Research

Research

Experiments and findings from the Nullify team on triage, reachability and AI-driven exploitation.

Latest posts

A figure in a bowler hat stands at the entrance of a circular teal stone maze with light at its center, the Nullify illustration style

How We Had PHP2Shell Fixes Ready Before Our Customers Woke Up

October 22, 2026

PHP2Shell hit PHP servers overnight. We checked 3,700 repos past the lockfile and had fixes ready for 19 vulnerable images by morning.

Let the Cheap Model Look

Shantanu Kulkarni

August 21, 2026

Replacing a one-shot frontier model false-positive screen with a tool-using open-weight agent.

Reachability Triage That Scales Without Headcount

Reachability Triage That Scales Without Headcount

Every unverifiable reachability call has a bill attached, and someone always pays it. When a triage system asserts "this vulnerable function is reachable" with no evidence you can inspect, a human…

Trust Issues: Can We Actually Validate Automated Vulnerability Repair?

Omri Ram and Tim Thacker

You cannot tell an automated vulnerability repair worked unless you prove two things at once: the vulnerability is genuinely closed, and the program still works. Here is why the public AVR benchmarks cannot measure that, and how we built one that can.

Per-CVE Reachability: Doing the Triage Without the Headcount

Per-CVE Reachability: Doing the Triage Without the Headcount

Attackers have stopped needing headcount to scale capability. Cheap, capable open-weight models let a small crew generate, adapt, and fire exploits at a rate that used to require a team — so a…

Fixes You Can Prove: Exploit-Replay Verification for AI-Generated Autofix PRs

Fixes You Can Prove: Exploit-Replay Verification for AI-Generated Autofix PRs

Nullify exists to automate security work end to end — find, triage, plan, fix — and to do it with AI you can actually control and measure, so a team's security outcomes stop scaling with its…

The Cheapest Way to Hunt Authorization Bugs Now Costs $0.17. That's the Problem.

The Cheapest Way to Hunt Authorization Bugs Now Costs $0.17. That's the Problem.

Authorization flaws — IDOR, broken access control, tenant isolation gaps — used to be expensive to find at scale. They resist signature scanners because the bug isn't in the code shape; it's in the…

Hunting Authorization Bugs at Scale: Map the Model Before You Attack It

Hunting Authorization Bugs at Scale: Map the Model Before You Attack It

Ask a good pentester which class of vulnerability does the most damage, and the answer comes back with unsettling regularity: authorization bugs. Broken object-level authorization (BOLA), broken…

See Nullify fix your code, live

Bring a repository and a question. We'll show you what Nullify validates, what it dismisses and the fix it writes.

Book a live demo See pricing →