PhiNode Labs Talk to us

Cybersecurity consulting and research technology

Hard security problems.
Clear answers.

PhiNode Labs brings the expertise to help resolve almost any bottleneck in your cybersecurity processes — from a difficult application flaw to AI agent risks and the redesign of an enterprise security program.

Work with our team or equip yours with PAVE, our collaborative security research platform.

Discuss an engagement → Explore PAVE ↓

PAVE · our public bug bounty findings

The body count.

689critical & high findings
40targets researched
12technologies & languages
6published CVEs

October 2026 · View findings →

selected discoveries

Findings the frontier models missed.

PAVE’s discovery record includes findings missed by frontier AI models. Below are selected public records from our research.

FreeRDP — memory corruption after earlier fixes.

A missing bounds check left another attack path exposed. Fixed in version 3.23.0.

Fixed · Maintainer advisory Read the advisory ↗
nginx — forged TLS sessions, credited by F5.

An uninitialised ticket-rotation key let a remote attacker forge client TLS sessions and bypass client-certificate checks. Fixed in 1.31.7 and 1.30.6.

Published · CVE-2026-97629 Read the CVE record ↗
GPTCache — unsafe model loading.

Our report describes a remote code-execution path through an unvalidated model name.

Disclosed · Research report Read the report ↗
View all findings →

services

Bring us the bottleneck.

From a focused investigation to a change across the enterprise, we work with your team to solve the problem.

Red teamingTest the paths an attacker could take to your critical systems.Explore red teaming →
Application securityFind vulnerabilities and strengthen how software is designed and built.Explore application security →
Attack surface monitoringTrack your network perimeter and investigate changes in exposure.Explore attack surface monitoring →
Zero-day researchInvestigate complex targets and uncover unknown vulnerabilities.Explore zero-day research →
Enterprise securityReshape security architecture, processes and priorities.Explore enterprise security →
AI agent securitySecure the agents you build and adopt, and the systems they can reach.Explore AI agent security →

product · program analysis and verification engine

PAVE. We model. We prove.

PAVE — our Program Analysis and Verification Engine — builds semantic models of software and proves hundreds of theorems during vulnerability analysis. Its mathematical engine makes the underlying analysis repeatable while reducing LLM token consumption and cost.

The LLM is the interface and amplifier of your expertise. A shared workspace lets your team investigate together, review findings and resume work without losing context.

Request a demo →

How an audit runs · 01 / 05

01 · Human

Lock the context.

Language, framework, scope and reviewer are fixed before any work starts. If they are missing, the engagement becomes a conversation, not a scan.

02 · Engine

Model the software.

PAVE builds a semantic model of the code — entry points, trust boundaries, invariants and state machines — and reasons over it with repeatable results.

03 · Engine

Find and validate.

Candidates from review, formal analysis and tooling are verified one by one. Tool output is an agenda, not a finding; nothing is reported until it holds.

04 · Engine

Prove and reproduce.

Fuzzing and proof-of-concept reproduce what can be reproduced. Every claim is labelled — source fact, inference, analysis result, runtime proof or proof gap.

05 · Human

A person closes the audit.

Your reviewer reads the evidence and sets the disposition. The agent cannot mark an audit complete.

In detail · the nine phases on one line

AUDIT OPENED 0Context Locklanguage, framework,target class scope, owner,reviewer set?[confirmed]Confirm the terms[not confirmed] · a question, not a scan 1Reconnaissanceentry points, APIs,handlers, CVEs 2Deep Reviewauth, validation,encoding, design 3Formal Analysisinvariants, statemachines, trust 4Toolkit Scanlanguage-specificstatic tooling 5Finding Validationverify each candidate,one by one does thecandidate hold?[holds][no] discard, with the reason on record 6Variant Analysisfindings and CVEsas seeds 7Fuzzing & PoCreproduce what canbe reproduced 8Reportingfindings, disclosure,lessons Review the evidencea person sets the disposition evidenceaccepted?[accepted][needs work] · back to validation Audit completeonly a person can mark it AUDIT OPENED 0Context Locklanguage, framework, target class scope, owner,reviewer set?Confirm the terms[not confirmed][confirmed] 1Reconnaissanceentry points, APIs, handlers, CVEs 2Deep Reviewauth, validation, encoding, design 3Formal Analysisinvariants, state machines, trust 4Toolkit Scanlanguage-specific static tooling 5Finding Validationverify each candidate, one by one does thecandidate hold?[no] discard, reason on record[holds] 6Variant Analysisfindings and CVEs as seeds 7Fuzzing & PoCreproduce what can be reproduced 8Reportingfindings, disclosure, lessons Review the evidencea person sets the disposition evidenceaccepted?[needs work] · back to validation[accepted] Audit completeonly a person can mark it

ai agent security

New agents. New attack paths.

AI is changing both vulnerability discovery and the systems we need to defend. Agents bring tool access, delegated permissions and new supply-chain connections. Prompt injection or a compromised integration can turn those capabilities against you.

We assess how agents can be influenced, what they can access and which actions they can take.

Discuss with us →

contact

Bring us your security problem.

We’ll solve it.

Talk to us →

Business: hello@phinode.io · Vulnerability reports: responsible disclosure, in the footer.