TALKS & SPEAKERS

Abstract

2026 has been the year of AI for vulnerability research. Within a period of a few months, frontier models such like Mythos and the likes have changed the entire research community and its experts’ outlook on computer security. The AI is simultaneously a security expert in firmware, kernels, browsers, web applications, cryptography, network security, reverse engineering … and has the patience to happily audit 1,000,000+ lines of Reactive Java SpringBoot code without needing drugs or mental therapy. How are we suppose to co-exist with it in this new world? In this keynote, we will share our experiences in using AI for vulnerability research and discuss its strengths and limitations. We will also discuss how the industry may need to rethink and change its approaches disclosure, detection/response, and software updates.

Abstract

The AI boom has made GPUs one of the most critical resources in modern cloud infrastructure. From training and fine-tuning to large-scale inference, AI workloads increasingly depend on cloud-hosted GPUs, making them a foundational component of today’s computing ecosystem.

While GPU security research is well established in the mobile world, where GPU driver vulnerabilities have repeatedly enabled privilege escalation, discrete GPUs powering cloud environments have received far less attention. This raises an important question: can cloud GPUs introduce security risks beyond those traditionally seen on mobile platforms?

To answer this, we analyzed the GPU driver stacks of two major GPU vendors, which together power virtually all cloud GPU deployments. Our research shows that the impact of cloud GPU vulnerabilities can be significantly more severe than mobile privilege-escalation bugs. In GPU-enabled cloud environments, host GPU devices are routinely exposed to untrusted containers running AI workloads. Because GPU drivers operate in the kernel, vulnerabilities within them can provide powerful exploitation primitives that lead directly to full container escape.

Abstract

The Windows Console Driver is a small kernel driver that acts as the link between console applications and the process hosting their windows. Since its introduction in Windows 8.1, its attack surface has been overlooked. This talk aims to fix this by presenting a simple bug leading to privilege escalation, and more surprisingly, escape from one of the most hardened sandboxes in Windows.

In this session, we will first give a quick overview of the console architecture on Windows and the role played by the Console Driver. We will then introduce the vulnerability and the challenges we faced during its exploitation, notably winning a very precise race condition and transforming a limited write primitive into a SYSTEM shell.

Afterwards, we will explore the different sandbox mechanisms implemented in Windows and demonstrate how this bug is reachable from heavily restricted contexts, allowing us to escape the LPAC sandbox by adapting our exploitation primitives to work in those constraints.

Abstract

Shortly after GTIG and iVerify released blogposts on the Coruna exploit kit I obtained access to a sample. The next couple weeks felt like the good old days, staying up late with friends to defeat obfuscation, reverse the chains and finally build up RCAs of the bugs. This talk will feature some of that analysis as well as takeaways from it.

Abstract

Page-cache corruption bugs are unusual because they can turn read access into the ability to modify the in-memory contents of file-backed pages, enabling local privilege escalation without changing data on disk. After Dirty COW, Dirty Pipe, Copy Fail, and Dirty Frag, most variant hunting focused on straightforward syntactic copies of known paths. This talk shows how a semantic variant-hunting workflow produced three new unprivileged root exploits: skb_shift and GRO flag loss (common CVE-2026-43503) — which bypass both existing patches — and the flagship, Dirty Pedit (CVE-2026-46331), a previously unknown route to deterministic root in under one second via Linux traffic control.

Our approach decomposes the entire Dirty COW to Dirty Frag exploitation chain into three independently queryable stages: Entry, Violated Invariant, and Writer. To make this work at scale, we built QuerySmith (tells you what’s valid, not just what’s wrong) and QueryLens (tells you exactly which predicate is failing). Together they enabled a focused campaign of 16 targeted CodeQL queries across the kernel, producing three unprivileged root exploits. The flagship, Dirty Pedit, required wiring results from queries targeting independent stages: one identified a novel arithmetic mismatch between skb_ensure_writable() and tcf_pedit_act() — a signed-to-unsigned wraparound creating a COW gap — while another surfaced tcf_pedit_act as a novel writer primitive: a direct 4-byte page-cache write via skb_store_bits, independent of any crypto subsystem which is a known writer primitive in the dirty series. Separately, they’re curiosities. Together, they’re root in under one second.

