Skip to content

30 results for “Fuzzing”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types30Repos10Articles8Papers4Write-ups3Advisories1Courses1
Talks1Threads1Videos1
“Fuzzing”
github.comrepo🛡️ Security

SnailSploit/Claude-Red

claude-red is a library of offensive security skills for the Claude Skills system, each a SKILL.md file that loads on conversational triggers (for example, mentioning SQL injection loads offensive-sqli). Categories include web, Active Directory, cloud, mobile, exploit development, fuzzing, privilege escalation, post-exploitation and AI. It targets about 130 skills across 23+ categories, with an install script and sparse-checkout install per category. Built on Sahar Shlichov's offensive checklists, MIT licensed.

ClaudeClaude CodeActive Directory
Kai AizenSahar ShlichovSnailSploit

Offensive Security, AI Security· Added 22 Oct 2026

arxiv.orgpaper🛡️ Security

Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing

RAISE (Risk-Aware Intensive Supplemental Execution Framework) is a just-in-time framework that predicts which project-days introduce a vulnerability, to decide where to spend extra fuzzing. The dataset joins OSV vulnerability-introducing commits with OSS-Fuzz coverage data for 15 C/C++ projects (15,210 project-days, 347 positive). A Random Forest using VCCFinder static features plus fuzzing features reaches ROC-AUC 0.74. In a simulation over 968 vulnerabilities, Simple-Regression needed 91.60 extra fuzzing sessions per detected vulnerability, against 171.89 for the Median heuristic.

OSS-FuzzOSVC
RAISEVCCFinderPatchCoverage+1

AppSec· Added 22 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.

Model Context ProtocolAtherisCodeQL+7
ToFuStrandsMAF+10

mcp, research, agents· Added 18 Oct 2026

arxiv.orgpaper🛡️ Security

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework that derives semantic security checks for LLM tools (mainly MCP servers) from their metadata and a corpus of 74 CWE-guided sanitizers. It generates schema-valid Atheris harnesses, uses runtime tracers and outcome oracles to catch bugs that don't crash, and uses an LLM only to map sanitizers and seed inputs, never as the judge. It also describes a "Repeat-After-Me" attack, in which the LLM is told to repeat attacker-written text that the orchestrator then dispatches as a tool call. It was reproduced on LangGraph, MAF, ADK, AutoGen, Strands and CrewAI. On 273 MCP servers it reports 253 verified bugs across 343 tools in 118 repositories, including path traversal, log injection, exfiltration and command bypass.

Model Context ProtocolAtherisLangGraph+3
Repeat-After-Mepath traversalSSRF+6

AI Security, AppSec· Added 18 Oct 2026

ethereum-magicians.orgwriteup🛡️ Security

Bend-SSZ: Formally proving SSZ

A forum writeup describing bend-ssz, a formally verified implementation of Ethereum's SSZ serialization covering all 109 mainnet Fulu types plus 131 generic test forms, written in the proof-checking language Bend and proved equal to the consensus-specs reference instead of relying on test vectors. The post details how mutation testing, hand-written fault injection, and 2M+ hostile decode fuzzing found and closed gaps, including a 32-bit size-arithmetic wraparound and a decode memory-amplification DoS (up to 28x heap-per-byte blowup) that is mitigated with a proved, budgeted decode function; it also reports integrating the library into Prysm and cross-checking against Lighthouse on a live devnet with zero mismatches.

EthereumBendSSZ+3
Fuluconsensus-specsBeaconState+2

Blockchain, AppSec· Published and added 4 Oct 2026

arxiv.orgpaper🛡️ Security

SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)

This SoK paper empirically evaluates 24 published emulation-based dynamic analysis tools for ARM Cortex-M firmware re-hosting, using large-scale datasets from OTACAP and FirmLine totaling 4,571 deduplicated ARM firmware samples. It finds that only 34.5% of samples can be successfully fuzzed by any existing tool, with average code coverage of just 10% and frequent false crashes/hangs, exposing systemic gaps across the emulation, fuzzing, and bug-diagnosis pipeline stages.

