appsec.fyi — Fuzzing

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

Fri, 03 Jul 2026 20:50:14 +0000

Library of seven vulnerabilities in FatFs, including CVE-2026-6682, enabling memory corruption and code execution on embedded devices like cameras and crypto wallets. These flaws, rated Medium to High by runZero, stem from mishandling malformed data in FAT and exFAT volumes. Exploits are publicly available, and while one GPT hang bug has an upstream fix, others require downstream vendor patching.

GPT-5.5-Cyber built a zlib fuzzing lab in a day

Fri, 03 Jul 2026 06:00:14 +0000

Tool that demonstrates GPT-5.5-Cyber's capability to autonomously construct a zlib fuzzing lab within a single day, including writing harnesses for multiple entrypoints like inflate and uncompress2, leveraging ASan/UBSan builds, and repurposing edge-case tests for seeds, surpassing typical OSS-Fuzz coverage by targeting valid states and using OS backpressure.

Introducing Aardvark: OpenAIs agentic security researcher

Tue, 30 Jun 2026 21:45:42 +0000

OpenAI has introduced Aardvark, an agentic security researcher. This AI-powered tool is designed to assist in identifying and analyzing security vulnerabilities. While the provided text mentions its introduction, it does not specify any bug bounty payout amounts related to Aardvark's findings or operation.

Multiple AirDrop and Quick Share Vulnerabilities Allow Attackers to Crash Devices

Tue, 30 Jun 2026 20:45:42 +0000

Multiple vulnerabilities have been discovered in Apple's AirDrop and Google's Quick Share features, both of which facilitate device-to-device file sharing. These security flaws enable attackers to remotely crash nearby devices by sending malformed packets. This exploit could disrupt users' ability to use their devices and potentially lead to denial-of-service scenarios. The article does not mention any bug bounty payout amounts.

WinPE as a stateless harness for Windows driver testing and fuzzing

Mon, 29 Jun 2026 06:15:18 +0000

Library for transforming Windows PE into an idempotent testing environment. This library details low-level mechanisms including BCD and QEMU modifications for faster VM spins, enabling kernel-mode driver testing and fuzzing. It covers aggressive boot optimizations with `bcdedit`, disabling VBS/HVCI via `hypervisorlaunchtype off` and `testsigning yes`, utilizing the older `pc` QEMU machine profile for stability, configuring KDNET with `busparams`, and customizing the boot process by disabling NDIS initialization and replacing `cmd.exe` with a custom test agent in `winpeshl.ini`.

OpenAI deploys GPT-5.5-Cyber for open-source vulnerability fixes

Tue, 23 Jun 2026 13:10:10 +0000

OpenAI deploys GPT-5.5-Cyber for open-source vulnerability fixes https://ift.tt/TC32xeh

Extending developer security with dev-first dynamic testing

Tue, 16 Jun 2026 06:00:59 +0000

Library extending developer security, Snyk has acquired Probely, a provider of API Security Testing and Dynamic Application Security Testing (DAST). This acquisition integrates modern DAST capabilities, focusing on a developer-first approach with low false positive rates, simple implementation, and CI/CD pipeline integration, addressing the growing need for API security in the GenAI era and providing enhanced visibility into application risk.

AI Smart Contract Vulnerability Detection: Web3 Guide

Mon, 08 Jun 2026 08:25:18 +0000

Guide summarizing AI smart contract vulnerability detection, emphasizing a layered defense approach. It details how AI methods like deep learning on EVM bytecode, graph neural networks, and LLM auditing models complement traditional static analysis, fuzzing, and formal verification. The guide highlights tools such as Slither, Mythril, and Aderyn, and discusses the practical challenges and trade-offs of integrating AI into Web3 security workflows, noting that while AI improves recall, human review remains crucial for complex logic and access control bugs.

