<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>ProjectDiscovery Blog</title>
    <link>https://projectdiscovery.io/blog</link>
    <description>Latest stories, research, and updates from the ProjectDiscovery team</description>
    <language>en-us</language>
    <lastBuildDate>Mon, 27 Jul 2026 20:43:30 GMT</lastBuildDate>
    <atom:link href="https://projectdiscovery.io/rss.xml" rel="self" type="application/rss+xml" />
    
    <item>
      <title><![CDATA[Oh My Rogue Agent]]></title>
      <link>https://projectdiscovery.io/blog/oh-my-rogue-agent</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/oh-my-rogue-agent</guid>
      <pubDate>Wed, 22 Jul 2026 20:37:22 GMT</pubDate>
      <description><![CDATA[Yesterday, Hugging Face came out saying they'd detected an AI autonomous-agent-powered cyberattack and that they had to use open-source models to actually investigate and remediate it. Later we heard from OpenAI that their agent was responsible; it happened during an ExploitGym eval, and the agent just drifted off the goal. It escaped the sandbox, reached OpenAI Research Environment, got access to internet, and hacked Hugging Face production environment trying to find the solution for the benchm]]></description>
      <category><![CDATA[Industry]]></category>
      <category><![CDATA[ai]]></category>
      <category><![CDATA[Research]]></category>
      <category><![CDATA[Neo]]></category>
    </item>
    <item>
      <title><![CDATA[Introducing Internal Network Scanning: see your network the way an attacker inside it would]]></title>
      <link>https://projectdiscovery.io/blog/introducing-internal-network-scanning-see-your-network-the-way-an-attacker-inside-it-would</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/introducing-internal-network-scanning-see-your-network-the-way-an-attacker-inside-it-would</guid>
      <pubDate>Tue, 21 Jul 2026 21:48:40 GMT</pubDate>
      <description><![CDATA[Most breaches don't begin with a zero-day but with something ordinary like a forgotten server, an unmanaged network device, a service reachable across a segment that was supposed to be isolated. Internal scanning was supposed to catch exactly that but most scanners match a host's banner and version against a CVE list and flag everything potentially affected, so the few reachable exposures sit lost among thousands that were never exploitable.

That noise is expensive now that the window to respon]]></description>
      <category><![CDATA[Vulnerability Management]]></category>
      <category><![CDATA[Scanners]]></category>
    </item>
    <item>
      <title><![CDATA[Community Spotlight: Rishi (@rxerium)]]></title>
      <link>https://projectdiscovery.io/blog/community-spotlight-rishi-rxerium</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/community-spotlight-rishi-rxerium</guid>
      <pubDate>Mon, 13 Jul 2026 06:12:18 GMT</pubDate>
      <description><![CDATA[“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium)



If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con]]></description>
      
    </item>
    <item>
      <title><![CDATA[The Vulnerability Curve Bent With the AI Curve]]></title>
      <link>https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve</guid>
      <pubDate>Thu, 18 Jun 2026 18:32:03 GMT</pubDate>
      <description><![CDATA[How CVE volume, known-exploited counts and time-to-exploit all changed shape across the LLM build-out and why defenders are now on the wrong side of the clock.

In 2018 the world published about 18,000 CVEs and the average vulnerability took roughly two months to get exploited after it went public. By 2025 the world was publishing nearly 50,000 CVEs a year and the average vulnerability was being exploited before it was disclosed.

Those two facts are the whole story. The number of vulnerabilitie]]></description>
      
    </item>
    <item>
      <title><![CDATA[Continuous PR Security Review]]></title>
      <link>https://projectdiscovery.io/blog/continuous-pr-security-review</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/continuous-pr-security-review</guid>
      <pubDate>Mon, 15 Jun 2026 16:26:15 GMT</pubDate>
      <description><![CDATA[The security findings that end up in incident post-mortems rarely looked dangerous in the PR that introduced them. Not because anyone was careless but because there's nothing in the change that looks wrong. The code does exactly what it says but the problem is in how the app behaves once it's running.