ARM Cortex-M
OTACAPFirmLine

Hardware & RF· Added 2 Oct 2026, published 30 Sep 2026

github.comrepo🛡️ Security

FirmAgent: Fuzzing + LLM Agents for IoT Firmware Vulnerability Discovery (NDSS 2026)

FirmAgent is an academic research toolkit (NDSS 2026) for finding vulnerabilities in re-hosted IoT firmware web services by combining IDA-based pre-fuzzing (CFG/sink distance scoring), QEMU instrumented tracing, CFG-guided API fuzzing, and an optional LLM agent (LLMATaint.py) that consumes runtime taint traces to reason about and produce PoCs for bug classes like command injection. The pipeline is explicit about scope: it is meant for authorized, owned or re-hosted firmware (e.g. Greenhouse-style containers), and stitches together sink-scope extraction, feedback-driven fuzzing, and request-to-trace attribution before handing traces to an LLM for taint-to-PoC analysis.

QEMUDockerPython+1
command injection

Hardware & RF, AI Security, Offensive Security· Added 26 Sep 2026

ethereum-magicians.orgthread🛡️ Security

ERC-8427: Portable Spend Grants

ERC-8427 'Portable Spend Grants' is a draft Ethereum standard defining a signed SpendGrant object that lets a principal authorize a delegate (e.g. an AI agent or session key) to spend up to specified per-call, trailing-24h, and lifetime caps of named assets, to a restricted set of recipients, within a validity window — solving problems that plain ERC-20 approve and midnight-resetting daily caps don't. A non-custodial registry tracks remaining usage and revocation while an immutable executor contract must call consume() in the same transaction as any transfer, so unauthorized value movement is provably blocked; the reference implementation is deployed on Arc testnet with formal verification (Halmos) of expiry, cap, revocation and executor-binding invariants plus fuzzing of the rolling-window logic. The thread also discusses interplay with ERC-7710/7715 delegation/permission RPCs, ERC-8226's regulated grants, and ERC-8312's usage-tracking pattern, and solicits feedback on EIP-7702 signer/delegation ordering and executor-vs-delegate binding in consume().

EthereumSolidity
ERC-8427ERC-7528ERC-7710+6

Blockchain, Identity & Access· Added 29 Sep 2026, published 25 Sep 2026

github.comcourse🛡️ Security

antonio-morales/Fuzzing101

Fuzzing101 is a hands-on course/repo by antonio-morales with 10 exercises targeting real software projects to teach coverage-guided evolutionary fuzzing using AFL++ (a fork of lcamtuf's AFL). It covers core fuzzing concepts like seed mutation, coverage feedback, and crash triage, with exercises tested on Ubuntu 20.04 and a provided VM image, making it a practical on-ramp for finding real vulnerabilities via fuzzing.

AFL++Linux

Learning, Offensive Security· Added 22 Sep 2026

github.comrepo🛡️ Security

SnailSploit/Claude-Red

claude-red is a GitHub library of structured SKILL.md files for the Claude Skills system, each priming Claude with expert-level offensive-security methodology for a specific attack surface (SQL injection, shellcode, EDR evasion, ADCS abuse, wireless, IoT, cloud, mobile, fuzzing, etc.). Skills load on-demand from conversational triggers so context isn't spent on unused domains, and can be installed wholesale, per-category via sparse-checkout, or pasted directly into a system prompt. It's aimed at authorized red-team engagements, bug bounty triage, CTF prep, and operator training, building on Sahar Shlichov's offensive checklist collections.

ClaudeClaude CodeActive Directory
Kai AizenSnailSploitSahar Shlichov

Offensive Security, AI Security· Added 21 Sep 2026

copy.failadvisory🛡️ Security

Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by AI-assisted fuzzing

Copy Fail (CVE-2026-31431) is a 9-year-old Linux kernel logic bug in algif_aead, reachable via the AF_ALG crypto API and chained through splice() into a 4-byte page-cache write to achieve local root, affecting kernels built between 2017 and the fix. The site publishes a 732-byte stdlib-only Python PoC that roots multiple distributions unmodified, identifies the fixing mainline commit a664bf3d603d, and gives interim mitigation (disable algif_aead / seccomp-block AF_ALG for untrusted workloads). The bug was found by Xint Code's AI-assisted fuzzing against the Linux crypto/ subsystem in roughly an hour of scan time.

