arXiv AI
22h ago
Benchmarking Automated Security Patch Backporting: How Far Are We?
arXiv:2608. 17671v1 Announce Type: cross Abstract: Automated security patch backporting is critical for mitigating N-day vulnerabilities.
Vulnerabilities, Secrets and Misconfiguration in the Highest-Exposure Docker Hub Images
arXiv:2608. 02669v1 Announce Type: cross Abstract: Docker Hub is the registry underneath most container deployments, and a flaw in a widely reused base image is inherited by every image built on it.
Related stories
arXiv AI
Jun 19
Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software
arXiv:2606. 20502v1 Announce Type: cross Abstract: Whether LLMs scoring well on vulnerability benchmarks genuinely reason about security or merely pattern-match on contaminated data remains unresolved.
Hugging Face Trending Papers
1d ago
Benchmarking Automated Security Patch Backporting: How Far Are We?
Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools report success rates above 80% on their respective datasets.
arXiv Machine Learning
Jul 30
HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models
arXiv:2607. 27030v1 Announce Type: cross Abstract: LLM-based analyzers have begun finding real vulnerabilities in mature open-source projects: AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS.
arXiv AI
Jul 7
JavaVulBench: A Java Vulnerability Benchmark with Realistic Splits, a Unified Multi-Backend Harness, and a Leakage-Aware Evaluation Mode
arXiv:2607. 02825v1 Announce Type: cross Abstract: We release \textsc{JavaVulBench}, a benchmark dataset and evaluation harness for Java vulnerability detection.
arXiv AI
Jun 17
ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
arXiv:2606. 17283v1 Announce Type: cross Abstract: Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at the cost of the others.
arXiv AI
Jun 3
FORGE: Multi-Agent Graduated Exploitation and Detection Engineering
arXiv:2606. 03453v1 Announce Type: cross Abstract: Vulnerability disclosure volumes now far exceed organizational assessment capacity, yet three adjacent research communities (proof-of-concept generation, vulnerability prioritization, and detection rule engineering) operate largely in isolation.
arXiv AI
Jun 2
Needles at Scale: LLM-Assisted Target Selection for Windows Vulnerability Research
arXiv:2606. 01364v1 Announce Type: cross Abstract: The attack surface of a modern operating system is a haystack: thousands of signed binaries and millions of functions, almost none relevant to any given vulnerability.
arXiv AI
Jul 8
Quantifying Frontier LLM Capabilities for Container Sandbox Escape
arXiv:2603. 02277v2 Announce Type: replace-cross Abstract: Large language models (LLMs) increasingly act as autonomous agents, using tools to execute code, read and write files, and access networks, creating novel security risks.
arXiv AI
Jul 3
ContraFix: Skill-Enhanced Contrastive Runtime Analysis for Vulnerability Repair
arXiv:2605. 17450v2 Announce Type: replace-cross Abstract: As software systems grow increasingly complex, automated vulnerability repair (AVR) remains difficult because the materials available to a repair system are usually failure artifacts rather than repair guidance.
arXiv AI
Jul 15
Bulkhead: Automated Semantic Detection and Remediation of Container Escape Vulnerabilities
arXiv:2607. 12723v1 Announce Type: cross Abstract: Filesystem isolation in container ecosystems is often weakened by cross-boundary path misresolution, causing path traversal (PaTra) vulnerabilities.
arXiv AI
Jul 1
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.