ZeroNights 2026 Conference Program Highlights Offensive Security Research Across 30+ Talks
The ZeroNights 2026 conference program has been officially released, outlining a comprehensive agenda for cybersecurity professionals interested in advanced offensive techniques, vulnerability research, and secure development practices.
The event is scheduled for September 30, 2026, at 10:00 MSK in Saint Petersburg, Russia, at LOFT#7. It will feature three tracks, four stages, and more than 30 speakers.
Offensive Track – Heap Stage
The first stage of the Offensive Track focuses on modern exploitation techniques, vulnerability discovery, and binary exploitation. Notable talks include:
- «Keys to the Core: What Femtocells 3G/4G Give Us» by Artur Garipov, covering practical security analysis of seven devices from vendors including ip.access, NEC, Sercomm, Sagemcom, Alcatel, and Baicells, including extraction of IKEv2/IPsec keys and TR-069 configuration.
- «Surveillance for Zero Rubles: Exploiting Mobile Operators’ Advertising APIs» by Anton Bochkarev, demonstrating AdINT techniques for de-anonymization and geolocation tracking via public APIs.
- «Java Development Kit Compiled from 16 Million Lines of Open Source Code. The Illusion of Security» by Maxim Safronov, exploring Trusting Trust attacks on the JDK compiler and LLM-assisted attack preparation.
- «Rust In Peace» by Sergey Gordeychik, analyzing how Rust shifts bugs from memory corruption to panic-DoS and deserialization issues, with a custom pipeline applied to parsers and reverse proxies.
- «Slowburn: Breaking System Management Mode via AMD Platform Configuration Blob» by Timofey Duditsky, detailing the APCB mechanism and CVE-2025-54502.
Additional Heap Stage Presentations
Further talks cover Bluetooth stack exploitation in audio devices by Denis Goryushev, jailbreaking custom U-Boot in Dreame robot vacuums by Mikhail Dryagunov, and Qualcomm Snapdragon BootROM vulnerabilities including CVE-2026-25262 in EDL mode and Sahara protocol by Alexander Kozlov and Sergey Anufrienko.
Offensive Track – Stack Stage
The second stage continues with post-exploitation and hardware-focused research. Highlights include:
- «Localhost VPN: SSTP as a Post-Exploitation and Defense Evasion Tool» by Vyacheslav Tsepennikov, presenting Evil-SSTP for traffic redirection on compromised Windows hosts.
- «Correlation Power. Debug? Reversing Hardware with an Oscilloscope and Mathematics» by Alexey Shalpegin, recovering undocumented Scrambler mode in Realtek AES accelerators via side-channel analysis.
- «Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel Using struct device» by Alexander Popov, achieving stable local privilege escalation on Fedora 44 Server for x86_64.
- «LoRa Under Threat: Running Custom Code Inside Semtech Chips» by Egor Koleda, disclosing two hardware CVEs in the Semtech LR11xx family.
Additional Stack Stage talks address cross-chain bridge exploits, COM-based Windows attack techniques, modern Linux rootkits, and bypassing Dexprotector RASP protections on Android applications.
Related articles
Enodia: Open-Source Go Tool Automates Service Inventory, EOL Tracking and CVE Correlation
A DevOps engineer has released enodia, a single-binary Go CLI that discovers real versions of services across large heterogeneous environments and correlates them with end-of-life calendars and vulnerability databases. The tool was built after manual Ansible-based inventories and existing solutions such as endoflife.date, nvchecker, Renovate and Uptime Kuma proved insufficient for covering both infrastructure and application services while also providing actionable lifecycle, patch and branch status. Enodia uses product-specific probes for 123 technologies including PostgreSQL, MySQL, MariaDB, Jira, Confluence, Bitbucket, VMware vCenter, ESXi, pfSense and multiple Linux distributions, falling back to a generic URL-plus-regex probe when needed. Data collection is deliberately separated from evaluation so that inventory.jsonl files can be generated inside air-gapped networks and later analysed where CVE feeds are available. The project also contributed dozens of missing products and corrected EOL dates to the endoflife.date project and integrates both NVD and Russia’s FSTEC BDU vulnerability databases. Special handling was added for MySQL/MariaDB connection-error counters, version-string masquerading, and vendor-specific update nomenclature to avoid false reports.
Telegram Voice Call Flaw Allows Remote Code Execution on Android Devices
Security researchers disclosed a vulnerability in Telegram for Android that enables remote code execution on a victim's device simply by answering a voice call. The attacker requires only a standard account, and the flaw was present in versions 8.6.2 through 12.10.3 released between March 2022 and September 2026. Telegram addressed the issue in version 12.10.4, released at the end of September 2026. The root cause lies in improper handling of the MediaState message exchanged during calls, specifically when processing rotation values and missing video state fields, leading to out-of-bounds memory reads. The same underlying fix was deployed earlier to shared call libraries, iOS, and desktop clients, but reached Android later. Researchers confirmed the impact only on private calls running on ARM64 Android devices, with no evidence of exploitation in the wild or public CVE assignment as of October 29, 2026.
360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform to Government and Enterprise Users
360 Security Cloud has launched a dedicated self-assessment platform that allows organizations to scan their PHP-based websites and systems for the PHP2Shell vulnerability. The service is now available to government agencies, large enterprises, and small-to-medium businesses. Users can apply by scanning a provided QR code to determine how many of their assets run PHP, identify affected versions, and check whether any systems have already been compromised. The platform addresses key questions about exposure: the number of PHP-powered sites and systems, the presence of vulnerable versions, and signs of prior intrusion. The announcement emphasizes that the tool helps organizations proactively assess risk without requiring external assistance. The original Chinese report was published on October 30, 2026, and the service is positioned as a practical response to ongoing PHP-related security concerns.
Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A detailed analysis reveals how the use of Liferay Community Edition in a closed government information system led to the transmission of user passwords in plaintext through transactional emails. The issue stemmed from default notification templates that included the [$PASSWORD$] macro, combined with unadjusted system variables pointing to localhost instead of the production domain. Despite proper OAuth 2.0 delegation and CSRF protections, the misconfigured password change workflow sent permanent credentials in clear text to user inboxes. The root cause was traced to custom portlets that incorrectly reused the New Password Notification trigger intended only for administrator-initiated resets. Remediation involves removing the password macro from email templates and updating portal-ext.properties to enforce production host settings. The case highlights how open-source enterprise platforms require thorough hardening beyond initial code audits when deployed in high-security environments.