The Curious Engineer

All blogs / Security

depthfirst

depthfirst.com

AI agents that reason like an elite team of security researchers, continuously discovering and remediating risks across your code, dependencies, infrastructure, and production environment while preventing new risks from being introduced.

SecurityAI / ML

’25’26
Posts
79 from 29 Jan 2025 to 21 Oct 2026
Posting
weekly (55 in the last year)
Kind
company blog

2026 50

  1. Anatomy of Two Critical PHP Vulnerabilities: How They Work and How to Protect Your Systems | depthfirst
  2. Free software supply chain exposure assessment | depthfirst
  3. From JavaScript to Renderer Code Execution: Three V8 Vulnerabilities and Two v8CTF Flags | depthfirst
  4. From Shackles to Freedom: Why I Joined depthfirst | depthfirst
  5. Alignment, Reward Hacking, and Autonomous Cyberattacks | depthfirst
  6. Introducing Agentic Pentesting | depthfirst
  7. General AI vs. Security Focused Code Reviews | depthfirst
  8. Building a Faster, Cheaper Vulnerability Scanner With Jev | depthfirst
  9. How Agents Transform Reachability in the Software Supply Chain | depthfirst
  10. Containers Are No Longer a Security Boundary | depthfirst
  11. How Supabase scales security across its application development lifecycle with depthfirst | depthfirst
  12. How MoonPay Securely Ships New Products Faster With depthfirst | depthfirst
  13. How Listen Labs Builds Safely at the Frontier of Agentic Software Development | depthfirst
  14. Building the Means to Stay in Control | depthfirst
  15. Events Join us at conferences, webinars, and live security sessions
  16. Introducing Dependency Firewall with On-Device Protection | depthfirst
  17. How Chainguard Built Comprehensive Security Review Across Its Codebase and CI/CD Workflows | depthfirst
  18. Preventing Supply Chain Attacks While Agents Work | depthfirst
  19. Abliteration and the Risks Ahead | depthfirst
  20. How Thatch Stays at Zero Critical Vulnerabilities While AI Accelerates Software Development | depthfirst
  21. Bug Bounties Are Not Dead | depthfirst
  22. Reachable doesn’t mean exploitable | depthfirst
  23. Introducing dfbench v1: A cybersecurity benchmark for frontier models and agentic systems | depthfirst
  24. Product Release: Threat Model | depthfirst
  25. Introducing dfs-large1: A New Frontier for Cybersecurity | depthfirst
  26. Graduating from CyberGym Level 1 | depthfirst
  27. Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem | depthfirst
  28. Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities | depthfirst
  29. Product Release: Workflows | depthfirst
  30. 2026: The Year Cyberattacks Became Autonomous | depthfirst
  31. Almanax is joining depthfirst | depthfirst
  32. Why Defenders Can’t Bet on One Model | depthfirst
  33. Customer Referral Program Terms and Conditions | depthfirst
  34. 21 Zero-Days in FFmpeg | depthfirst
  35. Introducing Dependency Firewall | depthfirst
  36. GitLab Oj Spill
  37. NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability | depthfirst
  38. NGINX Rift
  39. Cybersecurity's ChatGPT Moment | depthfirst
  40. Securing the World’s Software in the Age of AI | depthfirst
  41. Training State of the Art Vulnerability Discovery Agents through Reinforcement Learning | depthfirst
  42. Applied AI Lab depthfirst Announces $80 Million in Series B Funding | depthfirst
  43. The Masked Namespace Vulnerability In Temporal CVE-2025-14986 | depthfirst
  44. How AngelList Built an AI-Native Security Program with depthfirst | depthfirst
  45. Why Moveworks Chose depthfirst to Secure Production | depthfirst
  46. How Persona Increased Code-Security Coverage by 2x with depthfirst | depthfirst
  47. 1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253) | depthfirst
  48. Terms of Service | depthfirst
  49. depthfirst Announces $40M Series A to Secure the World’s Software | depthfirst
  50. Product Release: Secrets | depthfirst

2025 9

  1. ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC | depthfirst
  2. Our Approach to Coordinated Vulnerability Disclosure | depthfirst
  3. Agent Capability Is a System Design Problem: Lessons From a 90% Improvement on CyberGym | depthfirst
  4. Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization | depthfirst
  5. Anatomy of an Automated Patch: Fixing a File Upload RCE CVE-2025-59304 | depthfirst
  6. Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419) | depthfirst
  7. How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Study | depthfirst
  8. Terms & Conditions | depthfirst
  9. Privacy Policy | depthfirst

Undated 20

  1. Get started
  2. Platform Your autonomous security command center
  3. Code Find vulnerabilities scanners were never built to see
  4. Supply chain Know what's reachable, not just what's present
  5. Secrets Stop leaks before they leave the repo
  6. Agentic Pentesting Find vulnerabilities in code that's already running
  7. Dependency Firewall Detect malicious behavior before it spreads through your environment
  8. About Learn how we help teams uncover threats before attackers do
  9. Partners Become a depthfirst Partner
  10. Blog Insights, research, and security trends from our team
  11. See all
  12. Customer stories
  13. Book a demo
  14. After Mythos — depthfirst event
  15. Open Defense Initiative | depthfirst
  16. Free PHP exposure scans and mitigation guidance | depthfirst
  17. Customer referral
  18. dfbench — depthfirst
  19. Financial Institutions | depthfirst
  20. Growth Startups | depthfirst