Linux kernelLinuxPython+1
CVE-2026-31431algif_aeadAF_ALG+1

Offensive Security, AI Security· Added 17 Sep 2026

github.comrepo🛡️ Security

bikini/exploitarium

Exploitarium is a consolidated GitHub archive of an independent researcher's proof-of-concept vulnerability writeups, merging over a dozen former standalone PoC repos into one. It covers diverse real-world targets including RustDesk session permission bugs, an OpenSSH agent lock provider bypass, a Redis VSET duplicate HNSW ID RCE, a QEMU CXL Type3 mailbox escape, Firefox native/backup NSS RCE PoCs, libssh2 CVE-2026-55200, Nextcloud federated share bearer token issues, and more. The author documents an AI-assisted fuzzing workflow (hand-typed PoCs, AI-drafted READMEs) and credits prior work on an objdump OOB write finding.

RustDeskOpenSSHRedis+3
CVE-2026-55200

Offensive Security· Published and added 7 Sep 2026

github.comrepo🛡️ Security

subScraper

subScraper is a self-contained, single-file (main.py) Python orchestrator that chains subdomain enumeration tools (Amass, Subfinder, Assetfinder, Findomain, Sublist3r) into httpx probing, screenshot capture, ffuf fuzzing, nuclei, and nikto scans, all driven from a live web UI with resumable job state, worker concurrency controls, and Docker packaging. It ships 34 custom nuclei templates for CVEs lacking official coverage and exposes a scoped, API-key-authenticated "bug bounty agent API" for programmatic recon and attack-surface queries against a target's scope.

NucleihttpxDocker+3
AssetfinderFindomainSublist3r+2

OSINT, Offensive Security· Published and added 27 Aug 2026

intigriti.comarticle🛡️ Security

Web Fuzzing for Hackers

A practical guide to web fuzzing for bug bounty hunters, covering wordlist selection (custom vs. SecLists-style generic lists), and tool-specific configuration for content discovery, subdomain/VHost enumeration, and parameter/header discovery using ffuf, Burp Suite Intruder, OWASP Amass, dnsx, Arjun, and Param Miner. It details concrete techniques such as subdomain permutation patterns, extension fuzzing for leftover files (.md, .env, .sql), dotfile/prefix patterns (/.FUZZ, /-FUZZ, /~FUZZ), IIS-specific extensions (.asmx, .ashx, .aspx.bak), and hidden-header fuzzing (X-Forwarded-For, X-Debug, X-HTTP-Method-Override) that can lead to SQLi, cache poisoning, or access-control bypass.

Burp SuiteIIS
SecListsAssetnote

AppSec, Offensive Security· Added 3 Sep 2026, published 21 Aug 2026

i.blackhat.comtalk🛡️ Security

Pedal to the Bare Metal (Black Hat USA 2026)

Black Hat USA 2026 slides from Tobias Scharnowski and Kristian Covic (fuzzware.io) walking through rehosting and fuzzing the bare-metal FreeRTOS firmware of the Tesla Universal Wall Connector (ARM Cortex-M4). They cover MMIO modeling (bitextract/constant models), scoping the fuzzer to the reachable UDS-over-CAN/ISOTP attack surface reachable from the charge-plug SWCAN line, seeding with a captured firmware-update UDS transaction (building on Synacktiv's Pwn2Own '25 charge-connector work), and triaging a FreeRTOS scheduler crash back to a signed integer/negative image-length bug in tesla_verify_sig causing an OOB stack write during firmware signature verification — enabling STM32 takeover, contactor/plug-release control, device bricking, and a path toward wormable, secure-boot-bypassing persistence.

Ghidra
Tobias ScharnowskiKristian Covicfuzzware.io+7

Hardware & RF, Malware & RE· Published and added 21 Aug 2026

github.comrepo🛡️ Security

Teycir/BurpAPISecuritySuite

BurpAPISecuritySuite is a Jython-based Burp Suite extension that consolidates API reconnaissance, intelligent fuzzing (108+ payloads across 15 attack types including BOLA, IDOR, JWT exploitation, GraphQL abuse, SSTI, and WAF bypass), and passive deep-logic checks (counterfactual differentials, sequence invariants, token lineage, cross-interface parity drift) into a single tool covering the OWASP API Top 10. It auto-captures and normalizes API traffic, exports attack campaigns to Burp Intruder/Turbo Intruder/Nuclei, and generates AI-ready bundles (ChatGPT/Claude/Ollama) for LLM-assisted triage, while orchestrating external tools like ApiHunter, Katana, httpx, FFUF, Kiterunner, sqlmap, and Dalfox for verification.

