Continuous offensive security for modern engineering teams.
Joined April 2022
- Tweets294
- Following74
- Followers3.3K
- Likes139
Borg retweeted
We just launched our new way of dependency scanning!
Normally, dependency scans leave you standing with hundreds of vulnerable packages in your codebase, but only a select few might be genuinely affecting your codebase.
On average, we cut volume of findings by 95%
Borg retweeted
687 findings in 7 days.
Every Critical and High was actively tested and triaged—not scanner noise.
Continuous security should mean continuous proof.
Across Borg’s current findings, we’ve now uncovered:
🔴 44 Critical
🟠 305 High
🟡 1,140 Medium
⚪ 1,388 Low
But volume alone isn’t the goal.
The real value is proving which vulnerabilities are actually exploitable, cutting through false-positive noise, and helping engineering teams focus on what genuinely puts the business at risk.
Borg retweeted
Mjolnir just landed a bug bounty on @immunefi
Our autonomous pentester found a critical application-layer vulnerability in one of Web3’s largest blockchain ecosystems.
Impact confirmed.
Payout confirmed.
$10,000 bounty.
Autonomous offensive security is starting to work.
@BorgHQ
Borg retweeted
today @Borg_Security's autonomous hacking AI discovered a **huge** vulnerability on defi protocol with $20B TVL.
the vulnerability could have lead to loss of funds, and was in fact related to web2 infrastructure rather than their smart contracts.
benchmarking is cool and all, but the real battletest for agentic pentesting is bug bounties and real world testing with humans in the loop.
Borg retweeted
the team just cracked the code for **actual** agentic pentesting.
we beat other agentic pentesting frameworks and mastered complex attack chaining in agents
@Borg_Security @sjaluu @LORD_RIAN_
Borg retweeted
It's now a been week since React2Shell was made public.
Internally we're still seeing web3 platforms vulnerable to this exploit til' this day.
Considering a lot of web3 platforms use NextJS and React there's a lot of vectors the RCE can lead to causing loss of funds either directly via centralized PK storage or indirect attacks from malicious transactions prompted by the UI.
Web3 is really good at getting their smart contracts audited, however when it comes to their web2 infrastructure they are no better than your local hair salon with a website
Borg retweeted
🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.
The malicious payload works by silently swapping crypto addresses on the fly to steal funds.
If you use a hardware wallet, pay attention to every transaction before signing and you're safe.
If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.
It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.
Excellent report here: jdstaerk.substack.com/p/we-j…