AI agents successfully generated multiple exploits for a zero-day vulnerability, indicating a shift towards the industrialization of exploit development in cybersecurity.
About:
Sean Heelan is an independent researcher focused on LLM-based automation in vulnerability research, co-founded Optimyze, and has a background in exploit development.
Website:
Specializations:
Interests:
Subscribe to RSS:
The author discusses how they found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. They found a use-after-free vulnerability in the handler for the SMB ‘logoff’ command. The author also evaluates o3's perform...
The blog post discusses the use of Large Language Models (LLMs) to find faster, equivalent software libraries for application optimization. It highlights the benefits of using LLMs over traditional search methods and introduces a ...
The text discusses the combination of static and dynamic analysis for performance optimization in C++ using CodeQL. It outlines a pattern that can lead to sub-optimal machine code being emitted by the compiler and describes how to...
The text discusses the combination of static and dynamic analyses for performance optimization, focusing on the benefits of combining the two methods. It provides examples of how continuous profiling and library matching can lead ...
The text is a repost of a blog originally written on prodfiler.com, discussing how to optimize an eBPF compiler called K2 using Prodfiler. The author walks through the process of using Prodfiler to identify areas for optimization ...
The text is a summary of the author's PhD thesis on greybox automatic exploit generation for heap overflows in language interpreters. The author discusses the limitations of previous exploit generation systems and presents his app...
The author will present a paper on Automatic Exploit Generation (AEG) at the upcoming ACM Conference on Computer and Communications Security (CCS). The paper discusses a system for automatically discovering primitives and construc...
The author discusses the concept of exploit templates, which are partially completed exploits that can be filled in by an automated reasoning engine. The use of exploit templates can make the process of exploit development more ef...
The text is about a seminar on SAT, SMT and CP, and the author learned about some cool projects in the realm of constraint satisfaction and optimization. The projects include MiniZinc, Unison, and Approximate Model Counting.
The PHP development team has decided that bugs in the implementation of the unserialize function are no longer considered security relevant. The author disagrees with this decision and provides a set up for fuzzing/ongoing QA of u...