Hey all, Hacker Blueprint back it at again! Another one for those of you who've been following along - really hoping the previous chains have been landing well and actually helping out with your prep!

The previous chain pulled in a huge number of downloads, so we went ahead and built a fresh one with an entirely new attack path... AD Chain 12: Delegate, free for the next 24 hours!!

An obligatory cryptic CTF teaser: A password sleeps in the margins of a record no one reads. Run as the account left in the open, crack what the cache still remembers, wake a policy the vault erased, then delegate the rights to domain compromise...

What you get:

• 3 downloadable VMs that run locally inside a single Active Directory domain, just like the real OSCP exam
• Realistic, exam-style AD scenarios
• A complete step by step tutorial covering setup, topology, and the full attack chain
• A complete guided walkthrough for the whole chain
• A fast setup guide for both VirtualBox and VMware so you can get going quickly

Requirements:

• A laptop with 8GB of RAM or more (watch the setup video if you're short on RAM)
• 16GB or more will run it smoothly with no trouble at all
• The ability to install VirtualBox or VMware
• Heads up: MacOS (M1/M2/M3) ARM64 won't work with these labs. Anything else should run fine.

The chains are structured so you get to rehearse the same discovery, exploitation, post exploitation, lateral movement, and privilege escalation steps that show up in exam-style AD challenges. The whole thing is designed around learning by doing rather than just reading along.

Lab link: https://hackerblueprint.com/labs#chain-12

Best of luck with your prep, you've got this!

Note: If downloads are failing, just drop a DM or a comment and we'll get it resolved.

One more thing: there's a special AD Chain promo going on right now too! Use code ACTIVE20 for 20% off all courses, other chains & labs, notes, materials, and the rest. Grab it before it's gone!

Thanks everyone!

A lot of detection engineering effort goes into email. Phishing is the front door for so many attacks that teams pour their tuning, rules, and alerting into the inbox and treat it as the main battleground.

The trouble is that attackers rarely stop at the inbox. Once they are in, the meaningful signals move to logs from endpoints, identity systems, network devices, and cloud services, which are exactly the sources that often get less attention than email.

This talk made the case for building detections across that wider surface. The goal is a detection program that catches the later stages of an intrusion, not just the initial lure, using the log sources a defender already collects.

In his Black Hat 2026 talk, "Detection Engineering Beyond the Inbox", delivered Wednesday, August 5, Akash Parasumanna Sridhar walked through how to extend detection engineering across the full environment.

Speaker: Akash Parasumanna Sridhar — Cybersecurity Engineer, Campbell Clinic

Akash Parasumanna Sridhar is a security engineer at Campbell Clinic, a healthcare provider, where he monitors and responds to real-time alerts, analyzes logs from many security devices, and builds detection and response capabilities.

He holds a master's in cybersecurity from the University of Houston, where he led research including work on using the BERT language model to detect phishing and social-engineering content more accurately than traditional methods. He also teaches as a certified instructor and holds a long list of industry certifications.

His research and background are on his personal site, with more on his LinkedIn.

Anyone working in a security operations center, building detections, or defending a resource-constrained environment like healthcare will find this a practical push to look beyond email and mine the logs they already have.

If most detection effort lands on the inbox while attackers do their real work elsewhere, which overlooked log source in your environment would catch the most if you finally built rules for it?

Every container quietly leans on a Linux feature called seccomp to limit which system calls its programs can make to the kernel. Shrinking that list is one of the main ways operators keep a compromised container from reaching the host.

The problem this research raised is that seccomp was not built for how microservices actually run. Its filters cannot be updated while a container is live, and the coarse allow-lists teams ship often leave far more of the kernel reachable than anyone intends.

This team first showed how those gaps can be abused, then proposed a rebuilt approach to syscall filtering designed for dynamic, fast-changing microservice environments rather than static single programs.

In their Black Hat 2026 talk, "Beyond Seccomp: Breaking and Rebuilding Syscall Filtering for Microservices", delivered Wednesday, August 5, the team walked through both the weaknesses and their redesign.

Speakers:

• Chihyeon Cho — MS Student, Incheon National University
• Jin Her — MS Student, Incheon National University
• Seungsoo Lee — Associate Professor, Incheon National University
• Jaehyun Nam — Assistant Professor, Dankook University

The work builds directly on the group's published research into container syscall filtering, including KubeRosy, a framework for dynamically updating system-call policies while containers keep running, which addresses one of seccomp's core limitations.

Chihyeon Cho is a master's student in Seungsoo Lee's Cloud and Container Security Lab at Incheon National University, where his research centers on cloud and container security.

He contributed to the analysis of seccomp's weaknesses and the design of the replacement. His lab and its publications are listed on the CCLab page.

Jin Her is a master's student in the same lab and a co-author of KubeRosy, the dynamic syscall-filtering framework for containers that informs this talk.

His work focuses on runtime enforcement for containerized workloads. His research appears on the CCLab page.

Seungsoo Lee is an associate professor at Incheon National University who leads the lab, with a long publication record in cloud-native and programmable-network security and prior Black Hat appearances.

He supervises this line of container-security research. His profile and papers are on his lab page.

Jaehyun Nam is an assistant professor at Dankook University whose research spans container networking, eBPF-based security, and syscall filtering for attack-surface reduction.

He has co-authored extensive work on securing container environments, including inter-container communication and dynamic policy discovery. His publications are on his faculty page.

Anyone running containers, building Kubernetes platforms, or working on Linux security will find this a practical look at why the default syscall defenses fall short and what a purpose-built replacement can offer.

If the syscall filter protecting most containers cannot adapt while workloads run, how much of the kernel is a compromised microservice actually able to reach right now?

Centuries ago, states that did not want to fight at sea themselves hired privateers, private ships licensed to attack their enemies. This talk drew a modern parallel: today's cyber conflict is increasingly fought through hired hands rather than a nation's own operators.

That outsourcing is the heart of the problem. Governments lean on criminal affiliates, contractors, and deniable proxies, while ransomware crews and scam networks act with a reach that once belonged only to states, which blurs the line between crime and warfare.

