Programming Language Standards and their impact on Memory Safety: C++, Rust and Python – A comparative study

Stack integrity for practical code-reuse attack defense

In recent years, code-reuse attacks (CRA) have become increasingly stealthy and destructive to modern software systems. However, existing control-flow integrity techniques mainly focus on control-flow paths and give limited consideration to the program’s overall execution state. To address this problem, we propose StackPatroller, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies. Specifically, StackPatroller monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse (including return-to-libc) and certain forward-edge attacks earlier—within user mode before any unintended system calls occur. Compared to previous approaches, StackPatroller leverages the program stack as a structured and predictable representation of execution state. This provides a reliable indicator for early anomaly detection during CRA and eliminates the need for specialized hardware support. To validate our approach, we implement a prototype of StackPatroller and evaluate it on representative real-world software samples. The evaluation results show that our prototype can effectively detect CRA with an average performance overhead of 7.8%.

Rust for Secure Backend Development: A Critical Review and Extended Vulnerability Comparison with Node.js and Django

The Rust programming language is widely credited with eliminating entire classes of memory-safety and concurrency vulnerabilities, but the security implications of adopting it in practice extend well beyond memory safety. This paper presents a critical review of prior work on Rust's security posture in industrial settings, and extends that analysis in a direction the original study did not cover: backend web development. We first assess the strengths and limitations of the existing vulnerability classification of Rust against C, C++, and Java under the SANS Top 25, OWASP Top 10, and the 19 Deadly Sins of Software Security frameworks, identifying gaps including limited empirical validation, a small interview sample, and the absence of a secure development lifecycle discussion. We then contribute an original comparison of Rust against Node.js and Django using the same three-level classification (Rare and Difficult, Safeguarded, Unprotected), supported by side-by-side code experiments for out-of-bounds writes (CWE-787), use-after-free (CWE-416), and race conditions (CWE-362). Our results indicate that Rust's compile-time guarantees dominate at the systems layer, while managed backend frameworks offer stronger built-in defenses at the application layer, suggesting that Rust adoption in web contexts requires complementary safeguards rather than reliance on language-level safety alone.

The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs

This work systematically generates syntactic variants of security-relevant code generation prompts and evaluates their impact on code security across multiple open LLMs and programming languages, identifying prompt syntax as a concrete security control surface and providing actionable guidance for reducing vulnerability risk in LLM-assisted development.

PMDangNull: Preventing use-After-Free for Persistent Memory Applications

Use-After-Free (UAF) remains one of the most critical security threats affecting C/C++ programs. Moreover, the cross-restart persistence semantics of persistent memory (PM) programming models significantly broaden the UAF attack surface. Existing DRAM-based protection schemes lack crash consistency guarantees, whereas existing PM-specific solution, which is based on ASan, suffers from high runtime overhead and offers incomplete protection against UAF. In this paper, we present PMDangNull, a collaborative compiler-allocator protection framework built atop LLVM. PMDangNull instruments protected applications with escape-tracking instructions via a compiler plugin, coordinating with its allocator runtime module to enforce pointer nullification upon deallocation. Experimental results under single-threaded execution with no compiler optimization demonstrate that, compared with the existing solution SafePM, PMDangNull reduces performance and space overheads by up to 62.46% and 41.83%, respectively, and successfully prevents all eight UAF exploits in our test suite.

Increasing the Precision of Static Code Analysis Using Large Language Models

Investigating Software Aging in LLM-Generated Software Systems across Generation-and-Execution Environments

It is found that functional correctness alone is insufficient to assess the operational reliability of LLM-generated software before deployment in continuously running environments, and aging trends can also emerge in manually developed implementations.