Gaetano's paper on Scaling Security Testing by Adressing the Reachability Gap has been accepted at #ICSE26! 📝 gpsapia.github.io/files/ICSE_2... 🧑‍💻 github.com/GPSapia/Reac... How to scale automatic security testing to arbitrary systems?

#FUZZING'26 CALL FOR PAPERS ────── ✨ After 5 years, we will be again co-located with NDSS! 🔗 fuzzing-workshop.github.io 📅 11. Dec (Submission) //cc @mboehme.bsky.social (MPI-SP), @ruijiemeng.bsky.social (CISPA), @rohan.padhye.org (CMU), László Szekeres (Google)

Podcast! Had a fun conversation with @cachemisses.bsky.social on an episode of *Disseminate*. Check it out!

Excited to announce that the Fray paper has been accepted to OOPSLA'25! Work led by @aoli.al with a full pastalab.org collaboration. 📄: rohan.padhye.org/files/fray-o... 💻: github.com/cmu-pasta/fray 🎥: www.youtube.com/watch?v=AX6P...

Debating whether we can add acks "We thank Reviewers A and C for their constructive feedback on our paper".

🚨 Our amazing #FUZZING'25 keynotes are online! "Constraining Fuzzing without Paying Too Much" by Miryung Kim youtu.be/L90MBb6NLBE "Are you sure you belong in academia?" by Will Wilson youtu.be/qQGuQ_4V6WI // @mboehme.bsky.social, László Szekeres, @rohan.padhye.org, @ruijiemeng.bsky.social

Very cool: ‪@aoli.al‬ uncovered a deadlock in OpenJDK that can be triggered with a tiny test case and Fray's deterministic concurrency testing & debugging support. Read his blog post here: aoli.al/blogs/jdk-bug/ If you write Java/Scala/Kotlin, try Fray yourself: github.com/cmu-pasta/fray

Just Accepted to ACM TOSEM! The "Havoc Paradox" is about the relationship between byte-level fuzzer mutations and their effect on the inputs produced by generators for structured strings (e.g. XML/SQL). Can disruptive mutations be controlled? Should they be? Find out. 📄 dl.acm.org/doi/pdf/10.1...

🖊️ Register here: ntnu.eventsair.com/fse2025-isst... (FUZZING is a co-located workshop)

We're excited to announce two keynote speakers for the #FUZZING'25 workshop (part of @issta_conf at Trondheim, Norway): [*] Will Wilson, CEO and Co-Founder of Antithesis [*] Miryung Kim, Professor and Vice Chair of Graduate Studies at UCLA conf.researchr.org/home/issta-2...

The JQF repo is now both popular enough (700+ stars) and contains enough buggy/vulnerable code as sample fuzz targets that we're getting occasionally spammed with crappy AI-generated patches. I can't imagine what bigger OSS projects are dealing with right now.

Delighted to receive an ACM SIGSOFT Distinguished Award for this work... It's about time! Proud of the PASTA Lab students, including our visiting undergrads :-)

Love this argument: prior work does not use our novel idea.

Submission deadline for the Fuzzing workshop is tonight (AoE)! Send us those nuggets and research ideas. Rohan

Happy Daylight Savings Time to everyone in the US! A few more weeks for European Summer Time. If you notice some of your apps glitching, don't be alarmed. Even ChatGPT can't write correct date/time code!!! See more in our upcoming paper: rohan.padhye.org/files/dateti... (MSR'25 preprint)

I'm super excited about this new track at the #FUZZING'25 workshop. It's the academic version of thoughtful blog posts, but with a paper and talk for wider reach! Submission deadline is in a month (March 20th)! fuzzingworkshop.github.io

#FUZZING'25 CALL FOR PAPERS ────── ✨ New OC members: * Ruijie Meng (@ruijiemeng.bsky.social; NUS) * Rohan Padhye (@rohan.padhye.org; CMU). ✨ New paper type: Fuzzing Nuggets (short papers). 🔗 fuzzingworkshop.github.io 📅 20.March (Submission) 📅 17.April (Notification) 📅 28.June (Workshop)

Back to basics: Concurrency testing in Java! Our new tool *Fray* correctly solves a 25+ year old problem for real-world software. See this feature from Elastic Labs about Fray's contributions to Lucene. 📰: www.elastic.co/search-labs/... 🔧: github.com/cmu-pasta/fray 📝: arxiv.org/pdf/2501.12618

How do you know whether random testing is working as expected? [1/3] Long ago in JQF, we used `assumeTrue` to bias fuzzing towards *valid* inputs. This is powerful, but the abstraction is quite coarse if you have many properties. (Refs: github.com/rohanpadhye/..., rohan.padhye.org/files/zest-i...)

And now that we’re all here, some work!🚨 Are Large Language Models Memorizing Bug Benchmarks? 🚨 There’s growing concern that LLMs for SE are prone to data leakage, but no one has quantified it... until now. 🕵️‍♂️ 1/

Alright, I'm here!