Burp SuiteNucleiGraphQL+3
IDORBOLA

AppSec, Offensive Security· Published and added 21 Aug 2026

github.comrepo🛡️ Security

Awesome Embedded & IoT Security

A curated GitHub list of embedded and IoT security resources maintained by Fraunhofer FKIE, covering firmware analysis frameworks (FACT, emba, Firmadyne, Binwalk, Ghidra, Radare2), hardware hacking tools (JTAGULATOR, Bus Pirate, ChipWhisperer, Proxmark3, HackRF), RF/wireless gear (RTL-SDR, LimeSDR, UberTooth), books, academic papers on firmware security and fuzzing, real-world case studies of device hacking (D-Link, Huawei, Xerox printers), and CTF challenges (Rhme, Microcorruption, IoTGoat). It serves as a comprehensive entry point for beginners and experts doing embedded/IoT security analysis and hardware pentesting.

GhidraRadare2Binwalk+1
MiraiOWASP Embedded Application Security ProjectOWASP Internet of Things Project

Hardware & RF, Learning· Published and added 31 Jul 2026

blog.trailofbits.comarticle🛡️ Security

Building secure Uniswap v4 hooks

Trail of Bits distills dozens of Uniswap v4 hook audit findings into seven recurring failure patterns — missing caller checks, unvalidated PoolKey trust, custom accounting leaks, wrong-hook timing bugs, permission-bit mismatches, callback-triggered denial of service, and cross-callback state changes. The post walks through real incidents (the ~$12M Cork exploit and $8.4M Bunni rounding bug) to show how these bugs bypass PoolManager's settlement invariant, and gives developers and auditors a concrete checklist plus fuzzing guidance (Echidna, Medusa) for securing hook contracts.

Uniswap v4SolidityEthereum+2
Cork exploitBunni exploitSorella Angstrom+1

AppSec· Added 3 Sep 2026, published 30 Jul 2026

wolfssl.comarticle🛡️ Security

wolfBoot 2.9.0

wolfSSL's release announcement for wolfBoot 2.9.0, an open-source secure bootloader for embedded systems, covering new hardware targets (STM32N6/U3/C5/G4/WBA, NXP LPC54S018M-EVK, Kinetis KL26, Xilinx Zynq-7000), new crypto features (RSA-PSS image signatures, hardware crypto-callback interface, multi-root-CA verification, pre-computed IDevID/DICE attestation), and continued security hardening from Fenrir fuzzing including bounded unauthenticated image sizes, memory-copy limits during updates, and fault-injection resistant integrity verification. It also adds an sbom Makefile target producing CycloneDX and SPDX output for CRA-readiness.

wolfBootwolfSSLwolfHSM+3
LMSXMSS

Hardware & RF· Published and added 25 Jul 2026

semgrep.devarticle🛡️ Security

AI code security harnesses compared

Semgrep's blog post compares open-source AI-driven code security "harnesses" that use LLMs to find vulnerabilities, grouping them into three categories: LLM-led exploit generation (fuzzing-like, crash-oracle driven), LLM-skill-boosting vulnerability research (e.g. Cloudflare's security-audit-skill, Trail of Bits' skills, CapitalOne's vulnhunter, Google's mantis), and SAST+LLM hybrids (raptor, deepsec, ai-deep-sast, Visa's VVAH). It breaks down each tool's design, star counts, licensing, and ideal use case, and discusses cross-cutting themes like adversarial validation, discovery/validation separation, and patch generation maturity.

SemgrepCodeQLClaude Code+5
tptacek

AI Security, AppSec· Added 3 Sep 2026, published 24 Jul 2026

socket.devarticle🛡️ Security

Socket: Node.js Eyes Public Disclosure for AI-Flooded Security Reports

Node.js is debating a TSC proposal from security maintainer Rafael Gonzaga to route most security reports into a public workflow, reserving private embargo handling for a narrower set of clearly severe cases. The push follows a sharp rise in AI/LLM-driven fuzzing and scanning submissions to HackerOne (65 reports in one month vs. a historical baseline, 252 over two years) that Gonzaga argues are reproducible by anyone and thus undermine confidentiality assumptions, while TSC member Joyee Cheung counters that public visibility just shifts the same review bottleneck from private triage to public PR handling.