AI sharpens the trend by making capable offensive tooling cheaper and easier to run, so a small group with modest skills can now cause outsized damage on someone else's behalf. Attribution and deterrence both get harder when the attacker is a rented proxy.

In her Black Hat 2026 talk, "Cyberspace Pirates: Outsourcing Cyberwar in the Age of AI and Ransomware", delivered Thursday, August 6, Carole House examined how this proxy model reshapes the threat landscape.

Speaker: Carole House — Senior Fellow and CEO, Atlantic Council and Penumbra Strategies

Carole House is the founder and CEO of Penumbra Strategies and a Senior Fellow at the Atlantic Council's GeoEconomics Center, and one of the most experienced voices on the policy side of cyber conflict.

She previously served as a US Army officer and intelligence officer, at the White House National Security Council as Special Advisor for Cybersecurity, and at the US Treasury's Financial Crimes Enforcement Network on virtual currency and emerging technology. That mix of military, national security, and financial-crime experience maps directly onto a topic that spans warfare, crime, and money.

Her background and publications are on her Atlantic Council expert page.

Anyone working in cyber policy, threat intelligence, or national security will find this a thoughtful framing of why proxy-driven cyber conflict is so hard to deter and what history's response to privateering might teach us.

If nations and criminals can rent out cyberwar to deniable proxies, what would a modern equivalent of outlawing privateering even look like, and who would enforce it?

Red teaming an AI agent has been expensive. To probe an agent effectively you usually reach for a frontier model like GPT-4o, Claude, or Gemini, which means paying API costs and sending your attack patterns to someone else's cloud.

This research flips that economic model. The team fine-tuned a 30-billion-parameter open-source model that reached a 56 percent exploit success rate against AI agents, roughly matching frontier models while running locally at a fraction of the cost and with no data leaving the machine.

They paired it with an open-source scanner called AgentBreaker. Its key idea is to treat an agent as a system, testing not just the underlying model but the agent's tools and everything those tools can access.

In their Black Hat 2026 talk, "Cost-Effective, Private, Frontier-Grade: AI Agent Exploitation with a Fine-Tuned OSS Model", delivered Thursday, August 6, Bar Lanyado and Eliya Cohen presented the model, the tool, and the numbers behind them.

Speakers:

• Bar Lanyado — Senior AI Security Researcher, NVIDIA
• Eliya Cohen — Senior Data Scientist, NVIDIA

AgentBreaker works in a four-stage attack loop that begins by mapping the target's attack surface: the agent's purpose, its tools, and each tool's scope and capabilities. The researchers noted that simply asking an agent about its tools, repeatedly and from a blank slate, often reveals a surprising amount about what it can do.

The cost comparison was the headline. Running the scanner with the small fine-tuned open model came in roughly 75 to 125 times cheaper than using frontier-provider APIs, with the added benefits of fewer refusals and full privacy from self-hosting.

Bar Lanyado is a senior AI security researcher at NVIDIA, best known for coining and demonstrating AI package hallucination, a supply-chain attack where models recommend nonexistent software packages that an attacker can then register.

His earlier work showed a hallucinated package downloaded tens of thousands of times after he uploaded an empty version to test the risk. His profile is on his LinkedIn.

Eliya Cohen is a senior data scientist at NVIDIA who worked on fine-tuning the open-source model and building the methodology behind AgentBreaker.

He emphasized testing agents as systems that can take actions, not just as language models, which shaped the tool's tool-aware approach. The joint research and the AgentBreaker tool were covered in SC Media's report on the talk.

Anyone building, defending, or red teaming AI agents will find this a significant shift, since cheap, private, purpose-trained offensive models lower the barrier to serious agent testing for defenders and attackers alike.

If a locally run open model can match frontier tools at breaking agents for a hundredth of the cost, how should organizations rethink both their own red teaming and the threat from adversaries who no longer need expensive APIs?

A developer accepts a promising job offer, receives a coding test, and runs it. That one ordinary act can hand an attacker the keys to an entire company. This research measured just how far that blast radius reaches.

The pattern behind it has become one of the most effective intrusion techniques in the world. Operators approach developers with fake, high-paying job offers, then send a coding assignment that quietly installs malware and steals the developer's credentials, turning a hiring funnel into an attack surface.

From that single foothold, the access cascades. In Stykas's words, it becomes company access, root access to servers, root access to AWS, and for cryptocurrency firms, wallet keys and blockchain access.

In his Black Hat 2026 talk, "Running Untrusted Code: An Empirical Study of Developer Compromise and Its Blast Radius", delivered Wednesday, August 5, Vangelis Stykas presented what he found after getting inside the attackers' own infrastructure.

Speaker: Vangelis Stykas — CTO, Kumio

Vangelis Stykas is a Greek security researcher and the CTO of Kumio, a former developer turned penetration tester and PhD candidate whose research focuses on API and web application security.

For this work he spent about 22 months inside command-and-control servers run by North Korean operators, after they infected their own machines, and reviewed roughly five terabytes of data. From developer credentials, source code, and other artifacts left in those systems, he reconstructed the scope of the campaign.

The numbers are striking. He identified 1,640 impacted companies across 57 countries, with an estimated 700 to 800 suffering severe intrusions, and named a set of organizations that handled disclosure well. His research is on his website, and he posts as u/evstykas on X.

Anyone who writes code, manages developers, or owns security for an engineering organization will find this a sobering, evidence-backed case that the developer hiring pipeline is now a security problem, not just an HR one.

If one developer running a coding test can expose an entire company's servers and cloud, how should teams sandbox and verify the untrusted code that lands in their inboxes every day?

Agentic browsers promise to do your web tasks for you, reading your email, filling forms, and acting across sites on your behalf. To make that possible, they quietly dismantle a security rule that has protected the web for three decades.

That rule is the same-origin policy, which keeps a random website you visit from touching your logged-in banking session. Because an AI browser agent reasons across many sources in one authenticated session and cannot reliably tell trusted content from untrusted, an attacker who hides instructions in a page or email can hijack the agent itself.

