or "apocalypse" narrative. Instead, our focus remains on ensuring we consistently deliver high value to the security community. Staying ahead means moving faster.

podcasts.apple.comProject Discovery | CEO Rishi Sharma on AI Disruption in Software ExploitationPodcast Episode · Secure Ventures with Kyle McNulty · June 2 · 44m

22 June

Link to the full podcast:

dr-resources.darkreading.comBuild vs. Buy: The Hidden Cost of Building Your Own AI Security Stack, Free ProjectDiscovery WebinarFree Webinar to Build vs. Buy: The Hidden Cost of Building Your Own AI Security Stack Thurs, June 25, 2026, at 1pm EST

22 June

Everyone in security is asking the same question: can't we just use Claude Code for this? We ran the experiment so you don't have to. We are joining @DarkReading on Thursday to show what that gap actually looks like and demo it live. Join us! Register: dr-resources.darkreading.com/c/pubRD.mpl?...

projectdiscovery.ioThe Vulnerability Curve Bent With the AI Curve — ProjectDiscovery BlogHow CVE volume, known-exploited counts and time-to-exploit all changed shape across the LLM build-out and why defenders are now on the wrong side of the clock. In 2018 the world published about 18,00...

18 June

In 2018, the average vulnerability took 63 days to get exploited after disclosure. In 2024, that number went negative. Attackers are weaponizing bugs before they're even public. We pulled 8 years of CVE data to show exactly when the curve broke. projectdiscovery.io/blog/the-vul...