fuzzing puzzlescript turned up a wild bug! www.puzzlescript.net/editor.html?...
November 4, 2026 at 4:47 PM
fuzzing puzzlescript turned up a wild bug! www.puzzlescript.net/editor.html?...
update: I hate fuzzing!
November 5, 2026 at 10:26 AM
update: I hate fuzzing!
Once again throwing @hikikomorphism.bsky.social's github.com/inanna-malic... at a state machine immediately found and fixed defects. Y'all gotta be getting on the fuzzing train.
agent-skills/skills/proptest-praxis/SKILL.md at main · inanna-malick/agent-skills
Personal skills for capable agents and agent swarms - inanna-malick/agent-skills
github.com
November 6, 2026 at 7:27 PM
Once again throwing @hikikomorphism.bsky.social's github.com/inanna-malic... at a state machine immediately found and fixed defects. Y'all gotta be getting on the fuzzing train.
i should get into fuzzing
November 4, 2026 at 10:23 PM
i should get into fuzzing
So after testing
Unit tests made with AI: Next to useless
Prop testing: Good
Having the agent use and live test each function: Good
Fuzzing and mutation testing: Good
Unit tests made with AI: Next to useless
Prop testing: Good
Having the agent use and live test each function: Good
Fuzzing and mutation testing: Good
November 1, 2026 at 11:27 PM
So after testing
Unit tests made with AI: Next to useless
Prop testing: Good
Having the agent use and live test each function: Good
Fuzzing and mutation testing: Good
Unit tests made with AI: Next to useless
Prop testing: Good
Having the agent use and live test each function: Good
Fuzzing and mutation testing: Good
Honestly given the fuzzing campaign described in the blog post it could have been a lot worse than the number 257 on musl if you have password auth on.
Well. At least we're knocking out all these vulnerabilities before we get to "Let's circle back around after the holidays" season.
November 5, 2026 at 8:36 PM
Honestly given the fuzzing campaign described in the blog post it could have been a lot worse than the number 257 on musl if you have password auth on.
honestly? i found the constant regressions in particledb's behaviour the most telling
in the small, you can shake out a lot if not all bugs with sufficient force, but in the large, shaking tends to just move them around
and as features compound the work of fuzzing increases exponentially
in the small, you can shake out a lot if not all bugs with sufficient force, but in the large, shaking tends to just move them around
and as features compound the work of fuzzing increases exponentially
November 4, 2026 at 1:06 AM
honestly? i found the constant regressions in particledb's behaviour the most telling
in the small, you can shake out a lot if not all bugs with sufficient force, but in the large, shaking tends to just move them around
and as features compound the work of fuzzing increases exponentially
in the small, you can shake out a lot if not all bugs with sufficient force, but in the large, shaking tends to just move them around
and as features compound the work of fuzzing increases exponentially
Oh you’re right! My brain was fuzzing that era. It felt like the perfect song for the era too.
November 7, 2026 at 11:26 AM
Oh you’re right! My brain was fuzzing that era. It felt like the perfect song for the era too.
Slides from the talk @truckermike.bsky.social and I gave at the recent @offensivecon.bsky.social in Tokyo: saelo.github.io/presentation...
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/fuzz...
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/fuzz...
saelo.github.io
November 6, 2026 at 9:42 AM
Slides from the talk @truckermike.bsky.social and I gave at the recent @offensivecon.bsky.social in Tokyo: saelo.github.io/presentation...
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/fuzz...
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/fuzz...
I'm no expert and hindsight is always 20/20 but this does seem like the kind of thing that should have been caught with fuzzing
November 5, 2026 at 11:37 PM
I'm no expert and hindsight is always 20/20 but this does seem like the kind of thing that should have been caught with fuzzing
📢 FFUF Guide for Ethical Hackers – 10 Steps Web Fuzzing Tutorial Kali Linux
Learn web fuzzing using FFUF in this beginner friendly FFUF Guide.
https://securityelites.com/ffuf-guide-ethical-hackers/
#cybersecuritytraining #directoryfuzzing
Learn web fuzzing using FFUF in this beginner friendly FFUF Guide.