Node.jsHackerOne
Rafael GonzagaJoyee CheungOpenJS CNA+3

GRC, AI Security· Published and added 8 Jul 2026

github.comrepo🛡️ Security

ZX41R/awesome-reverse-engineering-and-malware-analysis

A curated, upkept "awesome list" for reverse engineering and malware analysis that organizes hundreds of resources into guided learning tracks (Windows malware triage-to-config-extraction, Linux/ELF reversing, exploit development, firmware & embedded, mobile, anti-analysis) plus a full taxonomy covering foundations, RE tooling (IDA, Ghidra, Binary Ninja, radare2, x64dbg), malware analysis/unpacking/YARA/C2 tracking, fuzzing (AFL++, libFuzzer), firmware, mobile, OS internals, LOLBAS/GTFOBins living-off-the-land resources, DFIR, and threat intelligence. It also surfaces niche researcher communities like Kanxue, 52pojie, Tuts4You, the WASM Russian RE forum, 0x00sec, and back.engineering (VTIL/VMProtect devirtualization work), with every link manually vetted and dead links pruned.

GhidraIDAradare2+3
VMProtectVTILKanxue+3

Malware & RE, Offensive Security, Hardware & RF· Added 30 Sep 2026, published 6 Jul 2026

blog.trailofbits.comwriteup🛡️ Security

GPT-5.5-Cyber built a zlib fuzzing lab in a day

Trail of Bits' Patch the Planet initiative (a collaboration with OpenAI pairing engineers with 30+ open-source projects) had GPT-5.5-Cyber, driven through Codex's /goal command, autonomously build a full fuzzing lab against zlib in a single day. Without step-by-step guidance, the model wrote ASan/UBSan-instrumented harnesses across a dozen entrypoints (inflate, inflateBack, uncompress2, gzFile, MiniZip, puff, blast, infback9, gzjoin, gzappend), used compile-time variant builds to reach hidden code paths, repurposed edge-case tests as seed corpus, and applied strict reportability discipline to reject unreachable crashes while surfacing several findings now under coordinated disclosure. The report argues this collapses the expertise barrier that historically kept bespoke fuzzing campaigns out of reach for low-skill attackers while also acting as a major force multiplier for defenders/researchers.

zlibCodexOpenAI+1
Patch the PlanetGPT-5.5-Cyber

AI Security, Offensive Security, AppSec· Added 3 Sep 2026, published 2 Jul 2026

blog.trailofbits.comarticle🛡️ Security

Introducing Patch the Planet

Trail of Bits describes the first week of Patch the Planet, a partnership with OpenAI Daybreak pairing engineers and maintainers with frontier models like GPT-5.5-Cyber and Codex to find and fix bugs in open-source projects such as curl, aiohttp, RustCrypto, PyCA, python.org, PyPI, and Sigstore. It reports concrete outcomes: GPT-5.5-Cyber autonomously building a full fuzzing lab with OS-backpressure harnesses in under a day, Codex-driven CVE variant analysis and cross-library differential testing that found an AES-GCM issue in PyCA and X.509 discrepancies, 64 pull requests and 51 issues filed, and aiohttp maintainers fixing eight privately-reported bugs within hours. It closes with maintainer guidance on deduplication, false-positive filtering, and severity correction for the flood of AI-generated reports.

GPT-5.5OpenAI Codexcurl+3
Patch the PlanetTrail of BitsOpenAI Daybreak+4

AI Security, AppSec, DevSecOps· Added 3 Sep 2026, published 22 Jun 2026

github.comrepo🛡️ Security

tmylla/Awesome-LLM4Cybersecurity

Awesome-LLM4Cybersecurity is a GitHub-hosted, continuously updated literature review (861+ papers as of 2026) organized around three research questions: building domain-specific security LLMs, applying LLMs to cybersecurity tasks (threat intelligence, fuzzing, vulnerability detection, program repair, insecure code generation, LLM-assisted attack and defense), and future directions like security-focused LLM agents. It accompanies the paper "When LLMs Meet Cybersecurity: A Systematic Literature Review" (Zhang et al., Cybersecurity journal, 2025) and serves as an index for researchers tracking the intersection of large language models and security.

