Black Hat Asia 2026 | Cache Me, Catch You: Exploiting LLM Caching Layers in vLLM, GPTCache & Friends

Large language models (LLMs) are now embedded in every cloud, SOC, and product team—but almost nobody is looking at the "boring" cache layer that keeps them fast. In this Briefing, we will show how that invisible layer becomes a powerful offensive entry point. Modern serving stacks such as vLLM, SGLang, GPTCache and commercial gateways aggressively cache prefixes, multimodal features, and semantic embeddings to save GPU time. We performed a systematic teardown of these caching implementations and found that performance shortcuts—non‑cryptographic hashes, lossy serialization, and fuzzy similarity matching—open a brand‑new attack surface during inference, not training. We will walk through six practical attack primitives: system‑prompt hash collisions that silently rewrite assistant instructions for every tenant sharing a cache; block‑wise collisions that make entire malicious blocks "invisible" to the model; multimodal collisions that let a weaponized image inherit a benign cache entry and pass content moderation; and two forms of semantic fuzzy poisoning that turn customer‑support or RAG pipelines into a misinformation delivery channel. Each attack costs under one US dollar to run and, in our experiments, reached up to 100% cache‑hit rate for targeted prompts and 75% poisoned‑hit rate against popular semantic caches. We then flip to the defender's perspective. Based on real patches and CVEs issued by major frameworks, we show what actually works in production: salted and cryptographic prefix hashes, canonical serialization for images and tensors, safer cache isolation in multi‑tenant deployments, and cheap LLM‑based filters that sit in front of semantic caches to kill poisoned hits before users see them. Attendees will leave with a concrete checklist they can apply to their own LLM APIs, gateways, and "AI platform" teams to stop cache‑layer abuses before attackers get there first. We will release PoC tooling that operators can immediately run against their own stacks to detect vulnerable deployments. Xiangfan Wu | Student, Ocean University of China and Tencent Zhuque Lab Lingyun Ying | Researcher, QI-ANXIN Technology Research Institute Guoqiang Chen | Security Researcher, QI-ANXIN Technology Research Institute Yacong Gu | Postdoctoral Researcher, Tsinghua University Haipeng Qu | Professor, Ocean University of China https://ift.tt/MB3CetL

source https://www.youtube.com/watch?v=P0KDHhGLXgE

Black Hat Asia 2026 | How OS, Libraries, and Hardware Keep Your AES Keys Alive

FIPS 140-3 requires cryptographic modules to ensure that sensitive security parameters, including AES keys, are reliably zeroized once they are no longer needed. In practice, however, real systems behave very differently from what this requirement implies. Even when applications appear to implement proper zeroization, surrounding layers such as cryptographic libraries, operating systems, and hardware continue to influence how long keys remain in memory in ways developers cannot easily observe. In this Briefing, we will present the first system-wide, empirical analysis of key zeroization behavior using an FPGA-based live memory forensic technique capable of monitoring physical memory independently of the CPU. By applying this method to Linux and Windows 11 on AArch64 SoC environment (Xilinx KR260) and Intel/AMD PCs with Alinx AXKU3 via Thunderbolt, we uncover several previously unrecognized zeroization failures. AES round keys processed within CPU vector registers are copied into kernel save areas during context switches and remain unzeroized after process termination. Abnormal termination conditions, including signal-based crashes, cause keys to persist for seconds to hours, and distribution-specific crash reporting mechanisms may duplicate them further into core dumps. Most strikingly, we observe that certain systems fail to zeroize memory during reboot, allowing AES keys to survive across system restarts despite expectations derived from FIPS 140-3 guidance. These findings reveal a fundamental gap between the zeroization guarantees assumed during module development and the actual behavior of deployed systems. Our work provides a new methodology for evaluating zeroization on real hardware and offers practical insights for application developers, library maintainers, and OS vendors seeking to meet the intent of FIPS 140-3. Ultimately, we show that zeroization must be validated as a system property, not merely as a software implementation detail. Toyofumi Sawa | Ph.D. Candidate, Institute of Information Security Kuniyasu Suzaki | Professor, Institute of Information Security https://ift.tt/NfcePBa

source https://www.youtube.com/watch?v=r5kkRtEsKT0

Black Hat Asia 2026 | Remote Server, Local Root. Welcome to MCP.

