libfyaml v1.0.0-beta2 is a correctness and portability release fixing memory leaks, double frees, and other issues found through fuzzing, while adding support for multiple platforms including FreeBSD, NetBSD, OpenBSD, and various Linux architectures. The release introduces allocation failure injection testing and expands CI coverage across supported platforms.
GitHub Security Lab introduces the Fuzzing Taskflow, an LLM-driven autonomous fuzzing pipeline for C/C++ projects that automates harness writing, crash triage, and vulnerability reporting. The system uses Claude Sonnet 5 as its default model and separates decision-making (LLM agent) from execution (MCP tools) to maintain security and clarity in the fuzzing workflow.
An article exploring generative testing techniques for finding bugs in software, using a regex engine bug as a case study. The author demonstrates how fuzzing with an oracle (comparing multiple implementations) can effectively discover edge cases that unit tests miss, emphasizing that small, carefully crafted inputs often reveal bugs better than large random ones.
Article discusses challenges in writing effective software tests that are fast, reliable, and comprehensive. It explores how to move beyond manual test cases toward property-based testing and fuzzing to discover bugs in unexpected scenarios, using examples from Firezone's approach combining sans-IO design, deterministic simulation, and coverage-guided fuzzing.
A developer explores building a deterministic hypervisor for running Linux kernels, discussing the core challenges of concurrency and hardware nondeterminism. The post examines existing approaches like Antithesis's use of Intel performance counters and traditional emulator-based solutions from cybersecurity fuzzing, while hinting at alternative implementation strategies.
This article explains how to conduct security reviews of Daml smart contracts by adapting EVM review methodologies. It defines the Daml template as the review unit—comprising contract data, signatories, observers, and choices—and describes how Daml Script tests contracts on a fresh ledger using submitMustFail assertions and time control functions, with authorization determined by signatories and actors.
Lily is an automated approach that detects code-level backdoors in open-source software by integrating backdoor detection into CI pipelines and release vetting workflows. It uses enhanced fuzzing to identify suspicious behavior triggers and combines code analysis with fuzzing data to pinpoint malicious code regions, achieving high detection accuracy while resisting adversarial evasion attempts.