Beyond the exploit itself, the talk gives attendees a practical method for semantic variant hunting: decompose exploit chains into queryable stages, use deterministic feedback to debug query behavior, and intersect independently interesting results to uncover exploitable paths that syntactic searches miss. All findings were responsibly disclosed and patches have merged upstream. The talk concludes with a live or recorded demo.

Abstract

Semaphores, mutexes, and other synchronization primitives are designed to prevent race conditions. Used improperly, they can instead let subtle vulnerabilities slip through the cracks. Race conditions are notoriously difficult to land, but what if the very constructs meant to protect a program could be turned against it, letting an attacker consistently win the race?

In this presentation, we will explore a previously unpublished exploit chain targeting NVIDIA Linux Open GPU Kernel Modules, resulting in local privilege escalation and container escape. Beyond attacking insufficient synchronization, we will turn these synchronization primitives against the software they were designed to protect and achieve dependable kernel code execution.

We begin with a timing-based side-channel attack on a buggy GPU semaphore interface. Leveraging an Out-of-Bounds read, we will leak kernel memory, bit-by-bit. Next, we will target a Time-Of-Check to Time-Of-Use vulnerability, caused by faulty use of a readers-write lock. This bug manifests as a Use-After-Free, with an unconscionably tight reclaim window measured at merely a couple hundred CPU ticks. Furthermore, losing the race triggers a kernel panic and system reboot, neutralizing a probabilistic “spray and pray” approach.

With help from a few million hash collisions and a well-timed heap spray, we will count on our Double Agents to turn this pipe dream of a race condition into a reliable exploit (which will be demonstrated!). Experience a race that can’t be lost as we escape the NVIDIA Container Toolkit.

Abstract

Linux Page caches save you the hassle of going to your storage device every time you need to access a file.  Unfortunately, we live in a society that doesn’t let us regular people modify most of those, leaving us with read-only access to files that we ourselves have opened,  in our own process! Sometimes even mapped into our own process memory space!
Fortunately, some recent developments have given us a few ways to circumvent this injustice, supplying the people with some page cache corruption vulnerabilities such as Copy Fail and its several siblings.
In our talk, we will focus on a more distant cousin of this pattern, targeting the RDMA subsystem of Linux, which is usually available in the kinds of multi-GPU systems which may most benefit from a bit of extra democracy. During this session, we will go over the generalized flaw which might lead to this kind of vulnerability, some internals of RDMA on Linux, and the actual vulnerability and 100% reliable LPE exploit we developed for it.

Abstract

Samsung’s Dual Data-at-Rest (DDAR) encryption is a Knox kernel component, absent from mainline Android. It wraps sensitive files in a second encryption layer above Android’s file-based encryption so the most sensitive data stays sealed. To do this, its /dev/dd driver hands each crypto request’s metadata page to a userspace crypto task through a shared mapping and performs encryption and key handling there. However, this also opens a new attack surface across Samsung’s flagship Galaxy S and Z series.

In this talk, I show that the DDAR subsystem introduces two vulnerabilities that together allow rooting every recent flagship Galaxy S and Z device. The first is an improper access-control flaw: a sandbox escape that injects code from an untrusted_app context into the privileged dualdard system daemon. The second is a mapping-lifetime bug that hands userspace read/write access to physical memory the kernel has already freed.

I present the complete chain from a zero-permission app to root on a late-August-updated Galaxy S26 (kernel 6.12.38) and S26 Ultra (kernel 6.12.30), both on Android 16 with verified boot and a locked bootloader. I developed it almost blind, with only a Magisk-rooted S23 (Android 14, kernel 5.15.148) as a debuggable testbed. The strategy is highly reliable and portable: moving between the S23 and both S26 variants took little more than adapting offsets and data-structure differences that can be pre-computed per firmware. I further confirmed from the released sources that the same vulnerable code ships unchanged on the Galaxy S23 through S26 and Z Fold7, so a single weaponized chain could cover them all. Along the way, the chain yields new insight into defeating hardened defenses such as SELinux as well as Samsung’s RKP and DEFEX.

Abstract

In the age of AI,

… finding renderer bugs with LLMs? Easy!
… turning them into a working RCE exploit? Doable: just burn enough tokens.
… completing a full sandbox escape? Maybe Mythos or even stronger models could do that.

