Enterprise server platforms are the bedrock of the modern internet. It would stand to reason that the foundation of IT infrastructure, the firmware and hardware of those systems, would be especially well audited and secured against advanced attackers. Unfortunately, history shows that the resilience of these components has suffered from an ever-increasing attack surface and insufficient scrutiny; today, this trend is only accelerating with the mass adoption of complex AI infrastructure at unprecedented rates.

In this work, we focus on analyzing the security of the Data Processing Unit (DPU), which has become ubiquitous in AI datacenters. This computer-in-front-of-a-computer promises to shield its host server by offloading networking, encryption, and security-related logic away from the host processor. But what happens when the DPU itself becomes the weak link? In this presentation, we demonstrate a UEFI secure boot bypass on the Nvidia Bluefield 3 DPU, and use it to build the first known DPU bootkit. We then show how it is possible to launch a DMA attack from the DPU targeting the host.

Microsoft's Resilient File System (ReFS) is a filesystem primarily found on Windows Server machines, designed for large-scale storage with built-in data integrity and resiliency. Its kernel driver parses a complex set of on-disk structures, most of which have very little official documentation, though the ReFuzz paper (2022) provided an extended foundation that proved invaluable during this research. In this talk, I will walk through the internals of ReFS, the strategies used to attack the driver, and the vulnerabilities discovered along the way. Multiple vulnerabilities were found including CVE-2026-49793 and CVE-2026-49792, which can be triggered by just mounting a crafted disk and performing some basic I/O with standard user privileges. The vulnerabilities were found in ReFS on-disk structures, particularly compression-related ones that have never been publicly documented previously.

This talk will walk through the internals of ReFS, the different strategies used to attack the driver, and the vulnerabilities discovered along the way.

Leveraging large language models for vulnerability discovery has become an important paradigm in security research. However, large-scale automated deployment still faces two major obstacles. First, LLM-generated vulnerability reports often suffer from high false-positive rates, creating substantial manual review costs. Second, vulnerability research requires more than report generation: it must integrate discovery, validation, PoC construction, and patch generation. In this talk, we present an end-to-end automated vulnerability research agent system for large codebases.

When using LLMs to audit large codebases, we frequently observe performance degradation as more code is added to the model context, even before the context window is full. Context management is therefore a primary focus of our work. We introduce three context-management mechanisms: reasoning-trace-driven adaptive compression, semantics-aware context separation, and report-directed context construction. With this design, our system identifies substantially more vulnerabilities than Claude Code in our experiments while maintaining a low false-positive rate.

We further extend our system with dynamic validation for Linux kernel vulnerabilities. Using a specially designed harness, the system iteratively debugs candidate vulnerabilities inside a QEMU environment and constructs PoCs capable of triggering KASAN.

For automated patch generation, we use multi-agent collaboration and fine-grained context management to reduce incorrect or incomplete fixes, unintended side effects, and new vulnerabilities introduced by generated patches. By separating patch generation and patch validation into dedicated agents, we establish a review-and-refinement loop that improves patch correctness and completeness.

To date, maintainers have confirmed 90 zero-day vulnerabilities identified by our system across projects including the Linux kernel, VirtualBox, and open-vm-tools. Of these, 62 have been fixed and 51 have been assigned CVE identifiers.

Apex Ghost: Unmasking Online Predators examines how Sadistic Online Exploitation (SOE) and Nihilistic Violent Extremist (NVE) networks identify, groom, and coerce young people—and what cybersecurity professionals can do to stop them. Through real-world cases, Ralph Logan shows how intelligence gaps allow known offenders to continue operating and how Apex Ghost combines threat hunting, open-source intelligence, data analysis, and cross-verified evidence to unmask perpetrators and deliver actionable intelligence to law enforcement. The session offers a stark look at adversary tradecraft, the limits of fragmented reporting, and how the security community can apply its capabilities and partnerships to protect children and drive real-world intervention.

Can higher order descriptive metadata alone aid automated exploitation of code repositories? Or are we stuck waiting for more sophisticated language models? 

A Cyber Reasoning System (CRS) is a program that can use threat information and source code to find and patch vulnerabilities in a code repository automatically. These systems increasingly use large language models for search with great effect, and the solution space for these systems has become very diverse. In this talk I will argue that while there is a very valid space for using a cyber reasoning system to protect key libraries, the solution space it often produces is narrower than desired.

To explore this notion of implementation versus algorithmic flaws in code, we will walk through a cyber security harness that produces code for the Lean 4 proof assistant as an intermediate representation language. The demo will explore this in practice with the Anthropic Glasswing demo harness, displaying the trade offs of using proof metadata as part of a cyber reasoning system. We'll contrast this with a larger parallel system that operates proof metadata in the context of an implementation of OSS-CRS. 

Modern inference systems load model artifacts they did not create. A checkpoint from a model hub, fine-tuning vendor, or conversion pipeline is parsed into tensors and consumed by native C++, CUDA, HIP, and Triton code. Offsets, shapes, block sizes, scale counts, and group indices eventually become allocations, loop bounds, and memory addresses. A file can parse successfully while unsafe relationships between individually valid fields remain unchecked.

This talk maps that boundary across vLLM, SGLang, llama.cpp, TensorFlow Lite, ONNX, and quantization tooling. Through public findings, assigned CVEs, maintainer-merged fixes, and matched negative controls, I show recurring failure patterns involving extent disagreement, cardinality mismatch, and invalid index domains. A public GPTQModel case traces checkpoint-controlled state to an out-of-bounds device read at the production Triton dequantization launcher.

The point is not a crash count. It is a reproducible method for separating source hypotheses, loader reachability, native-sink evidence, and demonstrated impact. Attendees leave with a practical approach for treating model artifacts as untrusted input and auditing the native consumers in their own inference stacks.