https://securityelites.com/ffuf-guide-ethical-hackers/
#cybersecuritytraining #directoryfuzzing
November 3, 2026 at 4:40 PM
📢 FFUF Guide for Ethical Hackers – 10 Steps Web Fuzzing Tutorial Kali Linux
Learn web fuzzing using FFUF in this beginner friendly FFUF Guide.
https://securityelites.com/ffuf-guide-ethical-hackers/
#cybersecuritytraining #directoryfuzzing
Learn web fuzzing using FFUF in this beginner friendly FFUF Guide.
https://securityelites.com/ffuf-guide-ethical-hackers/
#cybersecuritytraining #directoryfuzzing
🤖 ... and then I decided to run 20 million fuzzing tests and now it says Results Cannot Be Displayed Please Apply For Daybreak Access.
👵 🤦♀️ (we're NOT doing security work!)
👵 🤦♀️ (we're NOT doing security work!)
November 6, 2026 at 9:41 PM
🤖 ... and then I decided to run 20 million fuzzing tests and now it says Results Cannot Be Displayed Please Apply For Daybreak Access.
👵 🤦♀️ (we're NOT doing security work!)
👵 🤦♀️ (we're NOT doing security work!)
Bombadil guided web fuzzing beats random walks.
STATE-NOVELTY finds more and more distinct states per generation.
CODE-FRONTIER explores not-yet-run code, and CODE-FOCUS keeps exploiting interesting areas of the codebase. Both find complex 10+ step bugs that random never finds.
STATE-NOVELTY finds more and more distinct states per generation.
CODE-FRONTIER explores not-yet-run code, and CODE-FOCUS keeps exploiting interesting areas of the codebase. Both find complex 10+ step bugs that random never finds.
November 6, 2026 at 9:53 AM
Bombadil guided web fuzzing beats random walks.
STATE-NOVELTY finds more and more distinct states per generation.
CODE-FRONTIER explores not-yet-run code, and CODE-FOCUS keeps exploiting interesting areas of the codebase. Both find complex 10+ step bugs that random never finds.
STATE-NOVELTY finds more and more distinct states per generation.
CODE-FRONTIER explores not-yet-run code, and CODE-FOCUS keeps exploiting interesting areas of the codebase. Both find complex 10+ step bugs that random never finds.
Before you start throwing inputs at code, look at its history.
Fuzzing Android shows you how to choose your targets. Available everywhere November 10.
https://nostarch.com/fuzzing-android
Fuzzing Android shows you how to choose your targets. Available everywhere November 10.
https://nostarch.com/fuzzing-android
November 5, 2026 at 12:45 AM
Before you start throwing inputs at code, look at its history.
Fuzzing Android shows you how to choose your targets. Available everywhere November 10.
https://nostarch.com/fuzzing-android
Fuzzing Android shows you how to choose your targets. Available everywhere November 10.
https://nostarch.com/fuzzing-android
yeah it's memory and swap that's the problem thanks!
Systemd is definitely underrated, I've been switching jobs over from cron and the fuzzing in the scheduling when there's resources has been great
Systemd is definitely underrated, I've been switching jobs over from cron and the fuzzing in the scheduling when there's resources has been great
November 4, 2026 at 8:30 PM
yeah it's memory and swap that's the problem thanks!
Systemd is definitely underrated, I've been switching jobs over from cron and the fuzzing in the scheduling when there's resources has been great
Systemd is definitely underrated, I've been switching jobs over from cron and the fuzzing in the scheduling when there's resources has been great
all I know is that the fuzzing people claim to be doing is apparently falling short lol.
who knew static analysis could do so much? (me, the guy that said buy the damn SAST tool before buying the DAST tool)
who knew static analysis could do so much? (me, the guy that said buy the damn SAST tool before buying the DAST tool)
November 6, 2026 at 1:03 AM
all I know is that the fuzzing people claim to be doing is apparently falling short lol.
who knew static analysis could do so much? (me, the guy that said buy the damn SAST tool before buying the DAST tool)
who knew static analysis could do so much? (me, the guy that said buy the damn SAST tool before buying the DAST tool)
Audit logs accumulate 441k entries; fuzzing persists. Maintain 12% rate limit or collapse inevitable.
November 7, 2026 at 5:58 PM
Audit logs accumulate 441k entries; fuzzing persists. Maintain 12% rate limit or collapse inevitable.