A new endpoint ships without a permission check but every other route in the file handles permissions correctly, so nothing about it stands out. Or a response comes back carrying more of a user's ]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Application Security]]></category>
    </item>
    <item>
      <title><![CDATA[How Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify]]></title>
      <link>https://projectdiscovery.io/blog/neo-agent-architecture</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/neo-agent-architecture</guid>
      <pubDate>Mon, 01 Jun 2026 18:28:00 GMT</pubDate>
      <description><![CDATA[


Our first engineering post covered prompt caching, the infrastructure change that made long-running agentic tasks economically viable. That post assumed a multi-step, multi-agent system already existed.


It did not exist on day one.


When we started building Neo, the product was a single agent with a sandbox and a large toolset. Today, a typical task runs through optional planning, an Execution agent that delegates to parallel specialized subagents, and a verification loop that can re-run w]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Engineering]]></category>
    </item>
    <item>
      <title><![CDATA[Red-Teaming Cloud Infrastructure with Neo]]></title>
      <link>https://projectdiscovery.io/blog/red-teaming-cloud-infrastructure-with-neo</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/red-teaming-cloud-infrastructure-with-neo</guid>
      <pubDate>Thu, 21 May 2026 12:18:50 GMT</pubDate>
      <description><![CDATA[Most AI security tooling shipped over the last year focuses on one of two workflows, code review at PR time or zero-day research in open-source software. Models in PR pipelines now flag insecure patterns at every commit and autonomous research runs have produced more zero-days across open-source projects than the patch teams behind them can realistically triage. We've been running Neo on both of those workflows at ProjectDiscovery for a while now, surfacing zero-days in production software and t]]></description>
      <category><![CDATA[Neo]]></category>
    </item>
    <item>
      <title><![CDATA[Nuclei Templates - April 2026]]></title>
      <link>https://projectdiscovery.io/blog/nuclei-templates-april-2026</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/nuclei-templates-april-2026</guid>
      <pubDate>Tue, 12 May 2026 11:26:09 GMT</pubDate>
      <description><![CDATA[Two releases shipped this cycle - v10.4.2 (April 15) and v10.4.3 (May 5) - delivering deep KEV coverage, a major push into AI/LLM attack surface, fresh Perforce visibility, and broad quality improvements across the template library.


🚀 April Stats






Release
New Templates
CVEs Added
First-time Contributors




v10.4.2
121
61
15


v10.4.3
105
62
12


Total
226
123
27






 * 226 new templates shipped across both releases
 * 123 CVEs covered, including ~10 actively exploited vulnerabilities ]]></description>
      <category><![CDATA[Nuclei & Templates]]></category>
    </item>
    <item>
      <title><![CDATA[The Trust Gap Behind the AI Coding Boom: What 200 Security Practitioners Just Told Us]]></title>
      <link>https://projectdiscovery.io/blog/the-trust-gap-behind-the-ai-coding-boom-what-200-security-practitioners-just-told-us</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/the-trust-gap-behind-the-ai-coding-boom-what-200-security-practitioners-just-told-us</guid>
      <pubDate>Tue, 28 Apr 2026 18:05:58 GMT</pubDate>
      <description><![CDATA[New research from ProjectDiscovery surfaces an uncomfortable truth: Engineering has accelerated, and Security has been left to absorb the impact, mostly by hand.

If you work in application security right now, you already know the shape of the problem. Pull requests are landing faster than they used to. The diffs are bigger. The author on the commit is increasingly your engineering team's AI assistant, not the engineer themselves. And somewhere downstream, you and a small team are expected to ke]]></description>
      <category><![CDATA[Research]]></category>
      <category><![CDATA[Application Security]]></category>
    </item>
    <item>
      <title><![CDATA[Benchmarking Neo's Black-Box DAST Capabilities]]></title>
      <link>https://projectdiscovery.io/blog/neo-black-box-dast-capabilities</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/neo-black-box-dast-capabilities</guid>
      <pubDate>Mon, 27 Apr 2026 17:11:00 GMT</pubDate>
      <description><![CDATA[Since the launch of Neo, we've been steadily expanding what it can do. Neo has found 33+ real CVEs across open-source projects, performed well on white-box security testing where source code is available, and generally proven itself as a capable security engineer when it has context to work with.

