Vulnerability-Research on CuraSec

GraftyVul: Vulnerability Grafting System for Reproducible Exploit Datasets

Mon, 31 Aug 2026 19:07:02 +0000

Engineer — Learn: Useful for engineers evaluating or building SAST/vulnerability-detection tooling — GraftyVul’s reproducible, exploit-verified benchmark across five languages and 23 CWE categories offers a more realistic test corpus than most existing datasets.
SOC/IR — Skip
Leader — Skip

Mon, 17 Aug 2026 13:03:16 +0000

Engineer — Learn: The paper demonstrates that standard TLS primitives in OpenSSL and BoringSSL can be composed into an authentication bypass — a novel vulnerability class worth understanding for future TLS configuration and library choices. No CVE, no patch, and no KEV/EPSS signals mean no immediate action on running systems today.
SOC/IR — Learn: The research shows how TLS handshake state can be weaponized without triggering conventional signature-based detection, which has long-term implications for anomalous handshake detection; however, no IOCs, no active exploitation, and no ATT&CK mappings make this a future reference rather than a hunt trigger now.
Leader — Skip

Mon, 10 Aug 2026 13:39:41 +0000

Engineer — Learn: Research introduces a scalable method for generating validated C/C++ vulnerability training corpora that outperforms CVE-data augmentation; worth tracking as it may influence the next generation of AI-assisted SAST and patch-suggestion tools, but no change to running systems today.
SOC/IR — Skip
Leader — Skip

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Learn: AI-driven autonomous vuln discovery at scale signals that OSS dependency risk will accelerate; no specific CVEs or patches to act on now, but worth tracking whether any findings surface in packages you run.
SOC/IR — Skip
Leader — Learn: This research signals a coming wave of AI-generated vulnerability disclosures in OSS; worth factoring into board conversations about supply-chain risk and budget for SCA tooling investment.

Thu, 23 Jul 2026 12:47:45 +0000

Engineer — Skip
SOC/IR — Skip
Leader — Learn: GitHub’s restructuring signals a broader shift toward tiered, invite-only vulnerability research programs; useful benchmarking context if your organization runs or is considering a bug bounty program, but no immediate action required.

Tue, 21 Jul 2026 12:43:35 +0000

Engineer — Learn: An open-source AI agent orchestration tool aimed at automated code vulnerability discovery — worth evaluating for AppSec pipelines, but no exploitation pressure or immediate action required.
SOC/IR — Skip
Leader — Skip

Tue, 21 Jul 2026 12:43:35 +0000

Engineer — Learn: A high-signal HN discussion (267 points) on the structural dysfunction in vuln research is worth reading to calibrate how much weight to give CVE feeds and vendor advisories.
SOC/IR — Skip
Leader — Learn: Industry critique of vulnerability research incentives is relevant background for evaluating how your team prioritizes CVE-driven work and what that means for your risk posture.

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Learn: A dense research compilation covering Android preinstalled-app attack surface (IPC abuse, content provider exposure, etc.); worth reviewing if mobile or Android MDM is in scope, but no exploitation signals and no patch action available today.
SOC/IR — Skip
Leader — Skip

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Plan: curl (and libcurl) is present in virtually every Linux system, container image, and language runtime, making any disclosed vulnerability worth tracking; review your deployed curl versions and schedule a patch once the fix is available, but no exploitation signals exist to force emergency action.
SOC/IR — Learn: No IOCs, no exploitation, and no detection surface are present in this disclosure; the more notable angle is that an AI-assisted analysis tool surfaced a real bug in a ubiquitous open-source library, which is worth tracking as a signal of where automated vuln discovery is heading.
Leader — Skip

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Learn: Demonstrates AI-assisted static analysis surfacing a long-latent Linux kernel bug; follow the linked write-up to identify the affected component and check whether your kernel version is patched, but no KEV listing or exploitation signals justify immediate action.
SOC/IR — Learn: No IOCs, TTPs, or active exploitation described; interesting for understanding AI-driven bug discovery workflows but yields no detection or hunt work today.
Leader — Skip

Tue, 14 Jul 2026 12:08:08 +0000

Engineer — Learn: LLM-assisted vulnerability discovery is reaching the Linux kernel’s upstream review process; worth understanding how AI-generated security reports may reshape how CVEs get identified and patched in open-source dependencies you pull in.
SOC/IR — Skip
Leader — Learn: AI tooling is beginning to influence upstream open-source security maintenance at scale; useful context for future board discussions on AI-assisted security investment and supply-chain risk.

Mon, 13 Jul 2026 14:30:14 +0000

Engineer — Learn: Novel research showing an LLM-agentic pipeline that improves directed fuzzer crash-trigger rates by generating semantically aware seed corpora; worth evaluating if your team runs fuzzing campaigns against internal C/C++ codebases, but no immediate change to running systems is required.
SOC/IR — Skip
Leader — Skip

Mon, 13 Jul 2026 13:18:50 +0000

Engineer — Learn: Academic research on using LLM agent pipelines to automate vuln discovery and reproduction; no enrichment signals or active exploitation. Worth reading to understand where AI-assisted offensive tooling is heading and how to stress-test your own AppSec review process.
SOC/IR — Learn: No IOCs, TTPs, or active campaigns tied to this research. Understanding AI-accelerated exploitation as an emerging attacker capability is background knowledge for future threat modeling, but yields no detection work today.
Leader — Learn: This research signals that automated AI-driven vuln discovery is maturing, which is relevant for strategic conversations about AI threat landscape and investment in AppSec automation — but no immediate action or board-level event here.