Vulnerability Research

2026-07-026 minTrail of Bitshigh

Trail of Bits and OpenAI's Patch the Planet initiative used GPT-5.5-Cyber to autonomously build a bespoke fuzzing harness for zlib in a single day, discovering multiple vulnerabilities now undergoing coordinated disclosure. The model independently chose dynamic fuzzing over static review, wrote C/C++ harnesses across a dozen entrypoints, used ASan/UBSan builds and compile-time variants, and demonstrated disciplined reporting by filtering out unreachable crashes. This represents a significant shift in the threat model: the expertise barrier for bespoke fuzzing has collapsed, making large-scale vulnerability discovery accessible to both skilled researchers and low-skill attackers.

2026-06-244 minTrail of Bitsinfo

Trail of Bits introduced the 'Patch the Planet' initiative, leveraging frontier AI models to identify and remediate vulnerabilities across critical open-source projects. The effort highlights a paradigm shift where AI accelerates bug discovery, making triage, patching, and disclosure the primary challenges for maintainers.

2026-05-284 minCisco Taloshigh

Security research highlights a heap overflow vulnerability within DICOM parsing, specifically targeting Orthanc servers during image uploads. By exploiting the complex DICOM file format, attackers can trigger an out-of-bounds write, posing a significant risk to hospital PACS systems that automatically ingest and decode these files.

2026-05-132 minTrail of Bitsinfo

Trail of Bits detailed the technical process of integrating the LibAFL fuzzing engine into Ruzzy, their coverage-guided fuzzer for Ruby. The integration required resolving ELF linker constraints with .preinit_array sections and adjusting shared object loading to satisfy LibAFL's strict coverage map initialization requirements.

The article details the limitations of mutational coverage-guided grammar fuzzing, specifically its tendency to produce similar samples and struggle with complex function chaining. To mitigate this, the author introduces a methodology using the Jackalope fuzzer that periodically restarts workers to combine generative and mutational fuzzing, significantly improving the discovery rate of unique crashes in targets like libxslt.