As Large Language Models (LLMs) evolve into autonomous agents, the Model Context Protocol (MCP) has become the de facto standard for connecting AI to external systems. MCP not only enables tool invocation through structured message exchanges, but also supports privileged user-data retrieval from remote servers. To support this, MCP adopts several OAuth-based mechanisms to dynamically establish authorization sessions. However, in doing so, it unintentionally introduces new threat vectors that traditional OAuth applications were never exposed to. In this Briefing, we will uncover a novel attack surface within the MCP authorization flow. By abusing the dynamic nature of this flow, we demonstrate how authorization metadata—traditionally sourced from pre-registered, trusted identity providers—becomes a powerful attack vector when MCP clients accept it dynamically from arbitrary remote servers. Through a systematic analysis of three major classes of MCP clients—browser-based, process-based, and hybrid—we show how this design flaw leads to severe outcomes, including Remote Code Execution (RCE), Local File Execution (LFE), Account Takeover, and Cross-Tenant Data Exfiltration, depending on the client architecture. Our analysis was validated across real MCP implementations and acknowledged by major vendors, including Anthropic and Google. To date, our research has resulted in five assigned CVEs and multiple bounty rewards, including an RCE in MCP Inspector (CVE-2025-58444) and a command injection vulnerability in Google's Gemini CLI. Additional CVEs were assigned to Cherry Studio (CVE-2025-54074), Dify (CVE-2025-58747), and other MCP clients, along with further confirmed impacts across multiple SaaS platforms. Jiacheng Zhong | Security Researcher, Shuyang Wang | Head of Security Research, Obsidian Security Zhengyu Liu | Ph.D. Student, Johns Hopkins University Aonan Guan | Senior Cloud Security Engineer, Wyze Labs https://ift.tt/idtmhnM

source https://www.youtube.com/watch?v=wYcG_6SS788

Black Hat Asia 2026 | Exploiting Message Queue Flaws in AI Inference Servers for Widespread RCE

AI inference servers have become critical infrastructure for deploying large language models at scale, with platforms like vLLM, SGLang, TensorRT-LLM, and others processing millions of enterprise AI workloads daily. These systems rely on inter-process communication channels to coordinate distributed model inference across GPU clusters, but we discovered that the standard architectural patterns used across the industry contain fundamental security flaws. We identified multiple Remote Code Execution vulnerabilities in the message queue implementations used by all major open-source AI inference platforms, affecting deployments from Meta, NVIDIA, Microsoft, and the PyTorch ecosystem. Through our internet-wide scanning, we confirmed thousands of vulnerable instances are directly exposed online, creating an attacker-accessible pathway into AI infrastructure at organizations worldwide. The vulnerabilities stem from dangerous code reuse patterns where insecure "reference implementations" were copied across projects, propagating the same logical flaws throughout the AI supply chain. In this Briefing, we will reveal the complete technical details and working exploits for these RCE vulnerabilities, demonstrate attacks against multiple platforms, and share our complex coordinated disclosure process across numerous vendors. We'll show how attackers can gain code execution on AI servers, potentially stealing models worth millions in training costs, poisoning inference results, or pivoting into broader enterprise networks. This research exposes critical lessons about security versus performance trade-offs in AI systems and the unique risks of rapid open-source code sharing in the AI community. Avi Lumelsky | Senior AI Researcher, Oligo Security Uri Katz | Senior Vulnerability Researcher, Oligo Security Gal Elbaz | CTO and Co-Founder, Oligo Security https://ift.tt/mRYtoTX

source https://www.youtube.com/watch?v=R7RWtcN5rAY

Black Hat Asia 2026 | Qualcomm BootROM: A Journey Through Sahara

BootROM is a critical component in the security architecture of many system-on-chips (SoCs), including the Qualcomm Snapdragon and MSM/MDM-family SoCs, deployed in billions of smartphones and IoT devices worldwide. As an embedded, immutable component, BootROM serves as the root of trust for the entire Secure Boot chain. This Briefing will present a comprehensive analysis of new vulnerabilities found by our team at the BootROM level: vulnerabilities in Emergency Download Mode (EDL) and its Sahara protocol, which allow bypassing cryptographic verification of Secondary Boot Loader (SBL) images and subsequent boot stages. The Briefing will demonstrate that functional vulnerabilities in EDL mode allow an attacker with physical access to the device to gain complete control of the modem subsystem and its QuRT operating system. Alexander Kozlov | Principal Security Researcher, Kaspersky Lab Sergey Anufrienko | Security Research Group Manager, Kaspersky Lab https://ift.tt/GT6lNwY

source https://www.youtube.com/watch?v=ZlWvdRBuxpc

Black Hat Asia 2026 | When Office Attacks: XLL Chains and Enterprise EDR Nightmares

