Tag
Peter Szilagyi reports that Fable introduced a regression into a cryptographic library, which his fuzzer detected, and Fable refused to patch the security issue.
NeuronFuzz is a white-box fuzzing framework that uses internal safety neurons as continuous feedback for evaluating LLM safety against jailbreak attacks, demonstrating high discovery rates across multiple models.
The article explores fuzzing techniques, including LLM-based and structure-aware fuzzing, to find bugs in the Gleam compiler, which compiles to both JavaScript and Erlang with static types.
This paper presents UniHall, a fine-grained hallucination benchmark with a unified taxonomy, and Self-Adaptive Multimodal Fuzzing (SAMF), a self-evolving stress-testing framework for multimodal LLMs. Experiments show SOTA models degrade significantly under fuzzing and reveal a helpfulness-hallucination trade-off.
This article describes using fuzzing to discover an unauthenticated denial-of-service vulnerability in snac2's JSON parser, allowing remote crashes via crafted inputs.
Alex Gaynor argues that the AI-driven 'vulnpocalypse' makes traditional bug-by-bug fixing untenable and calls for systemic security fixes, such as rewriting components in memory-safe languages.
Antithesis describes its custom deterministic hypervisor and subtree deduplication technique for efficient, repeatable whole-system fuzz testing at cloud scale.
This paper presents the first cross-platform reverse engineering and protocol-aware fuzzing study of Apple AirDrop and Android Quick Share, uncovering six vulnerabilities in these widely used proximity transfer protocols.
The author revisits the autofz meta-fuzzer, arguing that its control-plane orchestration approach (managing multiple imperfect workers) is increasingly relevant in the LLM era for security automation, even as the specific fuzzing techniques evolve.
This post describes using Windows PE as a lightweight, stateless testing harness for Windows kernel driver testing and fuzzing, with optimizations for CI/CD pipelines.
Reify is an open-source random C program generator based on semantic reification that produces undefined-behavior-free code for compiler testing. It has already uncovered 59 bugs in GCC and LLVM, plus additional bugs in OpenJ9 and Linux's eBPF runtime.
A security researcher discovered CVE-2026-46529, a 10-year-old remote code execution vulnerability in Linux PDF viewers XReader, Evince, and Atril, caused by insufficient argument quoting when spawning child processes to open remote document links.
A technical blog post describing the author's minimal property-based testing library implemented in ~256 lines of Zig, featuring a Finite Random Number Generator for reproducible test case generation and algorithmic verification.