Continuous Offensive Security: The Line We've Been Walking

Mon, 08 Jun 2026 06:00:56 +0000

Library for continuous offensive security testing, this resource details the evolution from traditional Dynamic Security Testing (DAST) to AI-driven pentesting. It distinguishes between heuristic-detectable vulnerabilities (like SQL injection) and context-dependent ones (such as BOLA and IDOR) that require human-like reasoning. The library enables automated discovery of context-dependent flaws by analyzing intent, and includes Agent Red Teaming for novel AI-specific attack surfaces like prompt injection and data exfiltration in LLM-integrated applications.

Sparkplug B Protocol Fuzzing with AI Assistance

Mon, 08 Jun 2026 02:51:37 +0000

Tool for fuzzing the Sparkplug B protocol, an MQTT-based standard for industrial control systems. This fuzzer systematically targets message types, data types, and field paths, identifying crashes, protocol violations, and state-handling bugs. AI assistance refined the Python implementation, improving coverage, efficiency, and adding CLI functionality for security testing of ICS and SCADA devices.

Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529

Mon, 08 Jun 2026 02:51:25 +0000

Writeup details the exploitation of CVE-2024-54529, a type confusion vulnerability in macOS's CoreAudio framework. The author outlines the process of turning a crash into a working exploit, involving complex heap manipulation and control flow hijacking. This includes challenges with CFString objects and the development of custom tools like an object dumper utilizing Ivan Fratric’s TinyInst Hook API, alongside static analysis with IDAPython. The writeup also touches upon the failure of an out-of-bounds read approach due to object size constraints and the discovery of uninitialized memory in the `ngne` object using Guard Malloc with PreScribble.

On the Effectiveness of Mutational Grammar Fuzzing

Mon, 08 Jun 2026 02:51:25 +0000

Technique analyzing the flaws of mutational grammar fuzzing, particularly how increased coverage doesn't always equate to more bugs and how samples tend to remain highly similar. It highlights issues found in XSLT implementations and JIT engines, suggesting potential improvements by exploring dataflow coverage or combining generative and mutational fuzzing approaches.

Extending Ruzzy with LibAFL

Mon, 08 Jun 2026 02:51:18 +0000

Library for extending Ruzzy, a coverage-guided fuzzer for Ruby code, with LibAFL. This integration leverages LibAFL's LLVM compatibility layer and addresses challenges like ELF `.preinit_array` section restrictions by utilizing LLVM `ld`, and resolves "No maps available; cannot fuzz!" errors by ensuring proper SanitizerCoverage initialization timing, critical for fuzzing campaigns.

Go fuzzing was missing half the toolkit. We forked the toolchain to fix it.

Mon, 08 Jun 2026 02:51:17 +0000

Library, gosentry, is a fork of the Go toolchain that enhances native fuzzing capabilities. It integrates LibAFL, Nautilus for grammar-based fuzzing, and capabilities for structured inputs, integer overflow detection (building on go-panikint), goroutine leak detection (via goleak), data race detection, and timeout detection. Existing Go fuzz harnesses can be used with gosentry without modification, offering improved bug detection and coverage reporting for vulnerabilities like those found in Optimism and Revm.

Wireshark 4.6.6 Patches Critical ROHC and MACsec Vulnerabilities

Mon, 25 May 2026 19:45:32 +0000

Wireshark version 4.6.6 has been released, addressing critical vulnerabilities in the ROHC and MACsec protocols. These patches are essential for users to protect against potential security risks. The update is now available, and users are strongly encouraged to upgrade to the latest version to ensure their systems are secure.

Autonomous fuzzing process under LLM supervision

Fri, 22 May 2026 19:45:15 +0000

Library for autonomous fuzzing, codenamed fuzzlab, utilizes Large Language Models (LLMs) under strict procedural guidance to automate software security testing. This Python-based system analyzes code, generates test programs, classifies findings, and prepares reports. It has successfully identified vulnerabilities in ModSecurity and Oracle VirtualBox, demonstrating its capability to supervise fuzzing campaigns, adapt to anomalies, and improve test generation without constant human intervention, supporting various AI models through a standardized interface.