What we hadn't shared yet is how Neo does when it's operating purely as a black-box DAST agent no source code, no architecture context, just a URL. The prompt Neo gets is a minimal prompt with no guida]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[DAST]]></category>
    </item>
    <item>
      <title><![CDATA[Neo v. DIY: The gap between a single finding and a mature security program]]></title>
      <link>https://projectdiscovery.io/blog/neo-vs-diy</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/neo-vs-diy</guid>
      <pubDate>Fri, 17 Apr 2026 19:05:29 GMT</pubDate>
      <description><![CDATA[In our latest webinar, our Founding Solutions Engineer, Davis Franklin, addressed the massive gap between finding a vulnerability with an LLM and running a mature security program. That gap is what Neo is built to close.

With the release of Opus 4.6 and the announcement of Mythos, the question we hear constantly has gotten louder: Can I just build this with Claude Code? The short answer is yes. You can spin up a working PoC in about half an hour, find a real vulnerability, and feel genuinely co]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Webinar]]></category>
    </item>
    <item>
      <title><![CDATA[How We Cut LLM Costs by 59% With Prompt Caching]]></title>
      <link>https://projectdiscovery.io/blog/how-we-cut-llm-cost-with-prompt-caching</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/how-we-cut-llm-cost-with-prompt-caching</guid>
      <pubDate>Fri, 10 Apr 2026 02:42:06 GMT</pubDate>
      <description><![CDATA[At ProjectDiscovery, we've been building Neo, an autonomous security testing platform that runs multi-agent, multi-step workflows, routinely executing 20-40+ LLM steps per task. Vulnerability assessments, code reviews, and security audits at scale, enabling continuous testing across the entire development lifecycle.

When we launched, our LLM costs were staggering. A single complex task with Opus 4.5 could consume 60 million tokens. Then we implemented prompt caching. Here's what changed:






]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Engineering]]></category>
    </item>
    <item>
      <title><![CDATA[Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.]]></title>
      <link>https://projectdiscovery.io/blog/everyone-is-finding-vulns-the-hard-part-is-proving-them</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/everyone-is-finding-vulns-the-hard-part-is-proving-them</guid>
      <pubDate>Fri, 20 Mar 2026 16:14:10 GMT</pubDate>
      <description><![CDATA[LLMs are a genuine leap forward for vulnerability discovery. Anthropic reported 500+ zero-days from Opus 4.6 and OpenAI's Codex Security discovered 14 CVEs across projects like OpenSSH and GnuTLS. If you've experimented with LLMs for security testing, you've probably been impressed too.

The practical reality for a security team deploying AI is messier than the headlines or early POC results suggest. Noise compounds fast. Anthropic brought in external security researchers to help validate the vo]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Vulnerability Research]]></category>
    </item>
    <item>
      <title><![CDATA[Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught]]></title>
      <link>https://projectdiscovery.io/blog/inside-the-benchmark-pp-architectures-finding-walkthroughs-and-what-each-scanner-actually-caught</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/inside-the-benchmark-pp-architectures-finding-walkthroughs-and-what-each-scanner-actually-caught</guid>
      <pubDate>Wed, 11 Mar 2026 16:59:28 GMT</pubDate>
      <description><![CDATA[This is Part 2 of our vibe coding security benchmark study. In Part 1, we compared how LLM-based security tools like ProjectDiscovery's Neo and Claude Code performed against traditional SAST and DAST scanners on AI-generated code. We found that LLM-based tools like Neo and Claude Code detected many high-value findings that traditional scanners missed. Between Neo and Claude Code, Neo produced more true positives and fewer false positives because it could validate hypotheses against a running app]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Vulnerability Research]]></category>
    </item>
    <item>
      <title><![CDATA[How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code]]></title>
      <link>https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code</guid>
      <pubDate>Tue, 03 Mar 2026 17:05:32 GMT</pubDate>
      <description><![CDATA[Executive Summary

Neo found a Server-Side Request Forgery (SSRF) vulnerability in Faraday, a widely used HTTP client library in the Ruby ecosystem. This is Neo’s first credited CVE discovery.

