Fuzzing learning path

Orientation and first principles — what the bug class is and how it behaves.

1. GPT-5.5-Cyber built a zlib fuzzing lab in a day
   5 min readblog.trailofbits.com2026
   Tool that demonstrates GPT-5.5-Cyber's capability to autonomously construct a zlib fuzzing lab within a single day, including writing harnesses for multiple entrypoints like inflate and uncompress2, leveraging ASan/UBSan builds, and repurposing edge-case tests for seeds, surpassing typical OSS-Fuzz coverage by targeting valid states and using OS backpressure.
2. Web fuzzing for hackers
   17 min readintigriti.com2026
   Library for web fuzzing techniques, detailing its importance for discovering unreferenced API endpoints, unexpected behavior, and security vulnerabilities. It emphasizes the criticality of crafting specific wordlists and outlines popular tools like ffuf, Burp Suite Intruder, OWASP Amass, Arjun, and Param Miner for various fuzzing objectives, including content discovery, subdomain bruteforcing, and parameter discovery.
3. Bringing Fuzz Testing to Kotlin with kotlinx.fuzz
   7 min readblog.jetbrains.com2026
   Library for fuzz testing Kotlin applications. Developed by JetBrains Research, this fuzzer, named kotlinx.fuzz, leverages existing Java fuzzers like Jazzer to identify edge cases and uncover hidden vulnerabilities by automatically generating random or invalid inputs for target functions such as `Duration.parseIsoStringOrNull`. It simplifies the fuzzing process, offering improved configuration, execution, and result analysis for Kotlin projects.
4. Fuzzing | Testing Handbook - AppSec Guide
   8 min readappsec.guide2026
   Handbook chapter detailing fuzzing as an essential dynamic testing method for uncovering security issues and bugs. It covers starting fuzzing projects quickly, delving into advanced techniques, and selecting appropriate fuzzers. The handbook explains how to write fuzzing harnesses, interpret their outputs, and apply them to real-world C/C++ projects, discussing both blackbox and feedback-driven graybox fuzzing approaches. It also explores mutation-based evolutionary fuzzing, the de facto algorithm, and defines key terminology such as SUT, fuzzer, harness, and corpus.
5. The Fuzzing Book: Generating Software Tests
   6 min readfuzzingbook.org2026
   Library of practical examples and executable code, "The Fuzzing Book" teaches automated software testing techniques. It covers random fuzzing, mutation-based fuzzing, and grammar-based test generation, illustrated with Python code. The resource is suitable for university courses, supplementary material, or as a developer tool, and has been credited with finding over 2,600 bugs in JavaScript interpreters for browsers like Firefox, Chrome, and Edge.

Real testing methodology, tooling, and writeups that show the work.

1. WinPE as a stateless harness for Windows driver testing and fuzzing
   6 min readbednars.me2026
   Library for transforming Windows PE into an idempotent testing environment. This library details low-level mechanisms including BCD and QEMU modifications for faster VM spins, enabling kernel-mode driver testing and fuzzing. It covers aggressive boot optimizations with `bcdedit`, disabling VBS/HVCI via `hypervisorlaunchtype off` and `testsigning yes`, utilizing the older `pc` QEMU machine profile for stability, configuring KDNET with `busparams`, and customizing the boot process by disabling NDIS initialization and replacing `cmd.exe` with a custom test agent in `winpeshl.ini`.
2. Sparkplug B Protocol Fuzzing with AI Assistance
   9 min readbishopfox.com2026
   Tool for fuzzing the Sparkplug B protocol, an MQTT-based standard for industrial control systems. This fuzzer systematically targets message types, data types, and field paths, identifying crashes, protocol violations, and state-handling bugs. AI assistance refined the Python implementation, improving coverage, efficiency, and adding CLI functionality for security testing of ICS and SCADA devices.
3. On the Effectiveness of Mutational Grammar Fuzzing
   8 min readprojectzero.google2026
   Technique analyzing the flaws of mutational grammar fuzzing, particularly how increased coverage doesn't always equate to more bugs and how samples tend to remain highly similar. It highlights issues found in XSLT implementations and JIT engines, suggesting potential improvements by exploring dataflow coverage or combining generative and mutational fuzzing approaches.
4. Go fuzzing was missing half the toolkit. We forked the toolchain to fix it.
   5 min readblog.trailofbits.com2026
   Library, gosentry, is a fork of the Go toolchain that enhances native fuzzing capabilities. It integrates LibAFL, Nautilus for grammar-based fuzzing, and capabilities for structured inputs, integer overflow detection (building on go-panikint), goroutine leak detection (via goleak), data race detection, and timeout detection. Existing Go fuzz harnesses can be used with gosentry without modification, offering improved bug detection and coverage reporting for vulnerabilities like those found in Optimism and Revm.
5. AFL - American Fuzzy Lop: A Security-Oriented Fuzzer
   13 min readgithub.com2026
   Library for security-oriented fuzzing, American Fuzzy Lop (AFL) employs an instrumentation-guided genetic algorithm to identify vulnerabilities. It leverages modified edge coverage to detect program control flow changes and uses an input queue that grows as new states are discovered. AFL supports both compile-time instrumentation for source code availability and experimental binary instrumentation via QEMU user-space emulation for black-box targets. The tool generates a corpus of interesting test cases useful for other testing regimes and offers options for hardening and heap corruption detection.