Claude Mythos found decade-old Firefox bugs that years of fuzzing missed

Mon, 18 May 2026 09:25:36 +0000

Claude Mythos has discovered long-standing Firefox vulnerabilities, some dating back a decade, which eluded years of automated fuzzing. These critical bugs highlight limitations in current security testing methodologies and underscore the persistent challenges in identifying complex software flaws. The specific details of the bugs and their potential impact are not provided in this brief announcement.

Claude Mythos found decade-old Firefox bugs that years of fuzzing missed

Fri, 15 May 2026 19:15:28 +0000

Claude Mythos has discovered long-standing bugs in Firefox, some present for a decade, which eluded extensive fuzzing efforts. This highlights limitations in automated testing and the value of manual, in-depth security research. The specific number of bugs or their severity was not detailed in the provided content, nor was any bug bounty payout amount mentioned.

Stopping bugs before they ship: The shift to preventative security

Fri, 15 May 2026 13:55:45 +0000

The article discusses a crucial shift in cybersecurity: moving from reactive bug fixing to proactive, preventative security measures. This approach aims to identify and resolve vulnerabilities earlier in the development lifecycle, before software is released to the public. The goal is to minimize the risk of security breaches and their associated costs, ultimately leading to more secure products and services. The emphasis is on integrating security practices throughout the entire development process, rather than treating it as an afterthought.

Mozilla Uses AI to Help Discover a Security Vulnerability in Firefox 271

Sun, 10 May 2026 23:20:24 +0000

Mozilla successfully employed AI to identify a security vulnerability in Firefox 271. This marks a significant step in leveraging artificial intelligence for cybersecurity, enabling more proactive discovery of potential threats. The AI's ability to analyze complex code and identify weaknesses could revolutionize vulnerability assessment and software security. This development highlights the growing importance of AI in protecting digital infrastructure and user data.

Mozilla Uses Mythos to Find Hundreds of Flaws

Fri, 08 May 2026 18:10:47 +0000

Library using Anthropic's Claude Mythos Preview and custom orchestration identified 271 security bugs in Firefox, including a 15-year-old defect missed by fuzzers. This AI-assisted approach yielded high-signal findings with minimal false positives, suggesting maturing capabilities for vulnerability discovery. The findings raise considerations for disclosure processes and the dual-use potential of such powerful models.

Mozilla explains the system that discovered 271 vulnerabilities in Firefox using Claude Mythos Preview.

Fri, 08 May 2026 14:10:45 +0000

Library for AI-assisted vulnerability discovery, detailing Mozilla's system that leveraged Claude Mythos Preview to identify 271 vulnerabilities in Firefox. This system utilized an agent-based harness atop existing fuzzing infrastructure to pinpoint flaws in areas like JIT, WebAssembly GC, IndexedDB, and XSLT, including a 15-year-old bug in the `` element and persistent XSLT issues. The AI demonstrated a low false positive rate, with dual LLM verification bolstering developer confidence, and highlighted the effectiveness of existing anti-poisoning measures by identifying blocked AI attack attempts.

AI-based fuzzing targets open-source LLM vulnerabilities

Thu, 07 May 2026 10:25:21 +0000

Library that utilizes AI-enhanced fuzzing to discover vulnerabilities in open-source projects. This technique has already identified 26 new vulnerabilities, including a critical flaw in OpenSSL, by generating sophisticated and varied test inputs that explore new execution paths and uncover edge cases missed by traditional methods. The library aims to improve code coverage, increase efficiency, and automate vulnerability discovery, though users must be aware of potential drawbacks like false positives and the need for careful validation of AI-generated code.

