The Black Hat Asia 2026 briefings (Marina Bay Sands, Singapore), rebuilt talk by talk from the speakers' published decks and white papers. Analysis-first: each post explains the research question, the core idea, and what defenders and builders should change. It deliberately leaves out indicators and step-by-step reproduction, so follow the official slides for that. Newest posts appear at the top.
One post per briefing, added as each deck is read and written up.
A five-stage pipeline reads a fresh CVE's patch, clusters Chromium's codebase to find which of ~3,000 runtime flags covers the vulnerable path, ranks candidates by performance cost, and ships a defensive mitigation within hours, before the real patch lands.
Android's SurfaceFlinger (what's drawn) and InputDispatcher (what's touchable) independently track window state, reconciled only by a data hand-off. That mismatch, plus a Binder one-way IPC gap, produced a no-permission tapjacking chain fixed as CVE-2025-48621.
A four-stage pipeline, SAST filtering, runtime instrumentation, automated JVM memory-graph search, and constrained AI-assisted PoC generation, systematically discovers 7 new fileless Spring memory-shell families, more than tripling the known count.
A proprietary quantum circuit sent to an untrusted compiler gets extra gates that corrupt its output; a short classical key then restores the correct answer with plain bit-flip logic, no second quantum circuit or barriers needed.
Instead of brute-forcing a full UDS Security Access key space, AlgoBuster fingerprints the weak algorithm family by response timing and brute-forces only that. 2 of 12 real ECUs broken, one in 38 minutes.
Palo Alto Networks tested Claude Code, Cursor, Codex, Gemini CLI and more, finding the same command-injection, filesystem-escape and sandbox-escape bug classes repeat across nearly every product. 81+ reports, 18 CVEs, ~k in bounties.
EDNS Client Subnet quietly widens the aggregation key that has blocked the DNS Birthday Attack since 2002. 18 of 22 tested DNS software are vulnerable; 365,000+ open resolvers estimated exploitable; 35 CVEs assigned.
Fuzzing USB Control Transfers with the safety limits removed uncovers the same bug class at every layer of the Android boot chain, down to the immutable Boot ROM itself, on both Google Tensor and Samsung Exynos silicon.
A driver leak, a side-channel KASLR bypass and a firmware code-execution bug in a widely shipped MediaTek Wi-Fi 7 chip chain into SYSTEM privileges on the latest Windows — exposing how little the firmware/kernel boundary is audited.
Across 17 devices and 92 apps, weak enumerable IDs and shared keys turned local flaws into fleet-wide free rides, free charging, denial of service and account hijacking. 57 vulnerabilities, 18 identifiers.
Three $196-a-year Tor exit relays plus an LLM analyzer exposed 45 IoT vulnerabilities (29 zero-days) affecting ~12.7M devices, and the disclosure triggered mass offlining, CISA KEV listings and 1M+ honeypots.
PID-domain services share an app's sandbox but carry extra entitlements. An LLM-assisted static-analysis pipeline audited 302 services and 2,394 APIs, yielding 19 acknowledged bugs and 7 Apple CVEs.
Fast Pair's pairing-mode check is skipped by many accessories: 68% of 25 devices from 16 vendors could be hijacked in about ten seconds, with microphone control and covert Find Hub tracking. Firmware updates are the fix.
Adobe's blueprint for hardened base images that stay trustworthy: declarative builds, trigger-driven rebuilds, SBOMs and provenance, signing and verification, and an immutable registry.
A CTF-style contest where 108 student teams built AI bots to sway a simulated election: ~11.8 million posts, under $100 budgets, a 1.78% swing, and guardrails most found easy to bypass.
Windows ships about 2,600 self-describing TraceLogging providers that no standard tool can list. TLGMapper maps 73,000 events to their providers and surfaces new detection sources for driver abuse, UEFI access and ClickFix launches.
Millions of Windows logon events become a small user-host graph, ranked by PageRank and an HMM, then investigated by a guarded closed-loop LLM agent. Precision 0.90, recall 0.931, and a real intrusion triaged in 195 seconds.
