The dispersed node locations and complex topologies of edge networks, combined with
intricate dynamic microservice dependencies, render traditional centralized microservice …

Double-fetch bugs (or vulnerabilities) stem from in-kernel system call execution fetching the
same user data twice without proper data (re) sanitization, enabling TOCTTOU attacks and …

In-process isolation enforces the principle of least privilege for processes. With such
isolation, even if one part of the process is compromised, other parts within the same …

Browsers, Library OSes, and system emulators rely on sandboxes and in-process isolation
to emulate system resources and securely isolate untrusted components. All access to …

The endless stream of vulnerabilities urgently calls for principled mitigation to confine the
effect of exploitation. However, the monolithic architecture of commodity OS kernels, like the …

Large language models (LLMs) used across enterprises often use proprietary models and
operate on sensitive inputs and data. The wide range of attack vectors identified in prior …

Compartmentalization effectively prevents initial corruption from turning into a successful
attack. This paper presents O2C, a pioneering system designed to enforce OS kernel …

In the existing software development ecosystem, security issues introduced by third-party
code cannot be overlooked. Among these security concerns, memory access vulnerabilities …

Computer systems rely heavily on abstraction to manage the exponential growth of
complexity across hardware and software. Due to practical considerations of compatibility …

In today's digital landscape, software applications are susceptible to various threats arising
from vulnerabilities in unsafe programming languages (C, C++) and speculative out-of-order …