Open-source Models Match Mythos in Bug Finding

Fri, 01 May 2026 16:10:48 +0000

Tooling enables open-source models to match Anthropic's Mythos in bug finding by creating orchestration pipelines that run multiple models in harness, providing defense in depth and covering individual model blind spots. This approach replicates Mythos's ability to find both shallow and complex vulnerabilities, offering a cost-effective alternative to proprietary models. Human experts are crucial for orchestrating these ensembles, triaging findings, and validating exploitability, ensuring improved security practices through AI-assisted testing and fuzzing pipelines.

Firefox using advanced AI to find fix browser security flaws

Wed, 29 Apr 2026 14:00:49 +0000

Firefox is employing advanced AI to proactively identify and address browser security vulnerabilities. This innovative approach aims to streamline the process of finding and patching flaws, enhancing user security. By leveraging AI, Firefox can potentially detect a wider range of issues more efficiently than traditional methods. The goal is to create a more secure browsing experience for all users by staying ahead of potential threats.

Claude Mythos discovered 271 vulnerabilities in Firefox

Fri, 24 Apr 2026 00:40:32 +0000

Security researcher Claude Mythos identified an extensive 271 vulnerabilities within the Firefox browser. The details of these discoveries were shared via a linked article, highlighting a significant security audit conducted by Mythos. No bug bounty payout amount was specified in the provided content.

Jazzer: Coverage-guided, in-process fuzzing for the JVM

Wed, 22 Apr 2026 12:52:14 +0000

Library for coverage-guided, in-process fuzzing of the JVM. Jazzer integrates with JUnit 5.9.0+ and supports Linux, macOS, and Windows platforms. It leverages libFuzzer's instrumentation for mutation-based input generation, allowing developers to write fuzz tests alongside unit tests. Jazzer can run in regression or fuzzing modes, identifying crashes and storing inputs for further analysis. It also includes built-in sanitizers to detect risky behaviors during fuzzing.

Fuzzing 100+ open source projects with OSS-Fuzz - lessons learned

Wed, 22 Apr 2026 12:52:13 +0000

Writeup detailing continuous fuzzing efforts on over 100 open-source projects via OSS-Fuzz. This initiative reported 2104 bugs, including 559 security-relevant issues, with 1330 fixed. Notable findings include CVE-2020-28362 in Go-ethereum and contributions to Sudoers and Pidgin, highlighting the impact of sustained vulnerability analysis on critical software components.

Large Language Model guided Protocol Fuzzing (NDSS)

Wed, 22 Apr 2026 12:52:12 +0000

Tool for LLM-guided protocol fuzzing, ChatAFL leverages pre-trained large language models to extract machine-readable protocol information from natural language specifications. This engine constructs grammars for message types and mutates or predicts message sequences, significantly enhancing state and code coverage compared to state-of-the-art fuzzers like AFLNet and NSFuzz. Experiments on ProFuzzbench demonstrated ChatAFL's effectiveness in discovering previously unknown vulnerabilities in real-world protocol implementations.

Detect Go's silent arithmetic bugs with go-panikint

Wed, 22 Apr 2026 12:52:11 +0000

Library for detecting silent integer arithmetic bugs in Go projects. go-panikint modifies the Go compiler to transform integer overflows and truncations into explicit panics, making them detectable by fuzzers. It successfully identified an integer overflow vulnerability in the Cosmos SDK's RPC pagination logic. The library includes mechanisms to filter intentional overflows via source location whitelisting or in-code comments.

Denial of Fuzzing: Rust in the Windows kernel

Wed, 22 Apr 2026 12:52:11 +0000

Library for fuzzing Windows kernel GDI components, utilizing WinAFL and WinAFL Pet for efficient testing. It details techniques for metafile fuzzing with Enhanced Metafile Format Plus (EMF+) and identifies a denial-of-fuzzing condition triggered by mutations. The library includes methodologies for memory dump analysis using Volatility and MemProcFS, and a client-server approach to capture and store mutated files for faster reproduction of kernel crashes.

