https://xitter.cf/t.co/bmyDmTlFKv Senior Staff Eng @ Google DeepMind. Former: founder of https://xitter.cf/t.co/K575lba4tt, lead/co-founder for OSS-Fuzz.
Sydney, Australia
Joined June 2016
- Tweets196
- Following147
- Followers1.9K
- Likes316
Oliver Chang retweeted
We derestricted a number of vulnerabilities found by Big Sleep in JavaScriptCore today: issuetracker.google.com/issu…
All of them were fixed in the iOS 26.1 (and equivalent) update last month. Definitely some cool bugs in there!
Oliver Chang retweeted
Software vulnerabilities can be notoriously time-consuming for developers to find and fix.
Today, we’re sharing details about CodeMender: our new AI agent that uses Gemini Deep Think to automatically patch critical software vulnerabilities. 🧵
Oliver Chang retweeted
🚀Inviting GSoC2025 contributors to supercharge OSS-Fuzz-Gen! Opportunities include:
1. Modularize OSS-Fuzz features
2. Enhance Experiment Execution & Report UI
3. Integrate Research Innovations
Interested? Send your resume to [email protected]😃
gist.github.com/dynamicwebpa…
Oliver Chang retweeted
cloud.google.com/blog/produc…
Awesome blog on how we’re using SLSA to make GKE more secure for our customers!
Oliver Chang retweeted
Today, we announced the official release of OSV-SCALIBR, Google's software composition analysis library. If you are working in vuln management / security scanning, SCALIBR is for you! SCALIBR is powering most of Google's vuln scanning. Please RT
security.googleblog.com/2025…
Oliver Chang retweeted
The OSS-Fuzz team is hiring a PhD intern for this summer. Come join us and build the future of fuzzing. Link in next tweet in thread. RTs appreciated!
Oliver Chang retweeted
The OSS-Fuzz team at @Google is using AI-powered fuzzing to find vulns in open-source software and recently reported 26 new vulns to open-source project maintainers, including one in the OpenSSL library which is critical to most internet infrastructure. security.googleblog.com/2024…
Oliver Chang retweeted
On the heels of @Google’s ‘Big Sleep’ AI discovery of a real-world vulnerability, our OSS-Fuzz team identified and reported 26 vulnerabilities to open-source project maintainers by using AI-generated and enhanced fuzz targets. Read more here: security.googleblog.com/2024…
Oliver Chang retweeted
Today, we proudly unveil Ubuntu 24.10, codenamed "Oracular Oriole" 🔮
Packed with GNOME 47, the Linux 6.11 kernel, permissions prompting, an enhanced command line, OpenVEX and OSV support, and a special #Ubuntu20Years anniversary gift - there’s plenty for you to explore 🚀
Read more: ubuntu.com/blog/canonical-re…
#Ubuntu #Linux #OracularOriole
Oliver Chang retweeted
Yesterday we announced that our security advisory feed was being now published following the OSV schema. This was a herculean job by @danluhring and @comedordexis.
Oliver Chang retweeted
The @DARPA #AIxCC will help design new #AI systems to secure major open source projects that our critical infrastructure relies upon. Learn how @Google's OSS-Fuzz can show opportunities where AI can help find and patch vulnerabilities for the challenge: security.googleblog.com/2024…
Oliver Chang retweeted
OSV.dev, the community vulnerability database aggregation service for open source crosses the 100k mark (115,054 vulns), thanks to the @openssf OSV schema (github.com/ossf/osv-schema) standardization across 24 language and distro ecosystems!
Oliver Chang retweeted
Announcing the general availability of the V3 deps.dev API (All your OSS transitive dependencies belong to you!). Lot of new features like batch support, purl support, querying capabilities for new things like name similarity, SLSA attestations, etc! Check it out at blog.deps.dev/api-v3/
Oliver Chang retweeted
A truly wonderful year for OSV. From OSV-Scanner, to widespread adoption of OSV schema (now 20+ ecosystems, 72K+ vulns aggregated), to NVD C/C++ support. Lots more to come in 2024, and esp excited about our automated remediation at scale!
So many exciting things happened for OSV in 2023! 8 new ecosystems onboard, C/C++ support, and a packed list of OSV-Scanner features! Huge thanks to our amazing community & contributors!
Looking forward to more exciting stuff coming in 2024! Check out osv.dev/blog/posts/2023-in-r…
Oliver Chang retweeted
License scanning is now part of community #OSV-Scanner, you can use it to find all the license problems in your dependency trees. Check it out at - osv.dev/blog/posts/introduci…
Oliver Chang retweeted
C/C++ dependencies remain a critical pillar of our open source supply chains, but tracking vulns in them has been difficult — until now! @Google's open source OSV database and OSV-Scanner are making it easier to find C/C++ vulns in your dependencies: osv.dev/blog/posts/introduci…
Oliver Chang retweeted
Excited to announce the big milestone on #OSV: We have now enriched 30K vulns from NVD CVE DB and added first-class support for C/C++ ecosystem inside OSV-Scanner. Check out osv.dev/blog/posts/introduci…! One-stop community DB and scanner for all your OSS vulnerability scanning needs!
Oliver Chang retweeted
Fuzzing is an important part of a comprehensive application security strategy. We've updated our "Application security orchestration with GitHub Advanced Security" blog post to include two tools for fuzzing, Google's ClusterFuzzLite and OWASP ZAP. ⬇️
github.blog/2023-03-08-appli…
Oliver Chang retweeted
Excited to share our next innovation in fuzzing: Using AI to break the bug hunting barrier - security.googleblog.com/2023…