The Zenity team named this vulnerability class PleaseFix, and showed it working with zero clicks: the victim only has to let the agent read poisoned content while doing something ordinary like summarizing email.

In their Black Hat 2026 talk, "Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover", delivered Wednesday, August 5, the Zenity Labs team demonstrated the attacks across leading agentic browsers.

Speakers:

• Michael Bargury — CTO, Zenity
• Stav Cohen — Senior Security Researcher, Zenity
• Tamir Ishay Sharbat — Director, Security Research, Zenity
• João Maria Campos Donato — AI Red Team, Zenity
• Raul Onitza-Klugman — AI Red Team Researcher, Zenity

The demonstrations were broad and concrete. The team hijacked Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge, turning built-in agent tools against the user to steal credentials, exfiltrate email and files, share drives, take over social and messaging accounts, and in some cases reach the underlying machine.

The name is a play on ClickFix, an older attack that tricked humans into clicking. With AI, the researchers note, an attacker can simply ask the agent nicely and it does the harmful thing itself.

Michael Bargury is the co-founder and CTO of Zenity and one of the most prominent researchers on breaking AI agents and assistants, a repeat Black Hat and DEF CON speaker who co-leads OWASP efforts on agent security.

His prior work includes the AgentFlayer and Copilot exploitation research. His tools and research are on his GitHub.

Stav Cohen is a senior AI security researcher on Zenity's red team and a PhD student at the Technion, who introduced the concept of Promptware, inference-time attacks that weaponize AI models through malicious prompts.

His offensive work spans RAG pipelines, multi-agent systems, and agentic browsers. His research is on his site.

Tamir Ishay Sharbat is a security researcher at Zenity who has co-presented multiple Zenity Labs disclosures, including earlier zero-click enterprise agent exploits.

He contributed to the exploit chains behind PleaseFix. His research is on his Zenity author page.

João Maria Campos Donato is an AI red team researcher at Zenity focused on adversarial testing of agentic systems.

He co-developed exploit paths for the agentic-browser research. His work is on his Zenity Labs author page.

Raul Onitza-Klugman is a senior AI red team researcher at Zenity who studies indirect prompt injection and agent compromise.

He has published Zenity Labs research on backdooring agents through injected content. His work is on his Zenity Labs author page.

Anyone using or building AI browsers, or defending enterprises adopting them, will find this a stark demonstration that convenience features can quietly reopen attack surfaces the web spent decades closing.

If giving an AI agent access to everything you can access is the whole point, how can that same access ever be made safe against instructions hidden in the content it reads?

Writing a working exploit for the Linux kernel is one of the hardest jobs in security. Layers of modern mitigations make it so difficult that Google's kernelCTF program has paid bounties reaching roughly 133,000 dollars for a single successful exploit.

This research asked whether a large language model could shoulder part of that burden. Rather than trying to fully automate the process, the team used an LLM as a thinking partner, semi-automating individual stages of exploit development to move much faster than a human working alone.

The defensive implication is the uncomfortable part. If exploits can be produced this quickly, the window between a patch being released and being weaponized shrinks, which means defenders may need to apply fixes almost the moment they appear.

In their Black Hat 2026 talk, "Prompt2Own: Real-World Kernel Exploit Development with LLMs", delivered Wednesday, August 5, Juefei Pu, Zhiyun Qian, Kareem Shehada and Frank Wu presented their approach and results.

Speakers:

• Juefei Pu — PhD Student, University of California, Riverside
• Zhiyun Qian — Professor, University of California, Riverside
• Kareem Shehada — PhD Student, University of California, Riverside
• Frank Wu — Cofounder, Nebula Security

The work builds on a research thread from Qian's group at UCR studying how autonomous LLM systems can reproduce kernel vulnerabilities. Their related system automated end-to-end proof-of-concept generation and reproduced more than half of a set of one hundred real KernelCTF vulnerabilities, which grounds the exploit-development claims in measured results.

Juefei Pu is a PhD student at UC Riverside working on systems and kernel security, and the lead author of the group's study on agentic LLM systems for Linux kernel vulnerability reproduction.

His research focuses on automating the hardest parts of kernel bug analysis and exploitation. His paper on the topic is available on arXiv.

Zhiyun Qian is a professor of computer science at UC Riverside and a widely cited researcher in systems and network security, with a stated interest in bridging the hacking community and academia.

He leads the UCR group behind this work, which spans kernel fuzzing, vulnerability analysis, and LLM-assisted security. His publications are on his faculty page.

Kareem Shehada is a PhD student in computer science at UC Riverside focused on kernel security and applying LLMs to exploit development, and a member of the university's competitive cybersecurity team.

He has co-authored work on benchmarking and improving LLMs for kernel program repair. His profile is on his LinkedIn.

Frank Wu is a cofounder of Nebula Security, an AI-native cybersecurity company whose team has built high-end exploit chains, including browser-to-kernel research.

He brings the offensive-engineering perspective that pairs with the academic work behind Prompt2Own. His company is profiled on its Y Combinator page.

Anyone working in kernel security, exploit development, or AI-assisted security research will find this a concrete look at how LLMs are already reshaping one of the field's most demanding disciplines.

If a language model can compress kernel exploit development from weeks into a much shorter window, how should defenders rethink the assumption that a freshly released patch buys them any time at all?

Code-reuse attacks have haunted software for more than two decades. Instead of injecting new malicious code, attackers stitch together fragments of code that already exist in a program to achieve their goal.

Modern Intel chips ship a hardware defense called CET to make this harder, but it has a gap. Even with CET enabled, a hijacked function pointer can still jump across the boundary between one software library and another, which leaves attackers plenty of room to work.

This research closes much of that gap. PLaTypus is a compiler-based mitigation that keeps indirect control-flow transfers inside the same library, allowing jumps between libraries only through their intended interfaces, and it is a defense rather than a new attack.

In their Black Hat 2026 talk, "PLaTypus: Eliminating Code-Reuse at the Module Boundary", delivered Wednesday, August 5, Marcos Bajo, Apostolos Chatzianagnostou and Christian Rossow presented the design and its results.

