SRLabs

On a complex target the hardest fuzzing question comes before the first harness: what is actually worth fuzzing? We threat-model the attack surface, follow untrusted data to where it gets dangerous, and turn that into a ranked, shaped set of harnesses, wo

Coverage analysis is an essential step for a successful fuzzing campaign, to identify uncovered code regions and change the campaign to reach them.

A comparative study of Claude Fable 5, Claude Opus 4.6/4.8, GLM-5, Gemma4-26b, and Qwen3.6-35B-A3B on two production codebases.

Exploiting a parental control app leads to surveilling families around the globe.

We report results from a 16-week security audit of the OpenVPN 2.7 release canidate, sponsored by the Sovereign Tech Agency in cooperation with the Open Technology Fund. We found 18 issues, including one critical logic bug in a replay check, and we descri

We introduce CosmFuzz, a coverage-guided fuzzer for CosmWasm smart contracts, and show how invariant-based testing quickly exposes a real token-accounting bug in cw20-base.

We strolled through an enterprise AI assistant's backend, helped ourselves to full application takeover and access to every chat log, and had a Microsoft Entra ID dump for dessert - no prompt injection, no model tricks, no AI expertise required.

We analyze how LLM-assisted coding and LLM-generated vulnerability reports shift the bottleneck from discovery to verification, and why security outcomes depend on reachability, context, and impact rather than vulnerability counts.

We describe three previously unknown vulnerabilities enabling remote code execution (RCE) in versions 8, 9, and 10 of the widely used learning management system ILIAS.

Nils competed in the DEF CON 33 CTF finals, placing 8th while running attack-defense operations, participating in the LiveCTF, and publishing a write-up on exploiting a Jukebooox bug leading to a glibc leak and ROP chain.