FedTrust-CVDv2 ties vulnerability evidence to approved disclosure actions
Original title: PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority
A reference implementation accepted all 25 valid fixtures and rejected all 650 invalid fixtures.
The paper presents FedTrust-CVDv2, a federated coordinated vulnerability disclosure framework separating evidence validation, coordination, human governance, and permissioned auditing. Signed observations are bound to exact evidence revisions, and external actions are limited by approved payloads, audiences, expiry, policy, and revocation while existing CNA roles remain. Six single-safeguard ablations admitted 25 to 75 invalid fixtures across 27 policy families. A PHP2Shell case formulation shows how runtime evidence, patch state, and emergency coordination can be represented without treating audit integrity as proof.
Unconfirmed: The PHP2Shell formulation is illustrative and does not establish that an AI-discovered vulnerability claim is true.
- Supporting tests covered signed messaging, authenticated encryption, and audit certificates.
- Finite quorum-set conditions were also exercised.
- This short version omits the full implementation and extended experiments.
- An expanded version is planned for journal submission.
From the original article
1 min read at arxiv.orgAI-assisted vulnerability discovery can produce technically plausible findings faster than maintainers can validate, coordinate, and safely disclose them. The resulting challenge is not only to establish whether a vulnerability claim is credible, but also to ensure that its supporting evidence, human authorization, intended recipients, and applicable policy remain bound to the same case revision.
By Toqeer Ali Syed · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.