Novel research, edge cases, and the techniques that push the class forward.

1. Autonomous fuzzing process under LLM supervision
   20 min readcert.pl2026
   Library for autonomous fuzzing, codenamed fuzzlab, utilizes Large Language Models (LLMs) under strict procedural guidance to automate software security testing. This Python-based system analyzes code, generates test programs, classifies findings, and prepares reports. It has successfully identified vulnerabilities in ModSecurity and Oracle VirtualBox, demonstrating its capability to supervise fuzzing campaigns, adapt to anomalies, and improve test generation without constant human intervention, supporting various AI models through a standardized interface.
2. Advanced binary fuzzing using AFL++-QEMU and libprotobuf
   20 min readairbus-seclab.github.io2026
   Tool for advanced binary-only fuzzing utilizing AFL++-QEMU, focusing on grammar-aware in-memory persistent fuzzing. This practical guide demonstrates step-by-step configuration, including instrumentation tuning for specific code paths and optimizing execution speed, using a case study of a weak X509 parser with a buffer overflow vulnerability in `parse_cert_buf`. It details corpus preparation with `afl-cmin` and `afl-tmin`, and explores AFL++-QEMU features like `AFL_CUSTOM_MUTATOR_LIBRARY` and persistent mode addresses for performance enhancements.
3. LLM-Based Harness Synthesis for Unfuzzed Projects
   11 min readblog.oss-fuzz.com2026
   Library for LLM-based fuzzing harness synthesis that automates the creation of OSS-Fuzz and ClusterFuzzLite projects for C/C++ software. It takes a GitHub repository URL as input and generates fuzzing harnesses by first building the project using generalized build heuristics, then extracting program analysis data with Fuzz Introspector, and finally synthesizing harnesses with LLMs based on that data. The process has demonstrated coverage increases and vulnerability discovery in prior work.
4. Bugs That Survive Continuous Fuzzing
   15 min readgithub.blog2026
   Library detailing vulnerabilities that persist despite continuous fuzzing in open-source projects like Gstreamer, Poppler, and Exiv2. It highlights issues arising from insufficient code coverage, unmonitored dependencies (e.g., DjVuLibre in Poppler), and neglected encoding logic, demonstrating the ongoing need for human oversight and expertise beyond automated fuzzing initiatives like OSS-Fuzz.
5. MALF: A Multi-Agent LLM Framework for Intelligent Fuzzing
   43 min readarxiv.org2026
   Framework MALF integrates multi-agent large language models for intelligent fuzzing of industrial control protocols like Modbus/TCP, S7Comm, and Ethernet/IP. It utilizes Retrieval-Augmented Generation and QLoRA fine-tuning for protocol-aware input generation, optimizing seed selection, mutation strategies, and feedback loops. In real-world ICS environments, MALF identified critical vulnerabilities, including zero-days registered by CNVD, surpassing traditional fuzzing methods with higher test case pass rates and improved exception trigger generation.
6. AI-based fuzzing targets open-source LLM vulnerabilities
   6 min readreversinglabs.com2026
   Library that utilizes AI-enhanced fuzzing to discover vulnerabilities in open-source projects. This technique has already identified 26 new vulnerabilities, including a critical flaw in OpenSSL, by generating sophisticated and varied test inputs that explore new execution paths and uncover edge cases missed by traditional methods. The library aims to improve code coverage, increase efficiency, and automate vulnerability discovery, though users must be aware of potential drawbacks like false positives and the need for careful validation of AI-generated code.
7. deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses
   50 min readarxiv.org2026
   Tool integrating static analysis and LLM-guided fuzzing to detect memory safety vulnerabilities in Rust's unsafe code. deepSURF handles generics by substituting them with custom types and LLM-augmented harnesses for complex API interactions. Evaluation on 27 Rust crates revealed 20 known and 6 previously unknown memory safety bugs, surpassing state-of-the-art tools.
8. KernelGPT: Enhanced Kernel Fuzzing via LLMs
   4 min readgithub.com2026
   Library for enhanced Linux kernel fuzzing using Large Language Models to automate Syzkaller specification generation and refinement. KernelGPT analyzes kernel source code, leverages LLMs for specification creation, and uses feedback for iterative improvement. This approach has successfully identified 24 new kernel bugs, including 11 with assigned CVEs, and many of its generated specifications have been integrated into the official Syzkaller repository.