ProjectDiscovery Stories

Announcing the ProjectDiscovery OSS Bounty Program

Democratizing Security, One Contribution at a Time Today, we're excited to announce the launch of the ProjectDiscovery OSS Bounty Program, a new initiative to reward meaningful contributions to our open-source security tools. The Vision At ProjectDiscovery, we've always believed that security should be accessible to everyone. Our tools are used by researchers, defenders, and builders worldwide. From Fortune 500 security teams to independent bug bounty hunters, from government agencies to ope

New Report: State of AppSec 2026 | Security at Engineering Speed

In 2026, most organizations aren’t shipping “applications” so much as they’re shipping continuous change; across APIs and services, infrastructure and configuration, identity and permissions, feature flags, and AI-assisted code.

Surfacing the real attack surface: Advances in asset discovery

Introduction Accurate external asset discovery remains a moving target for security teams at scale. What’s actually exposed is hard to pin down, regardless of how many inventories or spreadsheets an organization maintains. Release cycles move faster, new domains and endpoints are added constantly, and the attack surface continues to shift, leaving static processes and visibility tools struggling to keep up. Traditional discovery tools are effective at identifying well-known or easily indexed a

Year in Review: The Vulnerabilities That Defined 2025

A Year of Real-World Exploitation If you work in security, you probably remember React2Shell. Shortly after public disclosure, scanning activity increased, and exploitation attempts began to surface. That sequence showed up repeatedly across several of 2025’s most impactful vulnerabilities. Advisories were still circulating while attackers were already testing and operationalizing exploits. This wasn’t true for the thousands of CVEs published quietly throughout the year. But for a smaller set

Introducing Neo, an AI security engineer for complex security tasks

Neo is a cloud-based AI security engineer that works alongside your team and takes on real security tasks like a true co-engineer. As it operates, it continuously learns your systems and processes, improving over time just like an engineer ramping up on your team. Neo is built as a framework, not as a black box. It combines the reasoning of large language models with purpose-built execution tools, isolated sandboxes, a memory layer that learns your code, architecture and naming, and deep integr

Nuclei Templates - November 2025

Summary of Releases v10.3.2 & v10.3.4 This month, we had two releases of Nuclei Templates, introducing numerous improvements and new templates for Nuclei users. 🚀 November Stats Release New Templates Added CVEs Added First-time Contributors Bounties Awarded v10.3.2 129 56 9 7 v10.3.4 68 27 11 3 Total 197 83 20 10 Introduction November kept the momentum strong for Nuclei Templates with two new releases (v10.3.2 & v10.3.4). We added 197 new templates and coverage for

How to Research & Reverse Web Vulnerabilities 101

Introduction This blog serves as a detailed methodology guide for analyzing, reversing, and researching web vulnerabilities, particularly those with CVEs assigned. The content outlines repeatable processes used to evaluate vague advisories, analyze vulnerable software, and ultimately recreate or validate security flaws. The objective is to establish a structured, replicable approach to web vulnerability research. Environment & Tools When approaching a new target for CVE research or reverse-e

Introducing Credential Monitoring

Imagine discovering that your company's login credentials are sitting in plain sight on the internet, accessible to anyone who knows where to look. Unfortunately, this isn't hypothetical – it's happening right now to organizations worldwide through malware-stolen credentials. The Hidden Threat: Malware-Stolen Credentials Every day, cybercriminals deploy malicious software that quietly steals passwords from infected computers. These "stealer" programs harvest credentials from browsers and appl

Hacktober 2025 - Nuclei Templates

Summary of Releases v10.3.0 & v10.3.1 This month, we had two major releases of Nuclei Templates, introducing numerous improvements and new templates for Nuclei users. 🚀 Hacktober Stats Release New Templates Added CVEs Added First-time Contributors Bounties Awarded v10.3.0 124 90 6 12 v10.3.1 119 88 10 12 Total 243 178 16 24 Introduction October was huge for Nuclei Templates, two releases (v10.3.0 & v10.3.1) dropped during Hacktoberfest, adding coverage for 44 actively expl

Open by design, trusted by enterprises: how we keep Nuclei templates reliable at scale

At ProjectDiscovery, our greatest strength is our community. Thousands of security researchers, bug bounty hunters, and vulnerability analysts who identify zero‑day vulnerabilities, trending CVEs, and actively exploited vulnerabilities (including those listed in CISA KEV).

From Detection to Validation: Fixing Broken Vulnerability Workflows

By going beyond version checks, you’ll reduce noise, speed up critical fixes, and keep engineering smiling.

Remote Code Execution in DELMIA Apriso

Introduction DELMIA Apriso is a manufacturing execution and operations orchestration platform used by large manufacturers, service providers, and critical infrastructure operators. Because the product exposes multiple integration points (SOAP, file uploads, provisioning feeds) that are often reachable from internal networks, we performed a focused black-box assessment to surface integration and surface-area weaknesses. Our testing uncovered two chained, high-impact issues: an unauthenticated S