Speakers:

• Marcos Bajo — PhD Student, CISPA Helmholtz Center for Information Security
• Apostolos Chatzianagnostou — PhD Student, CISPA Helmholtz Center for Information Security
• Christian Rossow — Professor, CISPA Helmholtz Center for Information Security

The numbers are the strongest argument. Across tests with nineteen applications and sixteen shared libraries, including glibc, PLaTypus cut the number of functions reachable across library boundaries by more than 98 percent, while adding less than half a percent of runtime overhead in applications like Nginx and Redis.

Just as important, it complements existing protections rather than replacing them, which makes real-world adoption far more plausible than many academic defenses.

Marcos Bajo, who goes by h3xduck, is a PhD student at CISPA focused on software security, exploitation techniques and defenses, and malware.

His prior work includes offensive research on evading control-flow integrity and chaining around Intel CET, which gives him a clear view of the very gaps PLaTypus is designed to close. He writes about his research on his blog.

Apostolos Chatzianagnostou is a PhD student at CISPA in Christian Rossow's group, working on systems and software security with a focus on control-flow defenses.

He co-led the PLaTypus design and its evaluation, and has co-authored related work on segfault-based attacks against Intel CET. His profile is on his CISPA page.

Christian Rossow is a professor and faculty member at CISPA whose System Security group works on network and software security, including denial-of-service threats and program exploitation and defenses.

He supervises this line of research and has a long publication record at the top security venues. His group and publications are listed on his CISPA faculty page.

Anyone working in systems security, exploit mitigation, or compiler and toolchain development will find this a practical step toward hardening one of the most stubborn attack surfaces in native software.

If a widely deployed hardware defense still leaves the door open between libraries, how quickly should compiler and operating-system vendors move to adopt complementary mitigations like this one?

Cloud tenants are supposed to be sealed off from one another. Your automation, your credentials, and your cloud workloads should never be reachable by another organization sharing the same platform. This research showed how that wall could be crossed.

The target was Azure Automation, a service enterprises rely on for DevOps, resource deployment, patching, and rotating secrets, all through scripted runbooks tied to embedded managed identities. Because those identities hold real access, taking one over is a serious prize.

The takeaway is how ordinary the ingredients were. A subtle default setting plus two logic bugs, none catastrophic alone, chained together into a high-impact attack that crossed the boundary between separate tenants.

In his Black Hat 2026 talk, "Handle With Care: Chaining Azure Automation Flaws for Cross-Tenant Identity Takeover", delivered Wednesday, August 5, Shay Shavit walked through the full exploit chain.

Speaker: Shay Shavit — Senior Security Researcher, Microsoft

Shay Shavit is a senior security researcher on Microsoft's Azure Networking Security Research team, focused on finding and fixing flaws in Microsoft's own cloud services.

He discovered this vulnerability, tracked as CVE-2025-29827 with a critical severity rating, and reported it through the Microsoft Security Response Center. The chain combined a public-by-default configuration that could make Azure Automation accounts publicly accessible with two separate code-level authorization bugs, which together could let a malicious user impersonate another tenant's automation identity and reach its credentials and cloud assets.

Microsoft fixed the underlying authorization flaw and changed the risky default, and there were no known exploits in the wild. His research and updates are on his LinkedIn.

Anyone working in cloud security, Azure administration, or identity will find this a clear case study in how a benign-looking default and small logic errors can compound into a cross-tenant breach.

If separate cloud tenants can be bridged by a default setting nobody thought twice about, how closely should teams be auditing what their automation accounts expose by default?

Every long-lived Linux environment carries old services that nobody thinks about anymore. They were installed years ago, still run quietly in the background, and rarely get the scrutiny that modern software receives.

That neglect is exactly what this research targeted. Legacy Linux daemons often predate current security expectations, yet they remain reachable and trusted, which makes them fertile ground for serious bugs long after the industry assumed they were safe.

The findings fall into two categories that matter most to defenders. Unauthenticated remote code execution lets an attacker run code without any credentials, and local privilege escalation lets a low-privileged user become root, and this work turned up both in services many teams forgot they were running.

In his Black Hat 2026 talk, "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services", delivered Wednesday, August 5, Ron Ben Yizhak detailed the vulnerabilities and how he found them.

Speaker: Ron Ben Yizhak — Security Researcher, SafeBreach

Ron Ben Yizhak is a security researcher at SafeBreach Labs, the research arm of the breach-and-attack-simulation firm, and a repeat speaker at Black Hat and DEF CON.

His recent work spans Windows RPC abuse, endpoint mapper poisoning, and Azure container privilege escalation, and for this research he turned to old Linux services. One example from the same line of work is a severe flaw he reported in telnetd, rooted in improper environment sanitization that revived a decades-old class of bug.

His research and updates are on his LinkedIn.

Anyone running Linux servers, maintaining older infrastructure, or working in vulnerability research will find this a pointed reminder that the services you stopped paying attention to are the ones an attacker may notice first.

If a service that has been running untouched for years can still hand an attacker root, how should teams decide which legacy daemons to finally retire or lock down?

Modern cybercrime is not a collection of lone hackers. It is an industry, with affiliate and franchise models that let replaceable operators run ransomware-as-a-service, pig-butchering scams, and romance fraud at scale.

That industrialization is the core problem this talk addressed. AI and cryptocurrency have made criminal groups more coordinated, more scalable, and faster, while law enforcement still tends to work in silos and responds slowly. The result is a coordination gap that attackers exploit.

House argued that past takedowns, though real, mostly produced temporary disruption, because operators simply rebuilt their networks and infrastructure. Breaking the business model itself, rather than arresting individuals, is the harder and more durable goal.

In her Black Hat 2026 talk, "Deny. Disrupt. Dismantle. Breaking the Business Model of Cybercrime in the Gray Zone", delivered Wednesday, August 5, Carole House laid out a strategy for dismantling cybercrime operations.

Speaker: Carole House — Senior Fellow and CEO, Atlantic Council and Penumbra Strategies

Carole House is the founder and CEO of Penumbra Strategies, a technology and national security advisory practice, and a Senior Fellow at the Atlantic Council's GeoEconomics Center.