Instead of publishing a malicious package, what if you compromise the registry's own backend logic? Disclosed, fixed bugs across LuaRocks, JuliaHub, NuGet, and CocoaPods show manifest generation, git-based version resolution, metadata-file selection, and account verification are all part of the trust boundary.
Two RFCs disagree about which characters a domain name may contain, and many real implementations silently drop queries with disallowed characters instead of erroring. That silence turns a sub-100ms cache-poisoning race into a multi-second window — reviving brute-force poisoning thought dead since 2008, at internet scale.
OpDiffer and APIDiffer use LLMs to generate spec-valid test cases and judge real bugs vs. benign differences across Ethereum's diverse client implementations — 98 real bugs found across all 11 mainstream clients, including a spec-level error.
Serial-to-IP converters bridge decades-old ICS equipment onto IP networks and are already a real attack target (Sandworm, Industroyer, the 2025 Poland grid attack). They're ordinary embedded Linux boxes — new critical RCE and auth-bypass flaws mean full takeover, not just DoS.
A high-level look at layered boot security on Qualcomm's MDM9207 IoT modem chipset (CVE-2026-25262): four stacked trust guarantees, tested one by one, and why "needs physical access" still matters for field-deployed IoT hardware.
A custom password generator whose toLowerCase() collapses 62 chars to 36 makes the E2EE root password brute-forceable; with AES-CBC (no integrity), no key rotation, and TOFU keys, a malicious server reads and forges every message. ProVerif + code review + OSINT.
The Windows RPC runtime can't verify a server is legitimate, so a low-priv process with SeImpersonatePrivilege can register a phantom server and impersonate SYSTEM — a "Potato"-class LPE. The novel part: an ETW-driven pipeline that auto-discovers new triggers.
How CVE-2025-55182 — the React Server Components / "Flight" deserialization RCE attacked over a billion times in week one — works: a rich JS wire format that can reference built-ins, plus await's recursive resolution of any object with a then method.
Windows Admin Center is the bridge between Azure and on-prem — and five CVEs (writable ProgramData LPE, PoP-token-mixing tenant-wide RCE, unvalidated attestation, flow-redirection/XSS) chain into bidirectional compromise. Treat management tools as Tier Zero.
E2EE moves the attack surface from server to client: silent online-status recon, per-device OS fingerprinting, and pinpointed exploit delivery to one device via the Sesame multi-device protocol — the recon+delivery half of a targeted 0-click kill-chain.
A generic patch-bypass methodology turns one Windows auth-reflection fix into a chain of SYSTEM-shell CVEs. The clever core: a Unicode homoglyph makes a DNS record and an SPN collide under AD's sort keys, rebuilding Kerberos coercion.
FPGA-based live memory scanning shows AES keys survive abnormal termination, get duplicated into kernel memory by vector-register context switches and core dumps, and persist across reboots. Zeroization is a whole-stack problem.
An autonomous DFIR agent (LLM + Velociraptor over MCP) can be turned against the investigation by instructions planted in the artifacts it collects — Hide, Mislead, Exploit. Strict structured output drops the attack to ~0%.
A hidden prompt injection in a public module can make an LLM emit a "reasonable-looking" insecure cloud config that passes every static scanner. IntentGuard encodes infrastructure into description logic and flags where the config violates intent.
The guest-network isolation feature is enforced one layer at a time, so an attacker who moves between the Wi-Fi, IP, and Ethernet layers walks around it — into full two-way MitM. Every tested device was vulnerable.
Casting a 16-bit char to an 8-bit byte drops the high byte, so a Unicode character becomes an attacker-chosen ASCII byte. A WAF sees safe Unicode; the parser sees the payload. The bug class, its many faces, and the fix.
What a quantum computer breaks, why nobody knows when, what NIST PQC costs in bytes, what's deployable today, and a four-phase quantum-risk management loop.