Oliver Chang

Staff Eng @ Google DeepMind.

Former: founder of lead/co-founder for OSS-Fuzz.

[Samuel Groß @5aelo]

We derestricted a number of vulnerabilities found by Big Sleep in JavaScriptCore today: https://t.co/mKSWXXWmXG

All of them were fixed in the iOS 26.1 (and equivalent) update last month. Definitely some cool bugs in there!

[Oliver Chang @halbecaf]

Really excited to finally announce CodeMender!

As part of this we've already submitted and upstreamed several patches to OSS projects via OSS-Fuzz.

Check out our post at: https://t.co/qgnroQyIzN

There will be more technical details and exciting announcements to come!

[Google DeepMind @GoogleDeepMind]

Software vulnerabilities can be notoriously time-consuming for developers to find and fix.

Today, we’re sharing details about CodeMender: our new AI agent that uses Gemini Deep Think to automatically patch critical software vulnerabilities. 🧵

[DonggeLiu @dongge_liu]

🚀Inviting GSoC2025 contributors to supercharge OSS-Fuzz-Gen! Opportunities include:​
1. Modularize OSS-Fuzz ​features
2. Enhance Experiment Execution & Report UI​
3. Integrate Research Innovations​

Interested? Send your resume to [email protected]😃

https://t.co/vcoiDwScUN

[Oliver Chang @halbecaf]

OSV-Scanner has just released the first beta for V2, a major update that includes significant new features, including layer-aware container scanning, remediation for pom.xml, new HTML output and more.

https://t.co/kkPK2KHBTk

Please try it out and give us feedback!

[Bob Callaway @rdcallaw]

https://t.co/MJrSrcgXqC

Awesome blog on how we’re using SLSA to make GKE more secure for our customers!

[Sebastian Lekies @slekies]

Today, we announced the official release of OSV-SCALIBR, Google's software composition analysis library. If you are working in vuln management / security scanning, SCALIBR is for you! SCALIBR is powering most of Google's vuln scanning. Please RT
https://t.co/Xk95hlSQwd

[Jonathan Metzman @metzmanj]

The OSS-Fuzz team is hiring a PhD intern for this summer. Come join us and build the future of fuzzing. Link in next tweet in thread. RTs appreciated!

[Oliver Chang @halbecaf]

Happy new year! OSV had a lot of great progress in 2024, from new ecosystem adoption, API improvements, and scanner feature development! We just published a blog about these and our 2025 plans here: https://t.co/7vRkoPHZfO !

[Oliver Chang @halbecaf]

@jduck @clintgibler @metzmanj This is a very fair point! This is exactly why we haven't turned this on by default for all OSS-Fuzz users. One of our next priorities is to automate as much of the triage to determine if it's a legit vuln / attack surface or not (e.g. using an LLM and/or past reported vulns).

[Royal Hansen @royalhansen]

The OSS-Fuzz team at @Google is using AI-powered fuzzing to find vulns in open-source software and recently reported 26 new vulns to open-source project maintainers, including one in the OpenSSL library which is critical to most internet infrastructure. https://t.co/2UuBC0U4Xo

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

On the heels of @Google’s ‘Big Sleep’ AI discovery of a real-world vulnerability, our OSS-Fuzz team identified and reported 26 vulnerabilities to open-source project maintainers by using AI-generated and enhanced fuzz targets. Read more here: https://t.co/6SfPt38ZmE

[Oliver Chang @halbecaf]

New blog post about OSS-Fuzz AI-powered fuzzing is live!

We talk about what went into making LLMs work well enough for this use case to find 26 new vulnerabilities (including a CVE in OpenSSL), as well as what else we have planned to make this better.

https://t.co/ewCUmtRs6P

[Oliver Chang @halbecaf]

Red Hat joins OSV! https://t.co/M6yDyTwMpE

Combined with Ubuntu, Chainguard, and SUSE adopting OSV this year, https://t.co/JhJ5uLdAjV has really started to become a comprehensive vulnerability source for not only language packages, but also Linux distros!

[Oliver Chang @halbecaf]

CVE-2024-9143 (https://t.co/ApXML9Eiuv) was disclosed recently, which was found by OSS-Fuzz-Gen! This is a pretty proud example of our team showing the promise of leveraging LLMs enable more fuzzing coverage.

[Oliver Chang @halbecaf]

OSV support announced in the latest Ubuntu 24.10 release!

This year has seen OSV adoption from many Linux distributions, and the https://t.co/JhJ5uLd2un database is starting to become a really comprehensive source of accurate vuln info across major open source ecosystems!

[Ubuntu @ubuntu]

Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮

Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀

Read more: https://t.co/bOfOabbuM0

#Ubuntu #Linux #OracularOriole

[Ubuntu @ubuntu]

Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮

Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀

Read more: https://t.co/bOfOabbuM0

#Ubuntu #Linux #OracularOriole

[Oliver Chang @halbecaf]

@microsvuln @dobinrutis I expect that we'll need to do a combination of:
- Implementing these easier automated checks to prune out obvious false positives from incorrect/bad harnesses.
- Have some kind of feedback mechanism from project maintainers (e.g. an annotation on public APIs) to help us out

[Oliver Chang @halbecaf]

One week later the bug count is now at 25 bugs total (https://t.co/sjDnDMze7e)

There's still many improvements to be made to improve success rate of generated targets, but we now have the problem of too many crashes to triage. Automating this will a focus of our future research.

[Oliver Chang @halbecaf]

This week we've added another 8 trophies to OSS-Fuzz-Gen (for a total of 14)! These are vulnerabilities found by LLM-generated harnesses. The interesting bit here is many of these are in well-fuzzed projects with thousands of hours of fuzzing already.

https://t.co/sjDnDMyGhG

[Oliver Chang @halbecaf]

@microsvuln @dobinrutis Yep, there's a lot of low hanging fruit things we can do to determine these automatically (or use an LLM).

However, there are also cases when, even as a human, it's hard to tell if something is a legitimate bug or not because of unclear API preconditions and threat models.