Bringing Fuzz Testing to Kotlin with kotlinx.fuzz

Wed, 22 Apr 2026 12:52:09 +0000

Library for fuzz testing Kotlin applications. Developed by JetBrains Research, this fuzzer, named kotlinx.fuzz, leverages existing Java fuzzers like Jazzer to identify edge cases and uncover hidden vulnerabilities by automatically generating random or invalid inputs for target functions such as `Duration.parseIsoStringOrNull`. It simplifies the fuzzing process, offering improved configuration, execution, and result analysis for Kotlin projects.

Advanced binary fuzzing using AFL++-QEMU and libprotobuf

Wed, 22 Apr 2026 12:52:08 +0000

Tool for advanced binary-only fuzzing utilizing AFL++-QEMU, focusing on grammar-aware in-memory persistent fuzzing. This practical guide demonstrates step-by-step configuration, including instrumentation tuning for specific code paths and optimizing execution speed, using a case study of a weak X509 parser with a buffer overflow vulnerability in `parse_cert_buf`. It details corpus preparation with `afl-cmin` and `afl-tmin`, and explores AFL++-QEMU features like `AFL_CUSTOM_MUTATOR_LIBRARY` and persistent mode addresses for performance enhancements.

deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses

Wed, 22 Apr 2026 12:52:07 +0000

Tool integrating static analysis and LLM-guided fuzzing to detect memory safety vulnerabilities in Rust's unsafe code. deepSURF handles generics by substituting them with custom types and LLM-augmented harnesses for complex API interactions. Evaluation on 27 Rust crates revealed 20 known and 6 previously unknown memory safety bugs, surpassing state-of-the-art tools.

Fixing Security Vulnerabilities with AI in OSS-Fuzz

Wed, 22 Apr 2026 12:52:07 +0000

Library that customizes the AutoCodeRover LLM agent, named CodeRover-S, for autonomously fixing security vulnerabilities detected by OSS-Fuzz. This approach leverages exploit input from fuzzing campaigns to extract dynamic call graph information and augment vulnerability reports. CodeRover-S aims to improve patch generation success rates by incorporating type-based analysis at identified faulty program locations, focusing on dynamic attributes for patch correctness over static code similarity metrics.

A Survey of Network Protocol Fuzzing: Model, Techniques and Directions

Wed, 22 Apr 2026 12:52:06 +0000

Survey of network protocol fuzzing techniques; this paper systematically reviews advancements, proposes a unified process model, and discusses techniques for syntax acquisition, test case generation, execution, monitoring, and feedback utilization. It highlights challenges unique to network protocols, such as statefulness and structured input, and points to promising research directions, referencing vulnerabilities like Heartbleed (CVE-2014-0160) found in software like OpenSSL.

Anthropic AI Finds 271 Vulnerabilities in Firefox

Wed, 22 Apr 2026 10:10:22 +0000

Anthropic AI Finds 271 Vulnerabilities in Firefox https://ift.tt/61geSjc

Generative Fuzzer-Driven Vulnerability Detection in IoT Networks

Sun, 19 Apr 2026 02:22:08 +0000

Generative Fuzzer-Driven Vulnerability Detection in IoT Networks

Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs

Sun, 19 Apr 2026 02:22:08 +0000

Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs

Fuzz to the Future: Uncovering Occluded Future Vulnerabilities

Sun, 19 Apr 2026 02:22:07 +0000

Fuzz to the Future: Uncovering Occluded Future Vulnerabilities

EdgeFuzz: A Middleware-Based Security Testing Tool

Sun, 19 Apr 2026 02:22:06 +0000

EdgeFuzz: A Middleware-Based Security Testing Tool

Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery

Sun, 19 Apr 2026 02:22:05 +0000

Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery

Fuzzing | Testing Handbook - AppSec Guide

Thu, 16 Apr 2026 21:03:41 +0000

Handbook chapter detailing fuzzing as an essential dynamic testing method for uncovering security issues and bugs. It covers starting fuzzing projects quickly, delving into advanced techniques, and selecting appropriate fuzzers. The handbook explains how to write fuzzing harnesses, interpret their outputs, and apply them to real-world C/C++ projects, discussing both blackbox and feedback-driven graybox fuzzing approaches. It also explores mutation-based evolutionary fuzzing, the de facto algorithm, and defines key terminology such as SUT, fuzzer, harness, and corpus.

