Email [email protected] GitHub zzjas x zzjas98 LinkedIn zijie-zhao Google Scholar Scholar

About me

I am Zijie Zhao, a final-year PhD candidate (expected graduation May 2027) in the PL/FM/SE group at University of Illinois Urbana-Champaign advised by Lingming Zhang.

I develop methods that combine LLM agents, fuzzing, and program analysis for scalable, automated vulnerability discovery and validation in foundational software such as compilers, operating system kernels, and web browsers. My work has uncovered hundreds of bugs, resulting in dozens of CVE assignments and $8,000 in bug bounties.

I obtained my bachelor's and master's degree in Computer Science at University of California San Diego.

Publication

AnyPoC: Universal Proof-of-Concept Test Generation for Scalable LLM-Based Bug Detection

Zijie Zhao, Chenyuan Yang, Weidong Wang, Yihan Yang, Ziqi Zhang, Lingming Zhang

arXiv 2026

arXiv Bugs Found GitHub

KNighter: Transforming Static Analysis with LLM-Synthesized Checkers

Chenyuan Yang, Zijie Zhao, Zichen Xie, Haoyu Li, Lingming Zhang

SOSP 2025

ACM DL GitHub

KernelGPT: Enhanced Kernel Fuzzing via Large Language Models

Chenyuan Yang, Zijie Zhao, Lingming Zhang

ASPLOS 2025

ACM DL GitHub

WaVe: a verifiably secure WebAssembly sandboxing runtime

Evan Johnson, Evan Laufer, Zijie Zhao, Dan Gohman, Shravan Narayan, Stefan Savage, Deian Stefan, Fraser Brown

IEEE S&P 2023 🏆 Distinguished Paper Award

IEEE GitHub

Industry Experience

May - Aug 2024, Feb - Aug 2025

Software Engineering Graduate Intern

  • Built MoveSmith, a generation-based, coverage-guided fuzzer for the Aptos Move compiler and VM.
  • Designed a modular program generator that encodes Move language constraints such as ability, borrow, and lifetime rules, and runs incremental static analysis during generation to produce valid test programs.
  • Developed an LLM-based Move program generator to test emerging Move language features.
  • To date, MoveSmith has found 50+ bugs in both the compiler and the VM.

GitHub

June - Sept 2019

Software Engineer Intern

  • Used React.js, MobX.js, and Bootstrap to build complex web-based financial applications.
  • Maintained existing server-rendered applications built by Ruby on Rails.
  • Reduced page loading time from 18s to 2s and data saving time from 100s to 15s.
  • Optimized over 2400 SQL queries into 600 queries.

Teaching Experience

  • UIUC CS 527: Topics in Software Engineering
  • UIUC CS 427: Software Engineering I
  • UCSD CSE 127: Intro to Computer Security
  • UCSD CSE 21: Mathematics for Algorithms and Systems
  • UCSD CSE 12: Basic Data Structures and OOD
  • UCSD CSE 11: Introduction to Java

Selected Bugs

A selection of bugs that my work found:

  • Firefox
    • CVE-2026-12292 ($3,000 bug bounty granted)
    • CVE-2026-12305
    • CVE-2026-12291 ($4,000 bug bounty granted)
    • CVE-2026-2806
    • CVE-2020-26960 ($1,000 bug bounty granted)
  • Linux kernel
    • CVE-2024-23851, CVE-2023-52429, CVE-2024-23848, CVE-2024-23850, CVE-2024-25739, CVE-2024-23849, CVE-2024-25740, CVE-2024-26655, CVE-2024-25741, CVE-2024-43825, CVE-2024-50103
  • OpenSSL
    • CVE-2026-35188