Apple security engineering chief Ivan Krstić outlined formal verification for cryptography, the SPTM replacement for PPL, and MIE memory protections. He also announced higher Apple Security Bounty awards, including up to $2 million for zero-click exploit chains.
Hexacon opening speaker Renaud Feil discusses how AI and automation may change vulnerability research, why practitioners should retain hands-on code-analysis skills, and the ethical responsibilities of offensive security work.
Tao Yan and Edouard Bochin explain a six-year-old Firefox Promise.allSettled flaw and its exploitation through garbage collection and type confusion. Their Firefox 138 demo disabled the sandbox because the exploit was renderer-only.
At HEXACON 2025, Benny Isaacs and Neil Braha explain how they exploited a Redis Lua use-after-free for 0-click RCE at Pwn2Own Berlin. Redis had disclosed a patch, and they withheld a PoC while organizations upgrade.
A Hexacon talk details reverse engineering of MediaTek Wi-Fi 6/7 firmware and kernel-module flaws, including unauthenticated frame injection and a beacon-triggered buffer overflow demonstrated for remote code execution. The presenter says all discussed issues have been.
At Hexacon 2025, Csaba Fitzl and Gergely Kalman demonstrated how a race condition in Mac OS OS analytics helperd could enable local privilege escalation and a sandbox escape. Apple patched the issue with entitlement and symlink-handling checks.
Sergei Volokitin says a USB buffer overflow in a Cyper rock hardware wallet let him extract a PIN and 24-word root seed. He says the vendor fixed the bug two days after his report, but took 186 days to respond; he also found an unchecked NFC APDU overflow.
Pumpkin explains a Linux io_uring race in buffer upgrades that can cause a use-after-free and map arbitrary kernel memory, then demonstrates privilege escalation in kernelCTF. The fix allocates a new buffer object instead of reusing one.
Quentin Salingue’s talk examines Apple Secure Enclave architecture and its protections, including pointer authentication, firmware patching and the trusted boot monitor. He explains how signed firmware and execution checks add layers of defense.
At HEXACON 2025, Philippe Laulheret demonstrated how flaws in Dell Control Vault enable persistent firmware modification, fingerprint login bypass and Windows SYSTEM access through a compromised security chip.
A team describes VirtualBox VGA and network-device flaws used to build a guest-to-host exploit. The speaker reports adapting it for Pwn2Own 2025, where the team won the virtualization category.
Wilfried Bécard describes NTLM and Kerberos reflection against Windows SMB that can yield SYSTEM-level access when SMB signing is not required. He says Microsoft’s June patch blocks the coercion path and recommends enabling SMB signing.
William Liu and Savino Dicanosa explain how a Linux traffic scheduler bug becomes a root exploit through red-black tree manipulation, including a variant that bypasses experimental kernelCTF mitigations.
HEXACON speakers described exploiting an Android Bluetooth heap overflow fixed in 2023 to obtain shells without user interaction. Tests on Xiaomi and Samsung devices showed low reliability, with repeated attempts taking roughly two to five minutes.
At HEXACON 2025, IBM X Force researchers demonstrated an NVIDIA GPU driver exploit that escaped a container on Azure serverless GPU compute and obtained a root shell on the host, exposing risks from shared-kernel isolation.
Donncha Ó Cearbhaill describes Amnesty International’s spyware investigations, including Pegasus targeting and the use of phone-forensics tools against people detained in Serbia, and calls for greater oversight of exploit sales.
Mikhail Evdokimov demonstrated a zero-click Bluetooth exploit against an Alpine infotainment system, achieving a root reverse shell. He said Alpine chose not to release a patch after the vulnerability was reported.
Sergei Volokitin describes a USB-over-SPI out-of-bounds write in an HSM based on Ledger hardware. With physical JTAG access to its MCU, the exploit chain enables code execution and private-key extraction; Ledger fixed the bugs.
The talk details cross-CPU allocation exploits for Linux kernel vulnerabilities in nf_tables and Traffic Control, including CVE-2023-31248 and CVE-2024-36978, and demonstrates privilege escalation despite allocator mitigations.
Researchers demonstrate Sinkclose, an AMD processor flaw that can elevate ring 0 access to system management mode and enable firmware tampering. AMD provided a microcode update, though the researchers said it might not cover every affected system.
Ginoah explains a patched Solana validator vulnerability introduced in version 1.16 and demonstrates how a malicious program could exploit memory mapping to achieve remote code execution.
Researchers demonstrated remote code execution on the Tesla Model 3’s VCC through a TPMS enrollment certificate overflow. The exploit enabled arbitrary CAN messages; Tesla released updated firmware with additional checks.
Philippe Laulheret explains how he reverse-engineered the Windows CLIP driver and found a license-signature bypass and kernel memory vulnerabilities. He says the reported bugs were fixed in July.
At Hexacon, Google researcher Clem1 explained how exploit hunters identify in-the-wild zero-days, how attackers fingerprint targets, and why messaging apps may become more attractive targets.