Threat actors using malicious macros and XLLs as an attack vector is a tale as old as time. EDR and AV products developed to mitigate this are now well-equipped to stop malicious Microsoft Office macros, right? Turns out, not necessarily! Three years and countless malware infections later, we'll demonstrate how attackers continue to innovate, finding new ways to weaponize Office macros and XLL files to establish footholds in protected environments. As a red teamer, I spend an abundance of time doing security R&D to identify unique ways to break in, hide or break out of systems. The outcome of one such research cycle this year was a Frankenstein's monster of payloads, created using well-documented techniques and tactics to gain a foothold in a Windows system and bypass enterprise-level EDR detections. By combining Excel XLLs and Word macros, I created an attack chain that exploits the implicit trust organizations placed in legitimate business workflows. In this talk, I will dissect my custom initial access payload that chains macros and XLLs in unexpected ways with several sophisticated evasion techniques. We will explore the inner workings of Excel add-ins, COM automation, and process relationships that enable this technique to evade current popular EDR solutions. More importantly, we will examine why enterprise EDR deployments struggle with detection when operating at scale. Both offensive and defensive practitioners will gain valuable insights from this research. Red teamers will understand how legitimate business tools can be leveraged for initial access, while defenders will learn critical detection engineering strategies and incident response techniques. We will explore practical methods to identify, investigate and respond to such exploits and monitoring strategies, including a key configuration in a top EDR solution to detect this attack chain. This Briefing bridges the gap between offensive research and enterprise defense, providing actionable intelligence for organizations looking to strengthen their security posture against sophisticated macro-based attacks. Thanmayee Rao | Senior Red Team Engineer, Amazon https://ift.tt/JnfEKi4

source https://www.youtube.com/watch?v=RVAya4SoVBU

Black Hat Asia 2026 | IDEsaster 2.0: Another Novel Vulnerability Class in AI IDEs

AI IDEs continue to be on the rise, and they are not going away anytime soon. Last year, alongside dozens of vulnerabilities published publicly in AI IDEs, I published "IDEsaster" exposing a novel vulnerability class using AI agents and IDE features, leading to over 20 CVEs. This follow‑up research demonstrates that the architectural risks go deeper than previously understood. This Briefing presents (once again) a new universal vulnerability class affecting all AI IDEs. Unlike the previous attack chain, this one targets an underlying component that all of you use. A component not originally designed with the Secure for AI principle in mind, yet it strongly affects how IDEs behave. When AI agents interact with this component, it creates a powerful and largely invisible attack surface leading to an IDEsaster. The session concludes with higher‑level architectural insights on how AI applications need to be built to avoid this repeating issue. Ari (MaccariTA) Marzouk | Senior Security Researcher, Microsoft Red Team https://ift.tt/41IBs2u

source https://www.youtube.com/watch?v=uiIy9xUWGqU

Black Hat Asia 2026 | AirSnitch: Breaking Client Isolation in Wi-Fi Networks

We will present AirSnitch, a set of attacks that bypass Wi-Fi client isolation in home and enterprise Wi-Fi networks, enabling untrusted clients to attack others despite the usage of client isolation. Our attacks bypass Wi-Fi encryption and are effective even against modern WPA2/3 networks. Sometimes also called AP isolation, client isolation is not a standardized feature of Wi-Fi. Instead, vendors added it as an ad-hoc defense to prevent clients from attacking each other. For instance, client isolation prevents traditional ARP-based MitM attacks. However, we find that it is often implemented in inconsistent and insecure ways. We will present three main attack techniques to bypass client isolation. First, an adversary can abuse shared group keys to inject arbitrary traffic to a victim. Second, client isolation is often only implemented at the Ethernet layer, enabling bypasses at the IP layer. Third, an adversary can manipulate the forwarding tables of internal switches and bridges to intercept traffic despite the usage of client isolation. All combined, this enables us to restore MitM capabilities even in the face of client isolation. We find that most home routers are vulnerable, confirm vulnerabilities in real-world enterprise networks, and find that major operating systems such as Android, macOS, iOS, Windows, and Linux are affected. Mathy Vanhoef | Professor, KU Leuven University Zhiyun Qian | Professor, University of California, Riverside Xin'an Zhou | PhD Student, University of California, Riverside Juefei Pu | PhD Student, University of California, Riverside Zhutian Liu | PhD Student, University of California, Riverside Zhaowei Tan | Professor, University of California, Riverside Srikanth Krishnamurthy | Professor, University of California, Riverside https://ift.tt/ohtpIEV

source https://www.youtube.com/watch?v=1nevVb8ynsA

Black Hat Asia 2026 | Systematic Algorithmic Brute-Force Attacks Against UDS Security Access