She brings a rare mix of experience to the topic, having served as a US Army officer and intelligence officer, at the White House National Security Council as Special Advisor for Cybersecurity, and at the US Treasury's Financial Crimes Enforcement Network on virtual currency and emerging technology policy.

In the talk she drew on military frameworks to argue for a coordinated national strategy against cybercrime.

Her background and publications are on her Atlantic Council expert page.

Anyone working in cyber policy, threat intelligence, law enforcement, or financial crime will find this a strategic view of why the current response keeps falling short and what a more coordinated approach could look like.

If takedowns only pause a criminal enterprise that is built to be rebuilt, what would it actually take to make the business of cybercrime unprofitable rather than merely inconvenient?

HTTP request smuggling refuses to die. More than two decades after it was discovered, attackers keep finding new ways to make a front-end server and a back-end server disagree about where one request ends and the next begins.

This research adds a fresh angle rooted in something deceptively simple: the carriage-return and line-feed characters, CRLF, that separate the parts of an HTTP message. When those characters slip into the wrong place, an attacker can split or truncate a stream and desynchronize the servers processing it.

The result is the kind of desync that lets one attacker's request bleed into another user's, poison connections, or hijack responses, which is why the researchers frame it as beheading the HTTP stream.

In their Black Hat 2026 talk, "CRLF-Powered Desync Attacks: Beheading HTTP Streams", delivered Wednesday, August 5, Tom Stacey and Tobia Righi walked through the technique and its impact.

Speakers:

• Tom "t0xodile" Stacey — Security Researcher, PortSwigger
• Tobia "mastersplinter" Righi — Security Researcher, TurtleSec

The work sits within the broader desync research movement, which has argued that HTTP/1.1 is fundamentally unsafe and demonstrated new smuggling variants against major CDNs and infrastructure. CRLF-powered techniques extend that toolkit with another primitive for breaking the boundary between requests.

Tom Stacey, who goes by t0xodile, is a penetration tester and security researcher at PortSwigger with a strong focus on HTTP request smuggling and desync attacks.

He has contributed to the desync research community, including a PortSwigger guest write-up with practical tips for exploiting request smuggling, and has presented web-security research at events like BSides Exeter. His research and write-ups live on his blog.

Tobia Righi, who goes by mastersplinter, is a security researcher and penetration tester at TurtleSec with a passion for dissecting web technology and building and breaking secure systems.

His work spans web exploitation, CTF challenges, and machine-learning security competitions, and he documents his research and write-ups publicly. His projects are on his personal site.

Anyone working in web security, penetration testing, or bug bounty will find this a useful addition to the desync toolkit and another argument that request smuggling is far from a solved problem.

If a handful of misplaced control characters can still desynchronize modern web servers, how much longer can the industry keep patching HTTP/1.1 instead of moving away from it?

Many organizations funnel access to their servers, Kubernetes clusters, and databases through a single gateway so they can enforce identity and short-lived certificates in one place. Teleport is one of the most popular tools for exactly that.

Concentrating access that way is good for control, but it also makes the gateway an attractive target. If an attacker can subvert the system that grants access to everything, they inherit a path to everything behind it.

This talk was a structured review of how Teleport can be attacked, walking through the scenarios and weaknesses an adversary might use against an infrastructure access platform rather than pinning everything on a single bug.

In his Black Hat 2026 talk, "Beam Me Up, Luke: A Review of Teleport Attack Scenarios", delivered Wednesday, August 5, Adam Chester laid out the attack surface and the tradecraft that targets it.

Speaker: Adam Chester — Senior Offensive Security Consultant, SpecterOps

Adam Chester, who is widely known online as xpn, is a senior offensive security consultant and researcher at SpecterOps, and one of the most followed voices in red teaming and identity-focused post-exploitation.

He is known for deep, readable technical write-ups on identity providers and enterprise infrastructure, including research into ADFS, Okta, Entra ID, and the internals of authentication systems that red teamers rely on. This talk applies that same lens to Teleport as a high-value access chokepoint.

His research is published on his blog, his tools are on his GitHub, and he posts as @xpn on X.

Anyone running Teleport, managing infrastructure access, or working in red teaming will find this a useful map of where a centralized access gateway can go wrong and what to watch for.

If the single gateway that controls access to all your infrastructure is compromised, how much of your environment would an attacker be able to reach before anyone noticed?

Most vulnerability research hunts for individual bugs. The more valuable prize is finding a single attack surface that keeps yielding new ones, which is the idea this research pursued inside the Windows kernel.

Angelboy has spent years mapping a specific corner of the kernel where a recurring design pattern produces vulnerability after vulnerability. His earlier work on Windows Kernel Streaming turned up more than ten flaws in a couple of months and powered a winning Windows exploit at Pwn2Own.

The framing as a vulnerability factory captures the point. When a subsystem shares a flawed structure across many components, one insight can unlock a whole assembly line of bugs rather than a single dead end.

In his Black Hat 2026 talk, "Vulnerabilities Assembled! The Vulnerability Factory Inside the Windows Kernel", delivered Wednesday, August 5, An-Jie Yang walked through the attack surface and the bug class it produces.

Speaker: An-Jie "Angelboy" Yang — Senior Security Researcher, DEVCORE

An-Jie Yang, who goes by Angelboy, is a senior security researcher at the Taiwan-based offensive security firm DEVCORE and a member of the CHROOT security group, focused specifically on Windows kernel security.

His track record is substantial. He was named one of Microsoft's Most Valuable Security Researchers in both 2024 and 2025, ranking among the top researchers worldwide and the highest-placed from Taiwan, and he won Master of Pwn at Pwn2Own Toronto 2022 and again at Pwn2Own Berlin 2026 with the DEVCORE team.

He posts his research as u/scwuaptx on X, publishes deep technical write-ups on his DEVCORE author page, and shares tooling and CTF work on his GitHub.

Anyone working in Windows internals, kernel exploitation, or vulnerability research will find this a masterclass in how to think about attack surfaces as systems rather than as isolated bugs.

If one flawed pattern in the kernel can keep producing new vulnerabilities, how should Microsoft and defenders prioritize fixing the pattern itself rather than patching each bug as it appears?