LLM

AI Security· Published and added 10 Jun 2026

youtu.bevideo🛡️ Security

Web LLM Attacks Lab: Exploiting AI agents to trigger secondary vulnerabilities

This walk-through demonstrates solving PortSwigger Web Security Academy's 'Exploiting AI agents to trigger secondary vulnerabilities' lab. The attack leverages Burp Suite to discover an internal administrative endpoint via SSRF fuzzing, then plants an indirect prompt injection payload in a public product review to coerce an automated AI site auditor into deleting a target user.

PortSwigger Web Security Academy Lab - Exploiting AI agents to trigger secondary vulnerabilitiesBurp Suite Professional v2024.2.1Burp Intruder+4
PortSwigger Web Security Academy

AI Security· Added 3 Oct 2026, published 2 Jun 2026

provos.orgwriteup🛡️ Security

IronCurtain: Secure AI Agent Runtime

The author describes IronCurtain, an open-source finite-state-machine orchestration framework for agentic security research, and a vuln-discovery workflow built on top of it that autonomously hunts for zero-days. Using an Orchestrator agent, an append-only journal, and tiered harness-building (single-function fuzzing up to full QEMU-based VM validation), the workflow replicated the historical 1998 OpenBSD TCP SACK kernel panic with Opus 4.6/Sonnet 4.6, and independently found previously unreported bugs in a widely-deployed media framework and an 18-year-old integer truncation flaw in another foundational library — the latter run entirely on Z.AI's GLM 5.1 via a LiteLLM gateway swapped in place of Anthropic models. The piece argues that PoC generation (not static findings) is what matters for defenders, that open orchestration plus commodity/open-weight models can match "frontier" vulnerability-discovery capability at $30–$150 per codebase, and that AUP refusals during severity assessment create asymmetric friction for defenders versus unrestricted adversaries.

IronCurtainGLMLiteLLM+2
MythosOpus 4.6Opus 4.7+3

AI Security, Offensive Security· Published and added 7 May 2026

github.comrepo🛡️ Security

IronCurtain: Secure AI Agent Runtime

IronCurtain is a research-prototype runtime that constrains autonomous AI agents (Claude Code, Goose, or its own builtin agent) by compiling a human-written "constitution" into deterministic policy rules enforced on every MCP tool call. It treats the LLM as untrusted, mediating all filesystem/git/network/API access through a policy engine (allow/deny/escalate), a V8 isolate sandbox for its builtin agent, and a network-isolated Docker mode with a TLS-terminating MITM proxy for external agent tools. It also ships multi-agent workflow orchestration (e.g., a vulnerability-discovery pipeline with libFuzzer/AFL++ fuzzing gates) with human approval checkpoints.

Model Context ProtocolDockerClaude Code+3

AI Security· Published and added 7 May 2026

deepmind.googlearticle🛡️ Security

CodeMender (Google DeepMind)

Google DeepMind's official announcement of CodeMender, an AI agent built on Gemini Deep Think that autonomously debugs, roots-causes, and patches security vulnerabilities in real codebases, then validates fixes via static and dynamic analysis, differential testing, fuzzing, SMT solvers, and an LLM-based critique agent before human review. The team has upstreamed 72 security fixes to open-source projects, including some spanning 4.5 million lines of code, and used CodeMender to proactively apply bounds-safety annotations to libwebp, which would have neutralized the buffer-overflow class of bug behind CVE-2023-4863, a bug used in a zero-click iOS exploit.

CodeMenderGeminilibwebp
CVE-2023-4863

AI Security, AppSec· Published and added 6 May 2026

leviathansecurity.comarticle🛡️ Security

UEFI is the new BIOS

Leviathan Security's introductory post in a UEFI reverse-engineering and exploit-development series, explaining the UEFI/PI boot flow (SEC, PEI, DXE, BDS phases), core UEFI data structures (EFI System/Boot/Runtime Services tables), and how UEFI Secure Boot, Intel Boot Guard, and Intel BIOS Guard build a layered chain of trust over SPI flash firmware. It walks through UEFITool screenshots of a real X58I BIOS image and explains known design gaps (e.g., UEFI Secure Boot's implicit trust of SEC/PEI, Boot Guard not blocking SPI read/write) that motivate firmware implants and bootkits, setting up later posts on lab setup, static/dynamic analysis, fuzzing, and exploit dev.

UEFIUEFIToolIntel Boot Guard+1
BIOS Disassembly Ninjutsu UncoveredVincent ZimmerDarmawan Salihun

Hardware & RF, Offensive Security· Added 3 Oct 2026, published 23 Sep 2024