Top all-time · #9310
ZeroPath Blog
Company blog · zeropath.com/blogsecurityai
ZeroPath Blog is the company blog at zeropath.com, writing about security and ai. Since 2025, 8 different Hacker News readers have linked it 13 times, most often “Next.js Middleware Exploit: Deep Dive into CVE-2025-29927 Authorization Bypass”. It is still writing: the last post was on 2026-10-21, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link ZeroPath posts on recent AI model progress, AI-assisted bug finding in curl, and a Next.js middleware CVE. The comments only link or cite these posts and do not judge the writing.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
AI-native SAST that finds 2x more vulnerabilities with 75% fewer false positives. Automated security for modern DevOps teams.
Most-linked posts?
- Next.js Middleware Exploit: Deep Dive into CVE-2025-29927 Authorization Bypass2 people · 2 mentions · first linked 2025-03-22
What Hacker News says?
Original post here: https://zeropath.com/blog/on-recent-ai-model-progress
Comment linking /blog/on-recent-ai-model-progress
on “Recent AI model progress feels mostly like bullshit”Submitted AI Autonomously Finds 7 FFmpeg Vulnerabilities as a story · 11 points
HN discussionHi, I'm Etienne, one of the cofounders @ ZeroPath. We do not use traditional static analyzers; our engine was built from the ground up to use LLMs as a primitive. The issues ZeroPath identified in Joshua's post were indeed surfaced and triaged by AI. If you're interested in how it works under the hood, some of the techniques are outlined here: https://zeropath.com/blog/how-zeropath-works
Comment linking /blog/how-zeropath-works
on “Potential issues in curl found using AI assisted tools”Submitted Better-auth account takeover (CVE-2025-61928) found via ZeroPath as a story · 9 points
HN discussionI found a different article that goes into more detail: https://zeropath.com/blog/nextjs-middleware-cve-2025-29927-a... This looks trivially easy to bypass. More generally, the entire concept of using middleware which communicates using the same mechanism that is also used for untrusted user input seems pretty wild to me. It divorces the place you need to write code for user request validation (as soon as the user r…
Comment linking /blog/nextjs-middleware-cve-2025-29927-auth-bypass
on “Next.js version 15.2.3 has been released to address a security vulnerability”Submitted Two 10.0 severity Spinnaker vulns give attackers RCE and production access as a story · 3 points
HN discussionSubmitted Next.js Middleware Exploit: Deep Dive into CVE-2025-29927 Authorization Bypass as a story · 3 points
HN discussionSubmitted How good is Opus 4.6 at vuln detection? as a story · 2 points
HN discussionSubmitted Free Exploit Development CTFs and Walkthroughs Based on Real CVEs as a story · 2 points
HN discussionSubmitted Windows SPNEGO Nightmare: Critical RCE Vulnerability as a story · 2 points
HN discussionSubmitted CVE-2026-42167: SQLi and possible auth bypass or RCE in ProFTPD as a story · 1 points
HN discussionSubmitted Unpatched vuln in RAGFlow allows for post-auth RCE as a story · 1 points
HN discussionSubmitted Malicious Websites Can Exploit OpenClaw to Steal Credentials as a story · 1 points
HN discussion