← 研踪 PaperTrailarXiv:2610.36334 · v1
PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority
首次提交 2026-10-27 06:03
版本更新 2026-10-27 06:03
雷达观测 2026-10-29 00:35
摘要
AI-assisted vulnerability discovery can produce technically plausible findings faster than maintainers can validate, coordinate, and safely disclose them. The resulting challenge is not only to establish whether a vulnerability claim is credible, but also to ensure that its supporting evidence, human authorization, intended recipients, and applicable policy remain bound to the same case revision. We present FedTrust-CVDv2, a federated coordinated vulnerability disclosure framework that separates evidence validation, interorganizational coordination, human governance, and permissioned auditing. The framework binds independently signed observations to exact evidence revisions and scopes external actions to approved payloads, audiences, expiry, policy, and revocation state while preserving existing CVE Numbering Authority (CNA) roles. A local reference implementation accepted all 25 valid fixtures and rejected all 650 invalid fixtures across 27 constructed policy families; six single-safeguard ablations admitted 25-75 invalid fixtures. Supporting experiments exercised signed messaging, authenticated encryption, audit certificates, and finite quorum-set conditions. A PHP2Shell case formulation illustrates how runtime evidence, patch state, emergency coordination, and CNA authority can be represented without attributing unsupported claims to AI or treating audit integrity as vulnerability truth. This short version focuses on the architecture, evidence-to-action contract, selected conformance results, and case formulation. An expanded version containing the full implementation, extended experiments, operational analysis, and additional results will be submitted to a journal.
作者备注：7 pages, 4 figures, 2 tables
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-10-27 06:03 · 最新观测版本
PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority
AI-assisted vulnerability discovery can produce technically plausible findings faster than maintainers can validate, coordinate, and safely disclose them. The resulting challenge is not only to establish whether a vulnerability claim is credible, but also to ensure that its supporting evidence, human authorization, intended recipients, and applicable policy remain bound to the same case revision. We present FedTrust-CVDv2, a federated coordinated vulnerability disclosure framework that separates evidence validation, interorganizational coordination, human governance, and permissioned auditing. The framework binds independently signed observations to exact evidence revisions and scopes external actions to approved payloads, audiences, expiry, policy, and revocation state while preserving existing CVE Numbering Authority (CNA) roles. A local reference implementation accepted all 25 valid fixtures and rejected all 650 invalid fixtures across 27 constructed policy families; six single-safeguard ablations admitted 25-75 invalid fixtures. Supporting experiments exercised signed messaging, authenticated encryption, audit certificates, and finite quorum-set conditions. A PHP2Shell case formulation illustrates how runtime evidence, patch state, emergency coordination, and CNA authority can be represented without attributing unsupported claims to AI or treating audit integrity as vulnerability truth. This short version focuses on the architecture, evidence-to-action contract, selected conformance results, and case formulation. An expanded version containing the full implementation, extended experiments, operational analysis, and additional results will be submitted to a journal.
查看此版本解读 →查看此版本原文 ↗