The Unified Diagnostic Services (UDS) protocol—often referred to as the "HTTP of automotive ECUs"—relies on Service 0x27, "Security Access," to safeguard safety-critical operations, such as firmware reflashing, VIN rewriting, or ADAS calibration. Prior research has predominantly focused on firmware reverse-engineering, fault injection, or brute-forcing the key. However, with the widespread adoption of encrypted JTAG, hardened hardware, and secure supply-chain governance, these avenues are increasingly obstructed, rendering successful attacks rare and prohibitively expensive. We therefore introduce an algorithmic brute-force paradigm that reconstructs the algorithmic structure embedded within the ECU. Through three real-world case studies, AlgoBuster's battlefield performance is demonstrated. The framework has been tested on 12 ECUs launched after 2018 (covering nine Tier-1 suppliers), two of which were successfully broken. Jianwen Ren | ETAS Cybersecurity Consultant | Security MM Team Member, ETAS Jianchi Jiang | Automotive Security Engineer |Security MM Team Member, SGS Brightsight Su Shengfeng | Vehicle Security Engineer | Security MM Team Member, Ford Motor Company Lin Zengda | Security Researcher, Chen Guannan | OSR Security Researcher | Security MM Team Member, https://ift.tt/BpWOTFx

source https://www.youtube.com/watch?v=1RFx_5p3DYY

Black Hat Asia 2026 | IntentGuard: Securing LLM-Generated Cloud Configurations

GenAI assistants increasingly generate and modify configuration files—Kubernetes manifests, Terraform configurations, AWS CloudFormation templates, Helm charts, and others. These artifacts are security-critical, yet modern scanners and linters evaluate only correctness against predefined rules, not the operational intent the configuration is supposed to enforce. This creates a new attack surface: adversaries can poison configuration templates (via model jailbreaking or prompt injection), so that natural-language cues silently steer LLMs toward producing insecure configurations that still appear functionally correct. These "semantic misalignments" evade IaC scanning and pass human review because the generated configuration looks plausible but no longer matches the intended project purpose and security posture. This talk introduces IntentGuard, a novel Intent-Aligned Semantic Validation defensive framework that infers the intended behavior of a project, including configuration templates and marks configurations that contradict that intent. By reconstructing the service's intended role in the project—capturing its business, operational and performace roles, permitted communication graphs, dataflow and dependencies, privilege boundaries, —the framework identifies when configurations violate those structural and semantic intentions, enabling detection of latent misconfigurations such as conditional privilege escalation, unauthorized resource access, RBAC drift, information leakage, and infrastructure-level backdoors. Rather than relying on brittle prompt hardening or traditional scanners, intent-aligned validation detects when an LLM's output ceases to represent what the configuration was meant to enforce—even if the configuration is syntactically valid and operationally sound. Anna Bacher | CTO-Co-Founder, Jaroona GmbH Chris Wysopal | Co-Founder & Chief Security Evangelist, Veracode, Inc. https://ift.tt/GB2ASOY

source https://www.youtube.com/watch?v=Kd2eqp8ZUpA

Black Hat Asia 2026 | Faster Detection and Counteraction of N-Day Exploits in Chromium-based Apps

N-day exploitation speed is accelerating. For certain high-impact Chromium vulnerabilities, we observed exploitation attempts appearing shortly after public disclosure as fast as 24 hours, creating intense pressure on defenders. Yet many enterprise client applications built on Chromium face an asymmetric challenge: their release cadence and user-upgrade reality often lag behind attackers. Deep customization of the Chromium engine, fragmented client versions, and user groups that cannot readily update mean that official patches may take significant time to reach all endpoints. During this window, even well-managed products remain exposed. This talk presents a complementary, in-app defense architecture designed to operate alongside traditional patching, especially for applications where upgrading the underlying Chromium engine is slow or operationally difficult. Which integrates: • Accelerated patch analysis and down-version migration, enabling rapid internal adaptation of Chromium fixes across heterogeneous client baselines. • How to build an AI-based behavior-driven, in-app runtime detection capable of identifying exploitation attempts for newly disclosed CVEs across multiple client versions. • Realtime, on-client counteraction mechanisms that can disrupt or neutralize exploitation attempts, providing protection before a patched release can reach to the entire user base. This approach shortens the exposure window by adding a runtime, version-agnostic defense layer that can immediately respond to emerging threats. We will demonstrate how enterprises can enhance Chromium-based products with a layered, resilient protection model to reduce the operational risks posed by fast-moving N-day exploitation. Wenxiang Qian | Security Engineer Zhixin Tu | Security Engineer https://ift.tt/ClH5Gqe

source https://www.youtube.com/watch?v=-xaIpNlecJM