But where’s the fun in easy? Let’s go for a hardcore run instead: crafting a browser full chain without any memory corruption bugs and, to make the game even harder, choosing not to use AI at all — sounds crazy, right?

Actually, building a full chain in the Chromium ecosystem isn’t as hard as you’d think if you use the right approach. In this talk, I’ll detail my logic-only chain against Microsoft Edge at Pwn2Own Berlin 2026. As the only browser pwned in the competition, and the first to escape Chromium’s sandbox at Pwn2Own since 2016, it earned $175,000 and helped secure the Master of Pwn trophy. All five bugs are chained together with pure logic: no renderer bugs, no memory corruption, no AI, and of course, no collisions at all!

Abstract

ARM Memory Tagging Extension (MTE) makes memory corruption vulnerabilities harder to exploit by detecting invalid memory accesses at runtime. To reduce performance overhead, MTE’s asynchronous mode defers tag-fault handling, leaving a brief window before the kernel responds. Can an attacker exploit that window?

In this talk, we present MTEscape, a technique that turns this narrow window into a practical exploitation opportunity in the Linux kernel. We show that both OOB write and UAF vulnerabilities can, under the right conditions, be used to interfere with MTE’s fault-handling mechanism before a pending violation is handled.

To make exploitation reliable, we must win a challenging single-attempt race. We will discuss the distinct strategies we developed for each vulnerability type and why they work despite the limited timing window.

Finally, we will walk through two real-world Linux kernel vulnerabilities to show how MTEscape can be applied in practice.

Abstract

Broadcom wireless components have survived multiple operating systems, architectures, chipset generations, and product families. So have some of their security assumptions.

This talk follows the investigation of two previously undocumented vulnerabilities in Broadcom’s 802.11 implementation, beginning with legacy eCos-based cable gateways and extending to newer Linux-based platforms. Using a combination of manual reverse engineering and agent-assisted vulnerability research, we traced implementation lineage across firmware generations, reconstructed the wireless control plane, and identified remotely reachable flaws shared across multiple Broadcom SDK branches.

The vulnerabilities can be reached from 802.11 radio range without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution, with the underlying behavior confirmed across ARM and MIPS firmware and multiple downstream products.

We will cover the complete research process: transferring knowledge from old targets to new ones, using agents to accelerate firmware analysis, developing reliable exploitation primitives, resolving runtime information through protocol responses, and dealing with the practical constraints of exploitation over lossy 802.11 traffic.

The talk also examines how shared SDK components propagate from chipset vendors to OEMs, ISPs, and end users, creating a gap between fixing a vulnerability and actually removing it from deployed devices. It concludes with the release of passive fingerprinting and verification tools intended to help researchers and operators identify potentially affected systems.

Abstract

Parcel is a fundamental component of Android OS. It’s the core serialization mechanism for the majority of inter-process communication (IPC) between apps and OS. For years, malware and in-the-wild exploits have targeted Parcel vulnerabilities. In response, the Android Security team has dedicated tremendous effort to hardening the Parcel APIs.

At Black Hat EU 2022, we announced significant security enhancements in Android 13 designed to transform exploitable Parcel mismatch vulnerabilities into non-exploitable programming errors. Now, four years later, we are providing an update on the effectiveness of those hardening mechanisms. We’ll celebrate our successes, but also share an unexpected turn in our journey.

A bug fix intended to resolve a temporary file descriptor leak inadvertently introduced a critical Parcel Use-After-Free (UAF) vulnerability. This flaw allowed a LazyValue object to retain a dangling reference to a Parcel object after it had been recycled.

In this talk, we explore the challenges of securing Parcel APIs alongside the complexity and brilliance of three UAF exploits reported via the Android Vulnerability Rewards Program (CVE-2022-20452, CVE-2025-22429, and CVE-2025-48583). These exploits show how an attacker can steal sensitive Binder tokens and achieve arbitrary code execution. We’ll share the lessons we learned, the mitigations we implemented, and our plans for future work.

