Fuzzing the PHP Interpreter via Dataflow Fusion

Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland H. C. Yap, Zhenkai Liang

34th USENIX Security Symposium · Day 1

This article delves into FlowFusion, a groundbreaking automatic fuzzing framework designed to uncover memory errors within the PHP interpreter. Developed by a team from the National University of Singapore, FlowFusion represents the first tailored approach to specifically target these critical vulnerabilities in PHP's underlying C codebase, an area largely overlooked by prior security research. Given PHP's pervasive role, powering over 70% of websites globally, the security of its interpreter is paramount to the confidentiality, integrity, and availability of countless web services.

AI review

Solid fuzzing research with real results: 158 bugs, 125 fixed, a 20-year-old UAF, and adoption into the official PHP toolchain. The dataflow fusion technique is genuinely clever—not revolutionary, but a well-engineered approach to semantic test generation that actually works. This is the kind of research that moves the needle.