VULNHALLA: PICKING THE TRUE VULNERABILITIES FROM THE CODEQL HAYSTACK

Summary from the TLDR InfoSec newsletter

Modern vulnerability research can blend static analysis with large language models to cut through overwhelming false positives and highlight only issues that look genuinely exploitable. By feeding CodeQL findings and carefully chosen code context into an LLM, and then guiding it with structured questions about data and control flow, the system mimics how senior researchers reason about real bugs rather than surface patterns. Pre-extracting functions and related entities into fast-searchable CSVs makes this scalable across huge C and C++ codebases, enabling discovery of impactful issues and even new CVEs with modest time and compute.