API Fuzzing for Security Testing: Complete Guide

Thu, 16 Apr 2026 21:03:40 +0000

Library for API fuzzing that automates vulnerability discovery by generating malformed, randomized, or boundary-case inputs to uncover weaknesses like injection attacks, authentication bypasses, and data exposure via error handling. It integrates into CI/CD pipelines, complementing static analysis and manual testing by detecting edge cases and logic flaws missed by traditional methods, significantly improving detection rates and reducing remediation costs.

Recent Fuzzing Papers Collection

Thu, 16 Apr 2026 21:03:39 +0000

Recent Fuzzing Papers Collection

Awesome-Fuzzing: Curated List of Fuzzing Resources

Thu, 16 Apr 2026 21:03:38 +0000

Library collecting curated resources for learning fuzzing and exploit development, including books like "Fuzzing: Brute Force Vulnerability Discovery," courses, videos, tutorials, and vulnerable applications. It lists tools such as American Fuzzy Lop (AFL), Peach Fuzzer, honggfuzz, and Cloudfuzzer, alongside discussions of techniques like directed fuzzing and root cause analysis for vulnerabilities like integer overflows. The library also features resources on browser fuzzing frameworks like BFuzz and Grizzly.

KernelGPT: Enhanced Kernel Fuzzing via LLMs

Thu, 16 Apr 2026 21:03:37 +0000

Library for enhanced Linux kernel fuzzing using Large Language Models to automate Syzkaller specification generation and refinement. KernelGPT analyzes kernel source code, leverages LLMs for specification creation, and uses feedback for iterative improvement. This approach has successfully identified 24 new kernel bugs, including 11 with assigned CVEs, and many of its generated specifications have been integrated into the official Syzkaller repository.

ksmbd: Fuzzing Improvements and Vulnerability Discovery

Thu, 16 Apr 2026 21:03:37 +0000

Library for improving fuzzing and discovering vulnerabilities in `ksmbd`, an SMB server implementation. This resource details techniques for expanding the attack surface by enabling configuration options like durable handles, oplocks, and SMB2 leases, and discusses fuzzer improvements. It specifically mentions patching NTLMv2 authentication, adjusting connection limits, and simulating valid SMB state transitions by parsing responses for TreeIDs and SessionIDs. The library also leverages protocol specifications to build grammars for commands like SMB2 IOCTL requests and explores fuzzing strategies such as focused area fuzzing to target specific code paths like `smb_check_perm_dacl`, which led to the discovery of integer overflows.

AFL++ Fuzzing in Depth

Thu, 16 Apr 2026 21:03:36 +0000

Library for instrumenting and fuzzing source code targets with AFL++. This guide details the three-step process: compiling with special compilers like `afl-clang-lto` or `afl-gcc-fast`, preparing an input corpus, and executing the fuzzing process. It also covers compiler selection based on available versions (LLVM 11+, GCC 5+) and instrumentation options such as `laf-intel`, `redqueen`, and selective instrumentation via `allowlist.txt` or `denylist.txt` to optimize fuzzing efficiency.

The Fuzzing Book: Generating Software Tests

Thu, 16 Apr 2026 21:03:35 +0000

Library of practical examples and executable code, "The Fuzzing Book" teaches automated software testing techniques. It covers random fuzzing, mutation-based fuzzing, and grammar-based test generation, illustrated with Python code. The resource is suitable for university courses, supplementary material, or as a developer tool, and has been credited with finding over 2,600 bugs in JavaScript interpreters for browsers like Firefox, Chrome, and Edge.