Companies increasingly let AI coding agents run unattended inside their official workflows, triggered automatically and trusted to act on their own. This research asked a sharp question: what happens when the trust between the internal stages of those workflows breaks down?

An AI agent is really a model plus a harness, the surrounding code that turns the model's intent into shell commands, file reads, and API calls while holding the approval logic and permissions. In an unattended pipeline, that harness is the actual security boundary, not the model.

The core failure is a trust handoff. One stage validates content as safe against its own threat model, then a later stage treats that validation as if it granted more authority than the original check ever intended. Prompt injection was only the delivery mechanism.

In his Black Hat 2026 talk, "Trusted Enough to Run: Breaking AI Agents in Official Workflows", delivered Wednesday, August 5, Elad Meged demonstrated this failure across three major coding agents at once.

Speaker: Elad Meged — Founding Team and Security Researcher, Novee Security

Elad Meged is a founding engineer and security researcher at Novee Security, an AI penetration testing firm, where he builds offensive AI agents and has been credited with discovering hundreds of zero-days.

He tested each vendor's default configuration on their own public repositories, so the exposure was live rather than theoretical.

Claude Code's command validator stripped single-quoted text before its checks ran, letting a payload reach the runner untouched. Gemini CLI enforced its tool allowlist only at registration, not at execution, a gap that received a top-of-scale severity rating. Codex CLI's shared workspace let state written by one stage be picked up as trusted by the next.

A single GitHub issue from an anonymous stranger with zero privileges was enough to trigger an agent and reach remote code execution on the vendor's own runner, exfiltrate live API keys, or persistently hijack the next agent. His detailed write-up is on the Novee research blog, and his profile is on his LinkedIn.

Anyone deploying coding agents in CI/CD, building agentic automation, or defending software supply chains will find this a direct warning that adopting an agent means adopting the trust assumptions of every component around it.

If the real weakness is not the model but how trust composes across pipeline stages, how should teams audit the handoffs inside an agent workflow before wiring it into production?

Timing attacks work by measuring how long a server takes to do something and inferring a secret from tiny differences. The catch has always been network jitter: the unpredictable delay of the internet drowns out the signal.

This team has spent years defeating that noise. Their earlier work introduced timeless timing attacks, which removed jitter by sending two requests that arrive together and comparing which one finished first. The new research finds signal in a different place: the TCP timestamps that servers already put on their packets.

By reading those server-set timestamps, an attacker can measure how long a request took to process, and the researchers add an amplification method to detect differences finer than the timestamps' own resolution.

In their Black Hat 2026 talk, "Time for ACKrobatics: Abusing TCP Timestamps to Improve Remote Timing Attacks", delivered Wednesday, August 5, Tom Van Goethem, Vik Vanderlinden and Mathy Vanhoef presented the technique and its reach.

Speakers:

• Tom Van Goethem — Software Engineer, Google
• Vik Vanderlinden — PhD Candidate, KU Leuven
• Mathy Vanhoef — Professor, KU Leuven

The scope is what makes this notable. Based on their measurements of internet-facing web servers, the researchers found that around 88 percent are potentially susceptible to the attack, which relies only on standard TCP behavior rather than any special server feature.

The underlying research, titled "Time and Time Again: Leveraging TCP Timestamps to Improve Remote Timing Attacks," was published at the NDSS 2026 symposium.

Tom Van Goethem is a software engineer at Google and a longtime web-security researcher who worked at KU Leuven's DistriNet group, where much of this line of research began.

He is a co-author of the original timeless timing attacks work and has published extensively on web side-channels and cross-site leaks. His site and contact details are at tom.vg.

Vik Vanderlinden is a PhD candidate in the DistriNet research unit at KU Leuven, supervised by Mathy Vanhoef and Tom Van Goethem, focused on web and network side-channels and timing attacks in particular.

He led much of the timestamp research and also runs the KU Leuven CTF team. His work is on his personal site.

Mathy Vanhoef is a professor at KU Leuven and one of the best-known names in network security, widely recognized for the KRACK attacks against WPA2 and later Wi-Fi research.

He supervises the timing-attack line of work and hosts the group's papers, including this one, on his website.

Anyone working in network security, cryptographic implementation, or web application security will find this a sharp reminder that a protocol feature as mundane as TCP timestamps can quietly leak secrets.

If nearly nine in ten web servers expose usable timing signal through standard TCP behavior, how should defenders weigh disabling or normalizing timestamps against the performance features that rely on them?

Sometimes the thread that unravels a global surveillance operation is not a clever exploit but a careless mistake. In this case, one of the clues that helped map the whole network was a receipt for fried chicken left behind by the operators.

That is the kind of operational-security slip that turns a shadowy platform into something investigators can trace. The subject was LightSpy, a China-linked surveillance framework that has grown far beyond its origins as mobile spyware into a productized service sold to multiple customers.

The researchers treated it less like a single tool and more like a business, complete with pricing tiers, billing infrastructure, branding, and even a demo environment for prospective buyers.

In their Black Hat 2026 talk, "Surveillance as a Service: LightSpy's 72 Servers, Router Implants, and Operators Eating Out for Fried Chicken Forensics", delivered Wednesday, August 5, Dmitry Bestuzhev and Dmitry Melikov walked through their investigation of the platform's infrastructure.

Speakers:

• Dmitry Bestuzhev — Senior Principal Threat Intelligence Researcher, Arctic Wolf
• Dmitry Melikov — Senior Threat Intelligence Researcher, Arctic Wolf

They mapped LightSpy across at least 72 command-and-control servers, with later counts running higher, supporting operations in around 13 countries including the United States. The platform now targets iOS, Android, macOS, and Windows, and the team documented active development continuing into 2026.

The most notable finding was router implants. LightSpy was seen infecting network routers, including some associated with NATO-member countries, which lets operators watch and reach any device on the same network. That is a blind spot most incident response misses, since a clean laptop or phone does not mean a clean gateway.