Abstract

Apple and commercial offensive security companies have relied on iOS virtualisation for years while keeping their implementation details proprietary. In 2026, Apple unexpectedly shipped firmware for one of its internal virtual devices, the vphone600, enabling the community to build the first open-source iOS 26 virtualisation environment. This marked a major shift from previous QEMU-based efforts and opened entirely new opportunities for vulnerability research, exploit development, and dynamic spyware analysis.

We will present our work on transforming the open-source vPhone ecosystem from a heavily patched research prototype into a significantly more realistic offensive research platform. By recreating Apple’s firmware generation pipeline, we generate accepted filesystem artifacts instead of bypassing integrity checks, allowing the virtual device to boot while preserving core security mitigations. This enables security research in an environment that more closely resembles real-world devices.

Abstract

In June 2026, Paradigm Shift published usbliter8, a reminder that the SecureROM still holds surprises! A DMA bug in the Synopsys DesignWare (DWC2) USB controller that Apple has relied on for years. This talk returns to that attack surface through a different lens, and a variant of the same bug.

We begin with a brief tour of Apple’s Secure Boot ecosystem, where trust is anchored, and where a flaw in silicon is one that stays with the device. From there, the core of the talk: the effort to exploit this bug generically and across a decade of Apple SoCs, from A5 to A13. It is the story of an exploit that never quite stayed finished, rebuilt repeatedly as SecureROM and iBoot hardened over successive generations. Some techniques carried across many SoCs; others stopped working entirely on modern ROMs.

Along the way, we encountered something we still cannot fully explain: strange, undocumented behaviour of the SoC itself, doing something it was never meant to. We don’t yet know why it exists… Only that it made exploitation dramatically easier. We’ll also cover how we turned a temperamental USB attack into a reliable one.

We close where the story ends: the point at which modern Apple silicon shuts this surface down, and how far the secure-boot ecosystem has moved from the devices we set out to explore.

Abstract

Browsers are complex pieces of software and throughout the years they have been a prime target for vulnerability researchers.
Complexities arise when browsers implement standards and functionality to make the web experience better for the user. It is in that intersection where this talk develops: The implementation of WebAssembly and the optimizations on the code produced by the WebAssembly implementation.
WebAssembly is affected by the JIT compilation and optimization pipelines. Amongst those, we can find register allocation routines that try to make efficient use of registers.
This talk shows how in both V8, the JavaScript Engine of Chrome, and JavaScriptCore, the JavaScript engine for Safari, a very similar type of bug arised.
Covering how this bug was found via fuzzing and how collissions not only happen in bugs but in “fuzzing ideas” with other researchers. We’ll then focus on this somewhat less known family of register allocator bugs; showing how, due to the evolution of the WebAssembly standard standard and implementation by the Browser vendors, one resulted in just an info-leak and the later case
fully exploitable, turning a type confusion into renderer code execution.

Abstract

Over the last year research has been performed into practical USB exploitation by NCC’s exploit development group. Whilst there have been previous investigations into finding USB memory corruption-based vulnerabilities, there is much more limited public domain information on exploitation.

In 2025, Amnesty International released the first detailed write-up of an in-the-wild chain of USB related vulnerabilities which was used to compromise mobile phones demonstrating that these attacks are a real threat.

This left us with the question - “just how practical are USB memory corruption vulnerabilities to exploit against modern operating systems and what constraints are there?”

In the process we developed a framework which we call Dynamic USB Exploitation Tool (D.U.E.T.). The framework allows us to rapidly prototype new USB devices, perform common exploit techniques (such as heap manipulation) and transmit data in both directions between the USB device and the attacker (to allow for controlled information leakages and KASLR bypasses).

This framework was implemented on top of Raspberry Pi Pico’s as a related inexpensive way to deploy and coordinate large numbers of custom USB exploitation devices of varying exploitation roles via Wi-Fi.

Whilst performing this research and development, we discovered issues which affected Tesla’s automotive in-vehicle infotainment (IVI), core Linux kernel components, and developed several exploits along the way (CVE-2024-53150, CVE-2024-53104).

This talk will start by walking viewers through the Linux kernel attack surface of USB, discussing in-the-wild vulnerabilities, describing exploitation of three vulnerabilities and then moving on to discussion of the framework we developed.

Finally, we will wrap the talk up by demonstrating an end-to-end exploit for a modern Ubuntu version.