media.defcon.org resources

media.defcon.org

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-07.

Talks 6 RCE 3 AI 2 AuthN 1 Burp 1 Fuzzing 1 Python 1

Date Added	Resource	Excerpt
2026-11-07 2026	DEF CON 34: CRLF Powered Desync Attacks (Stacey, Righi)Talks	Stacey and Righi presented at DEF CON 34 on CRLF-powered desynchronization attacks. These attacks exploit the way web servers and intermediaries handle HTTP requests, specifically by injecting CRLF characters to manipulate parsing and potentially trick a server into processing a request intended for one user as if it were for another. This can lead to various security vulnerabilities, allowing attackers to gain unauthorized access or perform actions on behalf of other users. The presentation likely detailed methods for identifying and exploiting these vulnerabilities.
2026-11-07 2026	DEF CON 34: Beyond the Ceremony, the 2026 Passkey Attack Surface AuthN Talks	This DEF CON 34 talk, "Beyond the Ceremony, the 2026 Passkey Attack Surface," explores potential vulnerabilities and attack vectors for passkeys. It delves into the evolving landscape of passwordless authentication and anticipates challenges and security considerations for passkey adoption leading up to and around 2026. The presentation aims to highlight the critical areas where security needs to be strengthened as passkey technology becomes more widespread.
2026-11-07 2026	DEF CON 34: From Fuzzer Noise to Zend Engine 0day Fuzzing RCE Talks	This presentation from DEF CON 34 details the process of discovering a Zend Engine 0-day vulnerability. It covers how fuzzer noise, often dismissed as irrelevant, can be meticulously analyzed to uncover critical security flaws. The speakers share their methodology for transforming random fuzzer outputs into actionable exploits within the Zend Engine, a core component of PHP. The content likely focuses on the technical aspects of fuzzing, exploit development, and the significance of finding such vulnerabilities in a widely used technology.
2026-11-07 2026	DEF CON 34: Breaking Local AI Runtimes, exploiting llama.cpp and Ollama AI RCE Talks	At DEF CON 34, researchers demonstrated critical vulnerabilities in local AI runtime environments, specifically targeting llama.cpp and Ollama. They successfully exploited these systems to gain unauthorized access and execute arbitrary code. The presentation highlighted the security risks associated with popular local AI models and urged developers and users to implement stronger security measures. The exploits showcased could lead to data breaches and system compromise if not addressed promptly.
2026-11-07 2026	DEF CON 34: Unveiling Python Class Pollution in the Wild Python RCE Talks	At DEF CON 34, researchers demonstrated "Python Class Pollution," a vulnerability where attackers can manipulate Python object attributes in deployed applications. This technique allows malicious code to be injected and executed by altering class definitions or instances, potentially leading to unauthorized access or control. The vulnerability highlights the risks associated with improperly secured code execution environments and the dynamic nature of Python. The presentation emphasized the need for robust input validation and secure coding practices to mitigate such attacks.
2026-11-07 2026	DEF CON 34: Can AI do novel security research? Meet the HTTP Terminator (James Kettle)AI Burp Talks	At DEF CON 34, James Kettle presented "The HTTP Terminator," a project exploring AI's capability in novel security research. The presentation likely demonstrated how AI can be used to discover new vulnerabilities or research security concepts, moving beyond traditional manual methods. The core question addressed was whether artificial intelligence can independently conduct groundbreaking security research.