Stefan Nagy

Super proud of the FuTURES³ Lab and everything we accomplished in 2025, and excited for what’s ahead in 2026! Check out our work at futures.cs.utah.edu. 😃

@mahal0z Congratulations @mahal0z!!

This Fall, I’m joining the University of Georgia as an Assistant Professor! I want to push on the fundamentals of software reverse engineering, from decompilation to how humans actually understand code. I’m looking for PhD students, collaborators, and sponsors. More below.

ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense arxiv.org/pdf/2603.02297

@zeshan_nobin Congrats @zeshan_nobin!

Thrilled to receive the Paller Cybersecurity Scholarship from SANS Technology Institute for the MSISE program! Cybersecurity is a field I truly admire and love working in. Grateful for the support and excited for what’s ahead!

Awesome to see @yeaseen_'s work on transpiler testing recognized by the Go2Hx dev community! #p-14532-research-paper-review-1" target="_blank" rel="nofollow noopener">community.haxe.org/t/go2hx-work-i… 😁 Interested in improving transpilers? Check out our fuzzer TeTRIS! Paper: futures.cs.utah.edu/papers/25ACSAC… Slides: futures.cs.utah.edu/papers/25ACSAC… Code: github.com/FuturesLab/TeT…

TeTRIS uncovered 16 translation bugs across real-world transpilers—12 of them completely new!

Transcompiler lost in translation? Let TeTRIS uncover all its syntax frustrations! Happy to share my @ACSAC_Conf paper w/ @snagycs: "TeTRIS: General-purpose Fuzzing for Translation Bugs in Source-to-Source Transpilers"! PDF:futures.cs.utah.edu/papers/25ACSAC… Code:github.com/FuturesLab/TeT…

Crashing calculators and CAD editors? GUIFuzz++ is finally here to help make them better! 🔥 Come see my undergraduate student @trowlett0's very first paper "GUIFuzz++" at #ASE25 this Wednesday. Also now integrated in AFL++! 😃 github.com/AFLplusplus/AF…

This is an excellent history of LLMs, doesn't miss seminal papers I know. Reminds you we're standing on the shoulders of giants, and giants are still being born today. gregorygundersen.com/blog/2025/10/0…

#FUZZING'26 CALL FOR PAPERS ────── ✨After 5 years, we will be again co-located with NDSS! 🔗 fuzzing-workshop.github.io 📅 11. Dec (Submission) //cc Marcel Böhme (@mboehme_; MPI-SWS), @RuijieMeng (CISPA), Rohan Padhye (@moarbugs; CMU), László Szekeres (@lszekeres; Google)

@PurdueECE Congrats @AmPaschal01!

#PurdueECE PhD student Paschal Amusuo is building safer software with Zero-Trust Dependencies and smarter code checks. He presented at ICSE 2025 and is a finalist for the 2025 Qualcomm Innovation Fellowship. bit.ly/amusuo-zero

Super psyched to unveil GUIFuzz++: our grey-box fuzzer for desktop GUI applications, led by FuTURES³ Lab undergraduate researchers Dillon Otto and @trowlett0. Coming soon to @ASE_conf'25! futures.cs.utah.edu/papers/25ASE.p… github.com/FuturesLab/GUI…

GUIFuzz++ is the first general-purpose fuzzer for desktop GUI software! Fuzzing by translating AFL++ random input into user interaction with GUIs, leading to the discovery of 23 new bugs! Paper: futures.cs.utah.edu/papers/25ASE.p… Source: github.com/FuturesLab/GUI… Go test some GUIs!

Fuzzing GUIs shouldn’t be harder than fuzzing files. That's why I am excited to share my first paper (w/ fellow undergrad Dillon Otto + @snagycs) "GUIFuzz++: Unleashing Grey-box Fuzzing on Desktop Graphical User Interfacing Applications" at #ASE25.

Curious about fuzzing but don't know where to start? I wrote my first blog post on how to choose your target, build an AFL++-compatible harness, and avoid common pitfalls. Check it out: gabe-sherman.github.io/2025-09-17-beg…

I really enjoyed @0xacb's blog post "Fuzzing the Web for Mysterious Bugs". A great read on creative fuzzing techniques and strange edge cases in web apps. Highly recommended: 0xacb.com/2022/11/21/rec…

Big drama today in the Tor community. Conrad Rockenhaus, a Tor operator based out of Michigan, United States, was arrested in 2020 after refusing to cooperate with the United States Federal Bureau of Investigation Rockenhaus, a disabled United States military veteran, ran the fastest Tor node in the United States. He was approached sometime in late 2019 when the FBI requested he allow them arbitrary access to his exit node and allow them to decrypt traffic. He denied their request. Subsequently, in February, 2020 his home was raided. He was arrested for violating the CFAA (Computer Fraud and Abuse Act). It was alleged that he was a disgruntled ex-employee causing problems at his former place of employment. Interestingly, to "help resolve the matter", law enforcement requested he decrypt his Tor exit node to prove his innocence (???). After he refused, he was held in a pre-trial detention cell for over 3 years. He was denied bail after law enforcement stated Mr. Rockenhaus used Linux to "access the dark web" and he was "not complying" and not allowing them access to this Tor exit node. After Mr. Rockenhaus' wife filed an official complaint, and Mr. Rockenhaus was miraculously released, he was raided by the United States Marshal Fugitive Task Force TWO TIMES(???). They took him out his home, threw him to the ground, beat him, smashed his windows, and threatened to murder his animals. They are still requesting Mr. Rockenhaus allow them to access his Tor exit node. Mr. Rockenhaus still has not granted them that privilege. All of this has been captured on home security camera footage. Additionally, his wife has released all court documents. See subsequent post for more information.

The new Screen Unknown Callers iOS feature asks callers to describe (and transcribes) why they're calling before you pick up. I'm curious to see if this decreases folks falling for phone scams as many don't know what a phone scam pretext looks like in transcribed writing either!

From Zero to QEMU: A journey into system emulation (slide deck) #slide=id.g357295fe39c_0_3" target="_blank" rel="nofollow noopener">docs.google.com/presentation/d… Credits Antonio Nappa #infosec #qemu