ZeroNights 2026 Conference Program Highlights Offensive Security Research Across 30+ Talks
The ZeroNights 2026 conference program has been officially released, outlining a comprehensive agenda for cybersecurity professionals interested in advanced offensive techniques, vulnerability research, and secure development practices.
The event is scheduled for September 30, 2026, at 10:00 MSK in Saint Petersburg, Russia, at LOFT#7. It will feature three tracks, four stages, and more than 30 speakers.
Offensive Track – Heap Stage
The first stage of the Offensive Track focuses on modern exploitation techniques, vulnerability discovery, and binary exploitation. Notable talks include:
- «Keys to the Core: What Femtocells 3G/4G Give Us» by Artur Garipov, covering practical security analysis of seven devices from vendors including ip.access, NEC, Sercomm, Sagemcom, Alcatel, and Baicells, including extraction of IKEv2/IPsec keys and TR-069 configuration.
- «Surveillance for Zero Rubles: Exploiting Mobile Operators’ Advertising APIs» by Anton Bochkarev, demonstrating AdINT techniques for de-anonymization and geolocation tracking via public APIs.
- «Java Development Kit Compiled from 16 Million Lines of Open Source Code. The Illusion of Security» by Maxim Safronov, exploring Trusting Trust attacks on the JDK compiler and LLM-assisted attack preparation.
- «Rust In Peace» by Sergey Gordeychik, analyzing how Rust shifts bugs from memory corruption to panic-DoS and deserialization issues, with a custom pipeline applied to parsers and reverse proxies.
- «Slowburn: Breaking System Management Mode via AMD Platform Configuration Blob» by Timofey Duditsky, detailing the APCB mechanism and CVE-2025-54502.
Additional Heap Stage Presentations
Further talks cover Bluetooth stack exploitation in audio devices by Denis Goryushev, jailbreaking custom U-Boot in Dreame robot vacuums by Mikhail Dryagunov, and Qualcomm Snapdragon BootROM vulnerabilities including CVE-2026-25262 in EDL mode and Sahara protocol by Alexander Kozlov and Sergey Anufrienko.
Offensive Track – Stack Stage
The second stage continues with post-exploitation and hardware-focused research. Highlights include:
- «Localhost VPN: SSTP as a Post-Exploitation and Defense Evasion Tool» by Vyacheslav Tsepennikov, presenting Evil-SSTP for traffic redirection on compromised Windows hosts.
- «Correlation Power. Debug? Reversing Hardware with an Oscilloscope and Mathematics» by Alexey Shalpegin, recovering undocumented Scrambler mode in Realtek AES accelerators via side-channel analysis.
- «Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel Using struct device» by Alexander Popov, achieving stable local privilege escalation on Fedora 44 Server for x86_64.
- «LoRa Under Threat: Running Custom Code Inside Semtech Chips» by Egor Koleda, disclosing two hardware CVEs in the Semtech LR11xx family.
Additional Stack Stage talks address cross-chain bridge exploits, COM-based Windows attack techniques, modern Linux rootkits, and bypassing Dexprotector RASP protections on Android applications.
Related articles
BigDiskBuster Exploit Blocks Microsoft Defender Updates on All Supported Windows Versions
Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has released BigDiskBuster, a new exploit targeting Microsoft Defender that prevents the platform and antivirus signatures from receiving updates. The tool leaves Windows systems protected only by an outdated threat database while the interface continues to display normal status indicators. BigDiskBuster works across all currently supported Windows versions but requires continuous background execution. The researcher has published the source code on GitHub and acknowledged that the current implementation contains bugs requiring further refinement. The technique closely resembles the earlier UnDefend tool released in April, which similarly interfered with Defender update mechanisms. Naseri has disclosed nearly a dozen proof-of-concept exploits since April affecting Microsoft Defender, BitLocker, and other Windows components, including ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and Plasma variants. Microsoft has not yet issued a patch for BigDiskBuster and previously criticized uncoordinated public disclosures of working exploits.
WordPress Click2Shell Flaw Chain Lets Attackers Achieve RCE via Single Admin Click
Researchers discovered a chain of vulnerabilities in WordPress core named Click2Shell that enables remote code execution without attacker authentication. The attack requires only that a logged-in administrator opens a specially crafted preview link, after which the interface automatically installs a malicious theme. Researcher Paulos Yibelo from pwn.ai found that inconsistent parameter handling between the theme directory API and browser JavaScript allowed the crafted URL to trigger installation without user interaction. A second vulnerable component, the Mobile Repair Zone 2.5.4 theme from the official directory, was used to load arbitrary PHP code and abuse an insecure AJAX handler for plugin installation. Successful exploitation grants full access to wp-config.php, database credentials, file modification rights, and the ability to create new administrators. WordPress addressed the issue in version 6.7.1 and backported fixes to supported branches, while the constant DISALLOW_FILE_MODS offers temporary mitigation by blocking theme and plugin changes.
Cache Key Injection Flaw in Nginx Configurations Allows Access Bypass, Data Disclosure and Cached Denial of Service
Security researcher Alex Brumen from YesWeHack has detailed a Cache Key Injection attack vector that exploits poorly constructed cache keys in Nginx. The issue arises when administrators concatenate variable-length values without delimiters, such as $scheme$host$request_uri$http_accept, allowing different requests to produce identical cache keys. Attackers can poison the cache with 404 responses to deliver CPDoS, expose restricted pages like /admin by manipulating path components, or even achieve stored XSS by colliding HTTP and HTTPS responses. The technique can also bypass Cloudflare protection when the Authorization header routes requests directly to the vulnerable Nginx cache. Mitigation requires using explicit delimiters or structured encoding in cache keys, validating the Host header, enforcing HTTPS redirects, and avoiding caching of authenticated requests.
Click2Shell Flaw in WordPress Core Enables Remote Code Execution via Single Malicious Link
Researchers at pwn.ai have disclosed Click2Shell, a vulnerability in the WordPress core that allows an attacker to install a malicious theme and achieve remote code execution simply by tricking an authenticated administrator into opening a crafted link. The isolated flaw carries a CVSS score of 7.1, but the full attack chain reaches 9.6. The issue stems from an interpretation mismatch between the WordPress.org theme directory and the administrator browser, causing the browser to automatically trigger the install button without any user confirmation or password prompt. Affected versions start from 6.0 and run up to but not including 7.1.1. The vulnerability has been fixed in WordPress 7.1.1 with backported patches released for all supported branches down to version 4.7. No exploitation in the wild had been observed at the time of disclosure, yet the low barrier of convincing an admin to click a link makes prompt patching essential.