The PHP interpreter, powering over 70% of web-sites on the internet, plays a crucial role in web development. Existing approaches to finding bugs in PHP primarily focus on detecting explicit security issues through crashes or sanitizer-based oracles, but fail to identify logic bugs that can silently lead to incorrect results. We observe that the introduction of Just-In-Time (JIT) compilation mode in PHP presents an opportunity for differential testing, as it provides an alternative implementation of the same language specification. We propose, ZendDiff, an automatic differential testing framework that effectively detects logic bugs in the PHP interpreter by comparing JIT and non-JIT execution results. Our differential testing incorporates three techniques: program state probing for fine-grained execution state comparison, JIT-aware program mutation to sufficiently exercise JIT functionality, and dual verification to handle non-deterministic behaviors in PHP programs. Our experimental results demonstrate that ZendDiffoutperforms the official test suite used in PHP’s continuous integration, achieving higher code coverage and executing more Zend opcodes. Through ablation studies, we validate the effectiveness of these techniques. To date, ZendDiffhas identified 51 previously unknown logic bugs in the PHP interpreter, with 37 already fixed and 3 confirmed by the PHP maintainers. ZendDiffhas been acknowledged by the PHP community and offers a practical tool for automatically discovering logic bugs in the PHP interpreter.

With the advancement of Internet of Things (IoT) technology, smart IoT systems have become integral to industrial production and daily life. However, they face significant security and privacy vulnerabilities from different aspects. To enhance the security mechanisms, “Meta Computing” techniques (also called “Network-as-a-Computer, NaaC”) integrate all available computing resources and support zero-trust environments. Traditional anomaly detection methods consider the correlation between two events, which can be bypassed by constructing fake events that indirectly influence target devices, leading to false negatives. To address this issue, behavior-context-based approaches struggle with the complexity and variability of behavior patterns, resulting in false positives due to their inability to tolerate slight differences in event sequences representing the same system behavior. In this paper, we propose an anomaly detection approach in smart IoT systems based on the contextual semantics of behavior graphs. Our method captures critical event semantics while tolerating variations in noncritical events to aggregate and summarize the behavior semantics. We cluster benign behaviors and use whether the testing behavior instance falls into the benign behavior clusters as the criterion for anomaly detection. Our experiment results show that our approach effectively differentiates between anomalous and benign behaviors, significantly reducing false positives and negatives compared to state-of-the-art methods.