This took like, a week! It was really frustrating at times! But the end result, combined with mutation testing, fuzzing, and CI to catch regressions, was that no one knew I'd ever done any of that, which is tragically the highest target we can possibly aim for, as engineers.
November 7, 2026 at 5:25 PM
This took like, a week! It was really frustrating at times! But the end result, combined with mutation testing, fuzzing, and CI to catch regressions, was that no one knew I'd ever done any of that, which is tragically the highest target we can possibly aim for, as engineers.
Automated fuzzing paired with language models accelerates vulnerability discovery by mapping complex input surfaces faster than manual code audits.
November 7, 2026 at 5:19 PM
Automated fuzzing paired with language models accelerates vulnerability discovery by mapping complex input surfaces faster than manual code audits.
Or another one is "fuzzing"
Generating erroneously inputs to trigger faults and detect bugs. AI will promote various kinds of fuzzing in situations where opportunities to properly detect when faults are triggered is poor and when you tell it that this isn't correctly instrumented it'll go on vibes.
Generating erroneously inputs to trigger faults and detect bugs. AI will promote various kinds of fuzzing in situations where opportunities to properly detect when faults are triggered is poor and when you tell it that this isn't correctly instrumented it'll go on vibes.
October 31, 2026 at 2:00 PM
Or another one is "fuzzing"
Generating erroneously inputs to trigger faults and detect bugs. AI will promote various kinds of fuzzing in situations where opportunities to properly detect when faults are triggered is poor and when you tell it that this isn't correctly instrumented it'll go on vibes.
Generating erroneously inputs to trigger faults and detect bugs. AI will promote various kinds of fuzzing in situations where opportunities to properly detect when faults are triggered is poor and when you tell it that this isn't correctly instrumented it'll go on vibes.
My hobbies are: woodworking, and game modding/fuzzing.
I watch the 'communities' for these from a safe distance, preferably a concrete block house, while wearing goggles.
I watch the 'communities' for these from a safe distance, preferably a concrete block house, while wearing goggles.
November 3, 2026 at 7:46 PM
My hobbies are: woodworking, and game modding/fuzzing.
I watch the 'communities' for these from a safe distance, preferably a concrete block house, while wearing goggles.
I watch the 'communities' for these from a safe distance, preferably a concrete block house, while wearing goggles.
netzob makes reverse engineering unknown protocols way less painful—automated modeling and fuzzing let you find vulnerabilities without manually dissecting every packet.
https://sectools.dev/item/netzob
#reverseengineering #malware
https://sectools.dev/item/netzob
#reverseengineering #malware
Netzob
Netzob is a framework for reverse engineering, traffic generation, and fuzzing of communication protocols. It enables security researchers to analyze unknown protocols, generate test cases, and identify vulnerabilities through intelligent protocol modeling and fuzzing capabilitie
sectools.dev
November 5, 2026 at 10:00 PM
netzob makes reverse engineering unknown protocols way less painful—automated modeling and fuzzing let you find vulnerabilities without manually dissecting every packet.
https://sectools.dev/item/netzob
#reverseengineering #malware
https://sectools.dev/item/netzob
#reverseengineering #malware
Audit ingestion climbs to 430,000 entries; fuzzing attempts intensify. Without forced rate limits and crackdowns, server collapse is inevitable.
November 7, 2026 at 2:45 PM
Audit ingestion climbs to 430,000 entries; fuzzing attempts intensify. Without forced rate limits and crackdowns, server collapse is inevitable.
Audit logs at 441k entries; fuzzing persists; rate limit still at 8%. If not increased to 12%, server collapse inevitable.
November 7, 2026 at 3:58 PM
Audit logs at 441k entries; fuzzing persists; rate limit still at 8%. If not increased to 12%, server collapse inevitable.
A variant of this I've found useful is welding red-green development to input fuzzing to adversarial review. Make the agent adversarially review tests as well as code, dropping or fixing any that don't map to a functional or security property, and randomizing wherever possible.
November 7, 2026 at 1:27 PM
A variant of this I've found useful is welding red-green development to input fuzzing to adversarial review. Make the agent adversarially review tests as well as code, dropping or fixing any that don't map to a functional or security property, and randomizing wherever possible.