Project

Z3

Z3 is an open-source SMT solver from Microsoft Research used for automated theorem proving, program verification, and bug finding.

Known aliases

Z3 prover
Z3 SMT solver
Z3 solver
Z3 theorem prover

Current stories

security4 publishersConfirmed

China-based actor targets U.S. Rejetto HFS servers through a forgeable admin cookie

VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.

Publishers:dev.tosecurityaffairs.comsecurityweek.comthehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 43%
Operator: Operator 47%
Investor: Investor 10%

Reality

Evidence62
Adoption: Insufficient
Hype gap+30
Incentives50
Confidence60

build1 publisherOne report

A Z3 solver found an AWS deny policy covered four of nine compute-launch privesc paths

Bala Paranj ran a 2022 AWS privilege-escalation case through a Z3 solver and found its six-action deny policy blocked four of nine compute-launch vectors. Expanding the list to all nine leaves a residual, because each new compute service AWS ships opens a fresh bypass path.

Publishers:dev.to

Reality

Evidence55
Adoption: Insufficient
Hype gap+35
Incentives: Insufficient
Confidence50

build1 publisherOne report

A starts-with key condition lets one signed S3 upload write anywhere under the prefix

Four HackerOne reports cited in a dev.to analysis trace to S3 write scope set wider than the one object an upload needs. Only one of them is the starts-with key condition that turns a signed upload form into write access across a whole prefix.

Publishers:dev.to

Reality

Evidence45
Adoption: Insufficient
Hype gap+25
Incentives35
Confidence55

build1 publisherOne report

A week to prove zlib: verification starts looking like a line item, not a luxury

An interview with Lean's founder says an AI translated C zlib into Lean and proved compress-then-decompress round-trips in about a week. The remaining work is optimization without breaking the proof.

Publishers:dev.to

Reality

Evidence25
Adoption35
Hype gap+40
Incentives65
Confidence30

build1 publisherOne report

Scoping iam:AttachUserPolicy to the caller's own ARN hands out AdministratorAccess

A policy that lets users read and manage their own IAM profile usually carries iam:AttachUserPolicy scoped to ${aws:username}. That scope is enough to attach AdministratorAccess to yourself in a single call.

Publishers:dev.to

Reality

Evidence66
Adoption: Insufficient
Hype gap+20
Incentives70
Confidence56

build1 publisherOne report

Seven calls to a secret, with zero Secrets Manager permissions on paper

A CloudGoat walkthrough moves an API key through SNS into API Gateway and back out of Lambda. Access Analyzer and PMapper both report the user has no access.

Publishers:dev.to

Reality

Evidence52
Adoption: Insufficient
Hype gap+34
Incentives72
Confidence46