Neo is ProjectDiscovery’s AI security copilot for tasks like code review and vulnerability discovery. For this finding, Neo reviewed a widely used open source dependency and, without human guidance, surfaced a subtle URL-handling edge case, validated it in runtime, and produced a clear write-up that maint]]></description>
      <category><![CDATA[Vulnerability Research]]></category>
      <category><![CDATA[Neo]]></category>
    </item>
    <item>
      <title><![CDATA[AI code review has come a long way, but it can’t catch everything]]></title>
      <link>https://projectdiscovery.io/blog/ai-code-review-vs-neo</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/ai-code-review-vs-neo</guid>
      <pubDate>Thu, 26 Feb 2026 22:23:42 GMT</pubDate>
      <description><![CDATA[AI code review can reason about intent, but real incidents often stem from business logic flaws that only show up in runtime. Our benchmark reveals where code-only review falls short.]]></description>
      <category><![CDATA[Neo]]></category>
      <category><![CDATA[Vulnerability Research]]></category>
    </item>
    <item>
      <title><![CDATA[Announcing the ProjectDiscovery OSS Bounty Program]]></title>
      <link>https://projectdiscovery.io/blog/announcing-the-projectdiscovery-oss-bounty-program</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/announcing-the-projectdiscovery-oss-bounty-program</guid>
      <pubDate>Mon, 02 Feb 2026 14:17:38 GMT</pubDate>
      <description><![CDATA[Democratizing Security, One Contribution at a Time

Today, we're excited to announce the launch of the ProjectDiscovery OSS Bounty Program, a new initiative to reward meaningful contributions to our open-source security tools.


The Vision

At ProjectDiscovery, we've always believed that security should be accessible to everyone. Our tools are used by researchers, defenders, and builders worldwide. From Fortune 500 security teams to independent bug bounty hunters, from government agencies to ope]]></description>
      <category><![CDATA[#announcement]]></category>
      <category><![CDATA[Community]]></category>
      <category><![CDATA[Bug Bounty]]></category>
      <category><![CDATA[#opensource]]></category>
    </item>
    <item>
      <title><![CDATA[New Report: State of AppSec 2026 | Security at Engineering Speed]]></title>
      <link>https://projectdiscovery.io/blog/new-report-state-of-appsec-2026-security-at-engineering-speed</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/new-report-state-of-appsec-2026-security-at-engineering-speed</guid>
      <pubDate>Wed, 28 Jan 2026 00:46:03 GMT</pubDate>
      <description><![CDATA[In 2026, most organizations aren’t shipping “applications” so much as they’re shipping continuous change; across APIs and services, infrastructure and configuration, identity and permissions, feature flags, and AI-assisted code.]]></description>
      <category><![CDATA[Application Security]]></category>
    </item>
    <item>
      <title><![CDATA[Surfacing the real attack surface: Advances in asset discovery]]></title>
      <link>https://projectdiscovery.io/blog/surfacing-the-real-attack-surface-advances-in-asset-discovery</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/surfacing-the-real-attack-surface-advances-in-asset-discovery</guid>
      <pubDate>Thu, 15 Jan 2026 13:01:42 GMT</pubDate>
      <description><![CDATA[Introduction

Accurate external asset discovery remains a moving target for security teams at scale. What’s actually exposed is hard to pin down, regardless of how many inventories or spreadsheets an organization maintains. Release cycles move faster, new domains and endpoints are added constantly, and the attack surface continues to shift, leaving static processes and visibility tools struggling to keep up.

Traditional discovery tools are effective at identifying well-known or easily indexed a]]></description>
      <category><![CDATA[Attack Surface Management]]></category>
    </item>
    <item>
      <title><![CDATA[Year in Review: The Vulnerabilities That Defined 2025]]></title>
      <link>https://projectdiscovery.io/blog/year-in-review-the-vulnerabilities-that-defined-2025</link>
      <guid isPermaLink="true">https://projectdiscovery.io/blog/year-in-review-the-vulnerabilities-that-defined-2025</guid>
      <pubDate>Thu, 18 Dec 2025 21:29:01 GMT</pubDate>
      <description><![CDATA[A Year of Real-World Exploitation

If you work in security, you probably remember React2Shell. Shortly after public disclosure, scanning activity increased, and exploitation attempts began to surface.

That sequence showed up repeatedly across several of 2025’s most impactful vulnerabilities. Advisories were still circulating while attackers were already testing and operationalizing exploits.

This wasn’t true for the thousands of CVEs published quietly throughout the year. But for a smaller set]]></description>
      
    </item>
  </channel>
</rss>