Hardware, RFID and Signaling Security (TBC)

TBC

Workshop: Hardware, RFID and Signaling Security (TBC)

TBC

Vulnerabilities Assembled! The Cross-Component Vulnerability Factory Inside the Windows Kernel (VXCON Exclusive Edition)

This talk will be delivered remotely via Zoom.

As a fundamental part of the Windows networking stack, AFD (Ancillary Function Driver for Winsock) has undergone years of security hardening and is often considered a well-investigated target with a shrinking attack surface. But is that really true? By viewing AFD from a cross-layer composition perspective and combining drivers and components like LEGO blocks, we uncovered more than 30 vulnerabilities.

We introduce the concept of transport-layer gadgets and show how different transports, execution paths, and fragile assumptions can be combined to create entirely new bug classes. The resulting LPE primitives are stable, exploitable, and affect multiple generations of Windows. Under certain conditions, they can also break AppContainer isolation and enable practical sandbox escapes.

In this talk, we explain how this attack surface emerges, present representative case studies, and share guidelines for identifying similar composition-driven vulnerabilities across the Windows ecosystem.

Automating N-Day PoC Generation: A Hybrid LLM + Program Analysis Framework for Patch-to-PoC

Patch diffing is one of the most effective techniques in N-day vulnerability research, yet it remains slow and manual: analysts must track upstream releases, separate security-relevant changes from noise, and hand-craft a trigger to reproduce the fix. In this talk I demonstrate a working framework that automates the pipeline end to end. The system combines LLM-based reasoning with classical program analysis—using retrieval and code-diff summarization to interpret changes, an LLM classifier to flag security-relevant patches, and LLM-guided input synthesis backed by fuzzing to produce a proof-of-concept that reproduces the patched bug. I will show the tool running live against real-world targets, walking from an opaque vendor patch to a validated PoC, and discuss where automation succeeds, where it breaks, and how the AI and program-analysis components compensate for each other’s weaknesses.

Reading Between the Fixes: Variant Hunting in WebKit

A WebKit patch is worth reading even when it doesn’t hand you a new bug. It shows the assumption the fix depends on, the shape of the bug it closes, and whether that same assumption holds up elsewhere in the code. Even a fully fixed bug points to the next place to look.

This talk is about reading patches that way. Through real examples, it follows a patch from its root cause to the nearby code that might share the same weakness, then weighs whether a variant is really there. Some readings turn up a new bug. Others reach a dead end, which still sharpens what to look for next. Both are the point.

The talk also introduces WebKit Weekly, a project that uses AI to review commits and draft security analyses. It shows how that fits into the research workflow, where the AI’s output is wrong, and how the researcher checks every finding against the code.

New Car Hacking Techniques and Research (VXCON Exclusive)

New car hacking techniques and research, presented exclusively at VXCON. Details to be announced.

New Car Hacking Techniques and Research (VXCON Exclusive)

New car hacking techniques and research, presented exclusively at VXCON. Details to be announced.

Full-Automatic CTF Agent: Lessons from CODEGATE 2026

In this talk, we present the Full-Automatic CTF Agent deployed at the CODEGATE 2026 Finals. The system was designed to participate in an entire CTF without human intervention. It manages the competition, prepares challenge environments, and solves challenges using frontier LLMs such as Codex and Claude. The system autonomously solved 22 out of 26 unique challenges across six categories. It also achieved First Bloods in both the General and Junior divisions. We share several interesting cases, including cross-challenge dependencies, dynamic environment changes, and unintended solutions. We also discuss where full automation struggled and why. Finally, we discuss the role of experienced hackers in the LLM era. Experienced hackers do more than know exploitation techniques. They narrow the search space, recognize dead ends, and decide when to change direction. We discuss how such experience can be incorporated into future autonomous security agents.