Talk to us

Security advisories

Vulnerability disclosures and security fixes for Helm products.

Talk to us

How we disclose security issues

Helm publishes security advisories to communicate information about vulnerabilities and security fixes affecting Helm products and services, formerly sold as BullWall. Each advisory provides details on the issue, affected versions, severity, and recommended remediation steps. Customers should review advisories to determine applicability to their environment and take appropriate action. 

Report a vulnerability

If you believe you have discovered a security vulnerability in a Helm product, please report it responsibly by contacting security@helmsecurity.ai. 

Published advisories

BWD-2026-001: Encrypting a file while leaving the first four bytes unaltered bypasses detection.

Encrypting a file while leaving the first four bytes unaltered bypasses detection.

Published: January 15, 2026 • Last Updated: January 15, 2026

BWD-2026-002: Excluded paths (e.g. $RECYCLE.BIN) allow detection bypass by renaming a directory.

Excluded paths (e.g. $RECYCLE.BIN) allow detection bypass by renaming a directory.

Published: January 15, 2026 • Last Updated: January 15, 2026

BWD-2026-003: Single-file encryption may not trigger detection due to reliance on modification thresholds.

Single-file encryption may not trigger detection due to reliance on modification thresholds.

Published: January 15, 2026 • Last Updated: January 15, 2026

BWD-2026-004: Delay before MFA enforcement on RDP connections.

Delay before MFA enforcement on RDP connections.

Published: January 15, 2026 • Last Updated: January 15, 2026

BWD-2026-005: SIP initializes after login services, allowing post-boot login before MFA enforcement.

SIP initializes after login services, allowing post-boot login before MFA enforcement.

Published: January 15, 2026 • Last Updated: January 15, 2026