Metis fuzzing discovers 137 bugs in UEFI edk2 bootloader protocols
Metis rehosts edk2 protocols as user-space applications and achieves 73.1 percent coverage, 1.7 times higher than FuzzUEr, reporting 26 previously unknown bugs to vendors.
Stories per day · 30 days
Relatedappsec3bright-security3harness2memory-safety2open-source2star-fuzzer2arxiv1bigsleep1bootloader1differential-testing1edk21evaluation1ev-charging1evse1firmware1fuzzilli1hardware1javascript1
19 stories, newest first · one card per story
Stories tagged #fuzzing
GI-RTL-Fuzz finds inconsistencies in major Verilog simulators
Grammar-guided LLM generation and differential testing exposed previously unknown linting and simulation mismatches.
Project Zero: BigSleep beat Fuzzilli on V8 bugs, overlap partial
In six months BigSleep reported 45 V8 vulnerabilities to Fuzzilli's 37, and experiments put theoretical overlap near 60%.
Bright Security launches STAR Fuzzer for agentic application fuzzing
Bright says an open-source run found High or Critical issues in 45% of projects tested, with ten findings in eight projects.
EVSEFuzz auto-builds fuzzers for EV charging protocol implementations
Runs against open- and closed-source chargers found several flaws and led to two published CVEs.
RAISE paper ranks OSS-Fuzz project-days for extra fuzzing
A Random Forest reached ROC-AUC 0.74, and Simple-Regression used 91.60 extra sessions per detected vulnerability versus 171.89 for a median heuristic.
Bright Security launches STAR Fuzzer for agentic harness generation
The vendor says a first research run flagged High or Critical issues in 45% of projects tested.
3
Building Sound Evaluation Practices for Rust-Based Security Frameworks
Researchers propose a reproducible way to evaluate Rust fuzzers and test it on 20 projects.
ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary
ToFu fuzzing found verified semantic bugs in 343 LLM tools across 118 MCP servers.
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
GitHub Security Lab's Taskflow Agent autonomously fuzzes C/C++ repositories with AFL++ and writes vulnerability reports.
SoK: You Find What You Seek: Rethinking Oracles, Guidance, and Input Generation in Hardware Fuzzing
A survey of 52 hardware fuzzers says campaigns only find bugs they can reach, recognize, and prioritize.
Dynamic Conformance Testing of WebGPU Through Specification-Driven Mutation
Research paper introducing LANTERN, a dynamic conformance testing framework to uncover WebGPU browser bugs.
State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation
StateLens uses LLM-guided instrumentation to fuzz JavaScript engines and found 68 bugs.
AIJon: Automated Generation of Annotations for Fuzzing
AIJON uses LLMs to auto-generate IJON-style fuzzing annotations, matching human-expert quality on the Magma benchmark.
IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges
IntentFuzz protocol-aware fuzzer recovers bridge structure from unannotated Solidity and confirmed 22 invariant violations across 24 real-world deployments.
Testing race conditions with memory access tracing and stack-based delay injection
Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.
4
How well do agents use test/verification techniques?
Dan Luu's eval finds coding-agent testing instructions (TDD, formal methods, PBT, skills) mostly fail to beat defaults on Zstd implementation correctness.
When LLM Decompilers Recompile More and Preserve Less
Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.
Measuring the Checker: Mutation Analysis for GPU-Kernel Benchmark Oracles
Mutation analysis is introduced to evaluate GPU kernel benchmark oracles and detect faults in verified implementations.