289 matches found
[SECURITY] Fedora 43 Update: rust-resctl-demo-2.2.5-9.fc43
resctl-demo demonstrates and documents various aspects of resource control using self-contained workloads in guided scenarios...
SAFuzz: Semantic-Guided Adaptive Fuzzing for LLM-Generated Code
While AI-coding assistants accelerate software development, current testing frameworks struggle to keep pace with the resulting volume of AI-generated code. Traditional fuzzing techniques often allocate resources uniformly and lack semantic awareness of algorithmic vulnerability patterns, leading...
Can Developers Rely on LLMs for Secure IaC Development?
We investigated the capabilities of GPT-4o and Gemini 2.0 Flash for secure Infrastructure as Code IaC development. For security smell detection, on the Stack Overflow dataset, which primarily contains small, simplified code snippets, the models detected at least 71% of security smells when prompt...
SimFuzz: Similarity-Guided Block-Level Mutation for RISC-V Processor Fuzzing
The Instruction Set Architecture ISA defines processor operations and serves as the interface between hardware and software. As an open ISA, RISC-V lowers the barriers to processor design and encourages widespread adoption, but also exposes processors to security risks such as functional bugs...
Causal-Guided Detoxify Backdoor Attack of Open-Weight LoRA Models
Low-Rank Adaptation LoRA has emerged as an efficient method for fine-tuning large language models LLMs and is widely adopted within the open-source community. However, the decentralized dissemination of LoRA adapters through platforms such as Hugging Face introduces novel security vulnerabilities...
New Exam Security Questions in the AI Era: Comparing AI-Generated Item Similarity between Naive and Detail-Guided Prompting Approaches
Large language models LLMs have emerged as powerful tools for generating domain-specific multiple-choice questions MCQs, offering efficiency gains for certification boards but raising new concerns about examination security. This study investigated whether LLM-generated items created with...
WuppieFuzz: Coverage-Guided, Stateful REST API Fuzzing
Many business processes currently depend on web services, often using REST APIs for communication. REST APIs expose web service functionality through endpoints, allowing easy client interaction over the Internet. To reduce the security risk resulting from exposed endpoints, thorough testing is...
One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs
Finetuning pretrained large language models LLMs has become the standard paradigm for developing downstream applications. However, its security implications remain unclear, particularly regarding whether finetuned LLMs inherit jailbreak vulnerabilities from their pretrained sources. We investigat...
A Research and Development Portfolio of GNN Centric Malware Detection, Explainability, and Dataset Curation
Graph Neural Networks GNNs have become an effective tool for malware detection by capturing program execution through graph-structured representations. However, important challenges remain regarding scalability, interpretability, and the availability of reliable datasets. This paper brings togeth...
Effective Command-Line Interface Fuzzing with Path-Aware Large Language Model Orchestration
Command-line interface CLI fuzzing tests programs by mutating both command-line options and input file contents, thus enabling discovery of vulnerabilities that only manifest under specific option-input combinations. Prior works of CLI fuzzing face the challenges of generating semantics-rich opti...
Steganographic Backdoor Attacks in NLP: Ultra-Low Poisoning and Defense Evasion
Transformer models are foundational to natural language processing NLP applications, yet remain vulnerable to backdoor attacks introduced through poisoned data, which implant hidden behaviors during training. To strengthen the ability to prevent such compromises, recent research has focused on...
VEIL: Jailbreaking Text-To-Video Models Via Visual Exploitation from Implicit Language
Jailbreak attacks can circumvent model safety guardrails and reveal critical blind spots. Prior attacks on text-to-video T2V models typically add adversarial perturbations to obviously unsafe prompts, which are often easy to detect and defend. In contrast, we show that benign-looking prompts...
HYDRA: A Hybrid Heuristic-Guided Deep Representation Architecture for Predicting Latent Zero-Day Vulnerabilities in Patched Functions
Software security testing, particularly when enhanced with deep learning models, has become a powerful approach for improving software quality, enabling faster detection of known flaws in source code. However, many approaches miss post-fix latent vulnerabilities that remain even after patches...
Security Evaluation of Quantum Circuit Split Compilation under an Oracle-Guided Attack
Quantum circuits are the fundamental representation of quantum algorithms and constitute valuable intellectual property IP. Multiple quantum circuit obfuscation QCO techniques have been proposed in prior research to protect quantum circuit IP against malicious compilers. However, there has not be...
Learn what generative AI can do for your security operations center
The busier security teams get, the harder it can be to understand the full impact of false positives, queue clutter, tool fragmentation, and more. But what is clear—it all adds up to increased fatigue and an increased potential to miss the cyberthreats that matter most. To help security teams...
Learn what generative AI can do for your security operations center
The busier security teams get, the harder it can be to understand the full impact of false positives, queue clutter, tool fragmentation, and more. But what is clear—it all adds up to increased fatigue and an increased potential to miss the cyberthreats that matter most. To help security teams...
No, ICE (Probably) Didn’t Buy Guided Missile Warheads
A federal contracting database lists an ICE payment for $61,218 with the payment code for “guided missile warheads and explosive components.” But it appears ICE simply entered the wrong code...
EUVD-2021-16807
Malware in sbrugna...