halbecaf.bsky.social Senior Staff Eng @ Google DeepMind. Former: founder of OSV.dev, lead/co-founder for OSS-Fuzz.
Sydney, Australia
- Tweets 196
- Following 147
- Followers 1,855
- Likes 316
Oliver Chang retweeted
We derestricted a number of vulnerabilities found by Big Sleep in JavaScriptCore today: issuetracker.google.com/issu…
All of them were fixed in the iOS 26.1 (and equivalent) update last month. Definitely some cool bugs in there!
3
33
177
18,553
Really excited to finally announce CodeMender!
As part of this we've already submitted and upstreamed several patches to OSS projects via OSS-Fuzz.
Check out our post at: deepmind.google/discover/blo…
There will be more technical details and exciting announcements to come!
10
46
6,101
Oliver Chang retweeted
Software vulnerabilities can be notoriously time-consuming for developers to find and fix.
Today, we’re sharing details about CodeMender: our new AI agent that uses Gemini Deep Think to automatically patch critical software vulnerabilities. 🧵
75
320
1,829
368,091
Oliver Chang retweeted
🚀Inviting GSoC2025 contributors to supercharge OSS-Fuzz-Gen! Opportunities include:
1. Modularize OSS-Fuzz features
2. Enhance Experiment Execution & Report UI
3. Integrate Research Innovations
Interested? Send your resume to donggeliu@google.com😃
gist.github.com/dynamicwebpa…
1
4
15
1,846
OSV-Scanner has just released the first beta for V2, a major update that includes significant new features, including layer-aware container scanning, remediation for pom.xml, new HTML output and more.
osv.dev/blog/posts/osv-scann…
Please try it out and give us feedback!
4
11
1,329
Oliver Chang retweeted
cloud.google.com/blog/produc…
Awesome blog on how we’re using SLSA to make GKE more secure for our customers!
2
10
535
Oliver Chang retweeted
Today, we announced the official release of OSV-SCALIBR, Google's software composition analysis library. If you are working in vuln management / security scanning, SCALIBR is for you! SCALIBR is powering most of Google's vuln scanning. Please RT
security.googleblog.com/2025…
3
74
206
14,971
Oliver Chang retweeted
The OSS-Fuzz team is hiring a PhD intern for this summer. Come join us and build the future of fuzzing. Link in next tweet in thread. RTs appreciated!
2
30
88
14,929
Happy new year! OSV had a lot of great progress in 2024, from new ecosystem adoption, API improvements, and scanner feature development! We just published a blog about these and our 2025 plans here: osv.dev/blog/posts/2024-in-r… !
4
8
981
Oliver Chang retweeted
The OSS-Fuzz team at @Google is using AI-powered fuzzing to find vulns in open-source software and recently reported 26 new vulns to open-source project maintainers, including one in the OpenSSL library which is critical to most internet infrastructure. security.googleblog.com/2024…
25
77
5,110
Oliver Chang retweeted
On the heels of @Google’s ‘Big Sleep’ AI discovery of a real-world vulnerability, our OSS-Fuzz team identified and reported 26 vulnerabilities to open-source project maintainers by using AI-generated and enhanced fuzz targets. Read more here: security.googleblog.com/2024…
28
67
8,449
New blog post about OSS-Fuzz AI-powered fuzzing is live!
We talk about what went into making LLMs work well enough for this use case to find 26 new vulnerabilities (including a CVE in OpenSSL), as well as what else we have planned to make this better.
security.googleblog.com/2024…
26
110
16,028
Red Hat joins OSV! openssf.org/blog/2024/11/01/…
Combined with Ubuntu, Chainguard, and SUSE adopting OSV this year, OSV.dev has really started to become a comprehensive vulnerability source for not only language packages, but also Linux distros!
2
7
1,132
CVE-2024-9143 (openssl-library.org/news/sec…) was disclosed recently, which was found by OSS-Fuzz-Gen! This is a pretty proud example of our team showing the promise of leveraging LLMs enable more fuzzing coverage.
23
122
46,786
OSV support announced in the latest Ubuntu 24.10 release!
This year has seen OSV adoption from many Linux distributions, and the OSV.dev database is starting to become a really comprehensive source of accurate vuln info across major open source ecosystems!
Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮
Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀
Read more: ubuntu.com/blog/canonical-re…
#Ubuntu #Linux #OracularOriole
3
6
1,744
Oliver Chang retweeted
Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮
Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀
Read more: ubuntu.com/blog/canonical-re…
#Ubuntu #Linux #OracularOriole
27
209
1,080
44,049
One week later the bug count is now at 25 bugs total (github.com/google/oss-fuzz-g…)
There's still many improvements to be made to improve success rate of generated targets, but we now have the problem of too many crashes to triage. Automating this will a focus of our future research.
This week we've added another 8 trophies to OSS-Fuzz-Gen (for a total of 14)! These are vulnerabilities found by LLM-generated harnesses. The interesting bit here is many of these are in well-fuzzed projects with thousands of hours of fuzzing already.
github.com/google/oss-fuzz-g…
1
10
46
6,562
This week we've added another 8 trophies to OSS-Fuzz-Gen (for a total of 14)! These are vulnerabilities found by LLM-generated harnesses. The interesting bit here is many of these are in well-fuzzed projects with thousands of hours of fuzzing already.
github.com/google/oss-fuzz-g…
3
21
100
14,602
Second OSS-Fuzz blog post on fuzz harness generation for Java! blog.oss-fuzz.com/posts/intr…
We've been quiet for a while but have a few interesting posts coming in the pipeline about our research.
28
103
8,340