Jul 2026· European Symposium on Security and Privacy· pp. 1160-1179· 0 citations· 77 references
Computer Science
Abstract
Vulnerabilities in web applications, particularly within content management systems (CMSs) and their plugins, remain a critical attack vector in practice. Dynamic testing techniques such as fuzzing are underutilized in the web domain due to their limited ability to explore deeply nested code paths and context-dependent application logic. This limitation is especially pronounced in CMSs, where third-party plugins often introduce complex, domain-specific behaviors that challenge general-purpose fuzzers to detect context-specific software defects.In this work, we present Themis, a context-aware, grey-box fuzzing framework specifically designed for WordPress plugins. We built Themis based on the Atropos testing infrastructure and extended it with a domain-specific instrumentation layer, an adaptive test harness, and a custom bug oracle. Together, these components enable targeted vulnerability detection by guiding the fuzzer toward semantically meaningful and security-relevant code paths. Our tool, by design, prioritizes server-side vulnerability classes, including injection flaws, insecure file access, and logic bugs, while leveraging domain knowledge of WordPress APIs to improve detection precision. We evaluate Themis on 68 real-world plugins, including a representative subset drawn from related work. Themis successfully reproduces known CVEs from this selection and discovers 10 previously unknown vulnerabilities, which have been responsibly disclosed to the affected vendors. Compared to existing work, Themis achieves, on average, faster bug discovery and higher code coverage across the evaluated plugins. Our results demonstrate that domain-specific dynamic analysis, when paired with context-aware instrumentation and oracle-guided feedback, can outperform generic fuzzers in precision, effectiveness, and depth of exploration. These results underscore the importance of adopting more secure, context-aware security testing strategies.
A hybrid pipeline combining static vulnerability candidate selection using Latent Semantic Analysis with dynamic verification through Large Language Model-assisted fuzzing is presented, which reduces manual effort while still requiring human validation.
Kevin Nguyen, Dominik Schoop· International Conference on...· 0 citations
: Large language models are increasingly being deployed in safety-critical domains, yet remain vulnerable to jailbreak attacks that circumvent safety alignments. This systematic review synthesizes empirical jailbreak research published between 2024 and 2025, using a PRISMA-guided search protocol, followed by BERTopic-based topic modeling. The analysis identifies eight main jailbreak categories: optimization-based, ge-netic/evolutionary, iterative refinement, semantic/persuasion-based, decomposition, context/generation-level, visual/encoding and fuzzing attacks, and characterizes their effectiveness, efficiency, and transferability across open-source and proprietary models, including Llama-2/3, Vicuna, GPT-3.5/4, Claude, Gemini, and DeepSeek-V3. Results show that simple configuration and context-level attacks can match the near-perfect attack success rates of sophisticated white-box optimization methods on models such as Llama-2, while requiring far fewer queries and no parameter access, highlighting a gap between research focus and practical threat severity. The review further identifies five recurring vulnerability mechanisms: representation-level gaps, execution-priority manipulation, semantic fragmentation, gradient-space exploitation and persuasion susceptibility, and documents family-specific vulnerability patterns, with open-source Llama-based models consistently more exposed than safety-enhanced architectures such as Claude. Diverse methods, uneven focus on models and publication bias limit how broadly results apply. Nonetheless, the review reveals that weaknesses in safety alignment persist across successive LLM generations, urging that effective defenses must address all eight attack categories rather than isolated techniques.
Meda Račaitytė, Hélder Bastos, R. Ribeiro et al.· International Conference on...· 0 citations
Vulnerability detection via static analysis traditionally relies on security experts encoding insecure coding patterns into algorithmic rules. However, this approach often focuses on syntactic patterns and overlooks deeper semantic information in the code, such as the meanings of variable and function names. As software systems grow more complex, modeling vulnerabilities using only syntactic rules becomes increasingly challenging. In this paper, we propose a semantics-aware approach to detecting software vulnerabilities. We present SETYPE, a semantics-aware type system that can be derived directly from source code based solely on the meanings of symbols and expressions in natural language. In the SETYPE type system, both type inference and checking are performed by Large Language Models (LLMs), and a failed type check indicates a potential vulnerability. We prototype PYSETYPE to demonstrate the feasibility of SETYPE for detecting vulnerabilities in Python web applications. Our evaluation on real-world applications achieves 87% detection precision and 88% detection accuracy. Using PYSETYPE, we identified 15 potential zero-day vulnerabilities, nine of which were confirmed by developers.
Cross-Site Scripting (XSS) remains a common and high-impact web vulnerability. Detecting XSS with high precision is difficult because exploitability depends on end-to-end data flow (sources, sanitizers, and sinks), framework-specific rendering semantics, and the correctness of context-aware output encoding. Although secure development lifecycles increasingly integrate static application security testing (SAST) into CI/CD pipelines, practical adoption is often limited by false positives and incomplete modeling of project-specific sanitization and templating behavior. In parallel, machine learning (ML) approaches show promise for learning vulnerability-relevant patterns from code, but they depend on the availability of realistic labeled data. This paper studies a low-cost repository-native signal that is routinely available but underused in ML-assisted static analysis: commit messages. We propose a mining and weak-labeling pipeline for Java repositories that identifies candidate XSS-fix commits using message heuristics grounded in OWASP guidance and CWE taxonomy, aligns commit messages with pre-/post-change code contexts extracted from diffs, and trains classifiers under two feature settings: (i) code-only and (ii) code+commit-message fusion. Across three model families (Random Forest, TextCNN, and BiLSTM), commit-message fusion consistently improves F1 and AUPRC and reduces false positives, suggesting that developer intent provides a useful auxiliary signal for security triage.
Abu Alam, Qka Mirza· International Conference on...· 0 citations
Differential fuzzing reveals complementary bugs in the manual and LLM porting of security-critical C libraries to idiomatic Rust and translates these findings into concrete practical guidance for teams planning a similar migration.
Marco Parrillo, Marco Grassi, Luigi Laura· Future Internet· 0 citations
CWEEP can identify the exact location in the RTL where the potential vulnerability resides and supports automatic code repair suggestions when applicable, so it can be used in the early stages of RTL development while properties are still under construction.
B. Kwan, Benjamin Tan· arXiv.org· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