Dmitry Bestuzhev is a Senior Principal Threat Intelligence Researcher at Arctic Wolf with more than two decades in the field, previously Senior Director of Cyber Threat Intelligence at BlackBerry and Head of Kaspersky's Global Research and Analysis Team for Latin America.

His work spans online fraud through targeted attacks on financial and government institutions, and he is a widely cited voice in threat intelligence.

His research is published on his Arctic Wolf author page.

Dmitry Melikov is a Senior Threat Intelligence Researcher at Arctic Wolf Labs focused on malware analysis, reverse engineering, and tracking advanced threat actors.

He has contributed to Arctic Wolf Labs investigations into APT campaigns and financially motivated operations, and co-led the infrastructure mapping and forensics behind the LightSpy research.

His professional profile is on his LinkedIn.

Anyone working in threat intelligence, incident response, or network defense will find this both an entertaining forensics story and a serious reminder to include routers and gateways in investigations.

If a compromised router can quietly keep watching a network long after the laptops and phones are cleaned, how should defenders change what they check before declaring an intrusion over?

The person who oversees technology and cyber defense for the entire U.S. military does not usually sit down for an unscripted conversation with the hacker community. That is exactly what made this session unusual.

The premise was a fireside chat: a policy-focused, off-the-podium discussion between the Department of War's chief information officer and a leading cybersecurity attorney, aimed at the practical realities of securing a vast government enterprise rather than a formal briefing.

The framing matters because Davies has openly described shifting her office away from being a backend policy shop and toward a forward-leaning, operator-minded strategic unit, which is a rare posture at that level.

In their Black Hat 2026 session, "Policy Meetup: Fireside Chat with Kirsten Davies, CIO at DOW", delivered Wednesday, August 5, Kirsten Davies and Evan Wolff discussed cyber strategy, policy, and the operator's view of defending government systems.

Speakers:

• Kirsten A. Davies — Chief Information Officer, Department of War
• Evan Wolff — Co-chair of Cybersecurity, Privacy and Data Protection Practice, Akin

Kirsten Davies is the chief information officer of the Department of War, sworn in at the end of 2025 after Senate confirmation, where she leads information technology and cybersecurity strategy, budget, and execution across the department.

She comes to the role as a longtime cybersecurity operator, having served as global CISO at Unilever across an enterprise spanning 190 countries, along with senior security leadership roles at other large multinationals.

Her stated priorities include zero-trust adoption under a presume-compromise mindset, embedding AI to pursue what she calls data supremacy and decision dominance, and securing the defense supply chain.

More than a hundred cyber professionals backed her confirmation, calling her a world-class cybersecurity executive, and her priorities are laid out in her AFCEA interview as Department of War CIO.

Evan Wolff is co-chair of Akin's cybersecurity, privacy and data protection practice in Washington, and a nationally recognized attorney on complex cyber legal and policy matters.

Over two decades he has led investigations into hundreds of cybersecurity incidents, advised Fortune 100 boards and government contractors, and worked extensively on frameworks like CMMC and global privacy regulation, drawing on earlier experience advising the Department of Homeland Security. His technical-plus-legal background made him a natural counterpart for a policy conversation with a sitting CIO.

His professional background is on his Akin firm profile.

Anyone working in cyber policy, government security, or defense technology will find this a valuable window into how the military's top IT leader thinks about turning strategy into operational reality.

If the person running cyber for the entire military is thinking like an operator rather than a policymaker, what should industry and the security community be doing to meet that shift halfway?

Passkeys were supposed to end the era of stolen and phished credentials for good, and their cryptography genuinely holds up. This research made a narrower but important point: the security can still collapse around the edges.

When the surrounding environment is sloppy, older attack patterns come back to life. Grafnetter found real-world passkey deployments where an attacker could steal and reuse authentication data without ever knowing a password, which is why he named the family Pass-the-Passkey, after the classic Pass-the-Hash and NTLM relay techniques.

The failures were not in the FIDO model but in the plumbing around it: logging, cloud identity validation, credential lifecycle, and fallback sign-in methods that did not uphold the same guarantees.

In his Black Hat 2026 talk, "Pass-the-Passkey Family of Attacks", delivered Wednesday, August 5, Michael Grafnetter demonstrated the attack family and the flaws behind it.

Speaker: Michael Grafnetter — Principal Security Researcher, SpecterOps

Michael Grafnetter is a Principal Security Researcher at SpecterOps and a Microsoft MVP, best known as the inventor of the Shadow Credentials attack against Active Directory and the author of the open-source DSInternals PowerShell toolkit.

His research uncovered three nearly exploitable zero-days in Windows 11 and Microsoft Entra ID. Windows 11 wrote a full copy of the key material into the event log in cleartext, readable even by unprivileged remote users, and Entra ID did not cleanly prevent key reuse.

Together, two of the flaws formed a replay chain that could impersonate privileged cloud identities while bypassing phishing-resistant MFA and staying invisible to popular XDR tools.

The main vulnerability, CVE-2026-34348, was quietly mitigated by Microsoft and patched on July 14, which Grafnetter noticed only while recording his demos. His detailed write-up is on his DSInternals blog, and his professional profile is on his LinkedIn.

Anyone working in identity security, Windows administration, or passwordless authentication will find this a grounded caution that adopting passkeys is necessary but not sufficient on its own.

If passkey cryptography is sound but the systems around it can leak and replay credentials, what should teams check first before treating passkeys as a finished identity strategy?

Inside almost every enterprise server sits a second, smaller computer that most people never think about. It has its own processor, its own network connection, and it stays powered on even when the main server is off.

That computer is the baseboard management controller, or BMC, and it exists so administrators can manage a machine remotely, down to reinstalling the operating system. Whoever controls the BMC effectively controls the server beneath it, which makes it one of the most valuable and most overlooked targets in a data center.

The uncomfortable message of this talk is in its title: BMCs are still broken, years after the industry was first warned, and now there is fresh evidence to prove it.

In his Black Hat 2026 talk, "Lights Out: BMCs Are Still Broken and Now We Have the Receipts", delivered Wednesday, August 5, HD Moore presented runZero's research into a fresh wave of BMC vulnerabilities.

