CVE-2026-42268
CVSS 7.5 HIGH: modSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. EPSS 0.4% (31st percentile).
Vulnerabilities & Exploits
LLM supervision changes fuzzing from a labor-heavy craft into a pipeline. The weak point is no longer just the fuzzing engine. It is the classifier and prioritizer deciding which paths get attention, because that gate now controls ROI.
CERT Polska says the CCN project built an autonomous fuzzing system that handles code analysis, test generation, crash triage, and reporting. Its first campaigns already found real bugs in widely used open-source software, including CVE-2026-35251 and CVE-2026-42268.
That makes bug discovery faster for common components, but it also makes poor ranking more expensive. A weak top-of-funnel model can burn compute on low-value paths and bury good findings in triage noise.
1 source · May 21
CVSS 7.5 HIGH: modSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. EPSS 0.4% (31st percentile).
CVSS 7.5 HIGH: vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). EPSS 0.1% (1st percentile).
CERT Polska
Autonomous fuzzing process under LLM supervision
The CCN project is co-financed by the European Regional Development Fund and the State Budget under the European Funds for Digital Development Programme 2021-2027. Fuzzing is an automated software testing technique that involves feeding random or deliberately malformed input data to detect bugs and security vulnerabilities. For years it has …
originalPart of the PlainSec briefing for 2026-05-22
Every edition of this story: LLM-Guided Fuzzing Shifts the Bottleneck Upstream