Vulnerabilities & Exploits

LLM-Guided Fuzzing Shifts the Bottleneck Upstream

LLM supervision changes fuzzing from a labor-heavy craft into a pipeline. The weak point is no longer just the fuzzing engine. It is the classifier and prioritizer deciding which paths get attention, because that gate now controls ROI.

CERT Polska says the CCN project built an autonomous fuzzing system that handles code analysis, test generation, crash triage, and reporting. Its first campaigns already found real bugs in widely used open-source software, including CVE-2026-35251 and CVE-2026-42268.

That makes bug discovery faster for common components, but it also makes poor ranking more expensive. A weak top-of-funnel model can burn compute on low-value paths and bury good findings in triage noise.

1 source · May 21

CVE-2026-42268

NVD KEV

CVSS 7.5 HIGH: modSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. EPSS 0.4% (31st percentile).

CVE-2026-35251

NVD KEV

CVSS 7.5 HIGH: vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). EPSS 0.1% (1st percentile).

Timeline

Sources

Part of the PlainSec briefing for 2026-05-22

Every edition of this story: LLM-Guided Fuzzing Shifts the Bottleneck Upstream

More from today