Web Application Vulnerability Repair Via Context-Aware Fault Localization and Directed Differential Fuzzing

Web applications handle sensitive data, yet exploitation of their vulnerabilities can cause significant losses due to their widespread use. While vulnerability detection techniques have become increasingly sophisticated, timely remediation remains challenging due to substantial manual effort requirements. Automated vulnerability repair has become increasingly mature, yet research targeting web applications remains limited due to challenges posed by dynamic languages like PHP, which powers 73.1 % of websites. Leveraging existing LLM-based repair work is non-trivial as these systems rely on specialized toolchains and readily available test suites that web applications rarely provide. We propose SlicePatch, a novel automated vulnerability repair framework for PHP web applications. SlicePatch leverages PoC-driven dynamic profiling to capture runtime program behavior and retain vulnerability-specific code paths in a context-aware manner. The isolated vulnerable code slices, distilled from the broader application codebase, guide LLMs to generate precise patches while cutting invocation cost. We pioneer directed differential fuzzing that helps validate and refine patch candidates iteratively without requiring test suites. Our extensive evaluation across 96 real-world vulnerabilities and $\mathbf{7}$ LLMs shows that SlicePatch attains a $\mathbf{9 4. 7 9 \%}$ repair success rate, significantly outperforming baselines by over $\mathbf{3 0 \%}$.