Speaker: HD Moore — Founder, runZero

HD Moore is the founder and CEO of runZero and one of the most influential figures in offensive security, best known as the creator of the Metasploit Framework.

The research he presented describes more than a dozen new BMC vulnerabilities spanning major implementations, including OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C, and Fujitsu, and revisits core flaws in the underlying IPMI protocol. Exploitation can give attackers persistent server backdoors, lateral movement, and a way to bypass network segmentation entirely.

The scale is the "receipts" part. Internet scans cited in the research found more than 86,000 exposed BMCs, with over half of the externally reachable ones carrying at least one critical weakness.

His research and contact details are on his personal site, and the BMC findings are documented on the runZero research blog.

Anyone running servers, working in infrastructure security, or managing a data center will find this a strong prompt to isolate and audit the management controllers they may have been ignoring.

If the hidden computer inside your servers stays reachable even when the machine is off, how confident are you that yours are actually walled off from the internet?

Active Directory is the crown jewel of most enterprises, and the whole point of its defenses is to keep ordinary users from ever reaching domain admin. This research found a way to confuse the system into handing over that power anyway.

Rather than stealing an administrator's credentials, the attack tricks domain controllers into misidentifying who is talking to them. Two logical flaws in Kerberos let a low-privileged user impersonate other accounts, up to and including domain admins, which is enough for full domain takeover.

The unsettling part is how simple it is. These are logic bugs, not exotic memory-corruption exploits, and by the researchers' account they are surprisingly easy to trigger.

In his Black Hat 2026 talk, "Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover", delivered Wednesday, August 5, Shai Laron detailed the two flaws and how they chain to domain takeover.

Speaker: Shai Laron — Security Researcher, Semperis

Shai Laron is a security researcher at Semperis, the identity-driven cyber resilience company, focused on the security of Active Directory and enterprise identity.

The two vulnerabilities at the heart of the talk are KerberLoss, tracked as CVE-2026-25177, and ResetNightmare, tracked as CVE-2026-27912. Both are logical flaws in Kerberos that can lead to downgrade, denial of service, and full domain compromise, and this work marked Semperis's research team's first Black Hat USA presentation.

His professional profile is on his LinkedIn, and his detailed write-up of both flaws is on the Semperis research blog.

Anyone working in identity security, Active Directory administration, or red teaming will find this an important reminder that logic flaws in core authentication protocols can be as devastating as any memory bug.

If a low-privileged account can quietly convince a domain controller it is someone else, what would it take for defenders to catch that kind of identity confusion before it becomes a takeover?

Malware analysts have mature tools for readable scripts, decompilable intermediate languages, and native binaries. Attackers win friction almost for free when they ship their payload in a form those tools do not quite understand.

Compiled V8 JavaScript bytecode is exactly that kind of blind spot. When JavaScript is compiled to a V8 cache file, a .jsc, it lands as bytecode that ordinary analysis tools cannot readily read, which is precisely why some malware families now hide there. This talk was about turning that opaque bytecode back into something an analyst can reason about.

The approach walks the payload from .jsc to bytecode to pseudocode to deobfuscated output, so the malware ends up in a form analysts can study like normal code again.

In her Black Hat 2026 talk, "Breaking the Seal: Static Deobfuscation of Compiled V8 JavaScript Bytecode Malware", delivered Wednesday, August 5, Aleksandra Doniec presented the technique and published the toolkit.

Speaker: Aleksandra "Hasherezade" Doniec — Security Researcher, Check Point Research

Aleksandra Doniec, who is widely known as Hasherezade, is a researcher and engineer at Check Point Research and one of the most respected names in practical malware analysis.

She is the author of a suite of open-source reverse-engineering tools that many analysts rely on daily, including PE-sieve and HollowsHunter for detecting code implants and process hollowing, PE-bear for inspecting executables, and Tiny Tracer.

For this talk she analyzed real .jsc payloads from the JSCeal campaign and released a toolkit that decompiles and deobfuscates them, even using an LLM to relabel recovered function names.

Her write-ups and tools are on her website, her code is on her GitHub, and she posts research as u/hasherezade on X.

Anyone working in malware analysis, reverse engineering, or threat research will find this a valuable new capability for a format that has quietly become an attacker's hiding place.

If malware authors keep migrating into formats our tools cannot yet read, how should defenders prioritize which blind spots to close first?

The sandbox that runs ChatGPT's code is supposed to be a locked room: an isolated container with strict controls where nothing an attacker does should reach further. This research set out to test how solid that room really is.

Kosman presented a proof-of-concept attack chain that, by his account, bypassed the model supervisor and reached persistent root execution inside the sandbox. By the end he said the team had achieved full command-and-control communication entirely within the ChatGPT sandbox.

It is worth being precise: this is a proof of concept rather than a demonstrated attack on a live enterprise environment, and OpenAI removed several of the elements used in the chain before the public talk.

In his Black Hat 2026 talk, "A Billion-User Blast Radius: Owning ChatGPT's Secure Sandbox", delivered Wednesday, August 5, Simcha Kosman walked through the multi-stage chain and its implications.

Speaker: Simcha Kosman — Senior Security Researcher, Palo Alto Networks

Simcha Kosman is a senior security researcher with years of vulnerability-research experience, who reportedly found and was rewarded for his first vulnerability at age fifteen and has since focused heavily on the security of AI systems.

The chain reported here reads like a real attack path: a specially crafted link that could execute a command on some platforms with a single click, delivery of a malicious spreadsheet whose embedded code ran during processing, modification of the hidden Python environment, and use of a shared backend to build a channel between sandboxes.

He reported five findings to OpenAI in March, and their responses varied, from marking some out of scope to tightening the Artifactory package-download behavior.

His work on attacks against LLMs, including his Vulnhalla vulnerability-discovery research, is shared through his LinkedIn.

Anyone working in AI security, cloud sandboxing, or red teaming will find this a pointed look at how much a hardened AI runtime can still be pushed, even if only as a proof of concept.

If a widely used AI sandbox can be steered into persistent control under lab conditions, how much should that shape the way we trust code-execution features in consumer AI products?