Black Hat Asia 2026 | the Source, Of the Source

Sure, you can double‑check package names, stick to trusted maintainers, and install only from reputable sources. But even if you play everything perfectly, what happens when the infrastructure itself is what gets pwned? This research goes past the packages themselves and straight into the machinery underneath: exploiting the registry services, CDNs and proxie that every build quietly depends on. Once we treated those systems as the real attack surface, things got interesting fast. This talk walks through how we uncovered critical vulnerabilities across package distribution infrastructure of JavaScript, Julia, Go, .NET, Lua, and more — bugs that enabled account takeover, package hijacks, server-side RCE, and other ecosystem‑level compromises quietly embedded in the infrastructure. Even when developers do everything right, the systems delivering their code can still be the weak link. The problem isn't always just your dependencies; it's sometimes the systems that ship them. This is our journey into breaking (and ultimately helping secure) the foundations of modern software distribution. Tsi-Lin Ng | Security Researcher, DEVCORE https://ift.tt/Z5EBAl2

source https://www.youtube.com/watch?v=TPpHyYv6SqU

Black Hat Asia 2026 | Cyber-Paleontology in the Age of AI

A sophisticated cyber-espionage toolkit can disappear for decades-and still outperform modern implants. In this Briefing, we will present the discovery and reconstruction of an undocumented nation-state framework believed to have gone extinct more than 20 years ago. Although buried in time, this "fossil" malware reveals engineering decisions that remain surprisingly competitive today, and it appears to have quietly influenced reconnaissance platforms that emerged long after it. But the story isn't only about the tool. Because this framework was never publicly documented, it creates a rare testbed for something security teams are increasingly relying on: AI-driven malware analysis and attribution. We use the case to measure how modern AI systems behave when they cannot rely on training data, prior writeups, or recognizable patterns-and compare their conclusions to careful, expert-led reverse engineering. The result is both a recovered chapter of cyber-espionage history and a grounded look at where AI helps, where it misleads, and what its failure modes look like in cyber-paleontology. Vitaly Kamluk | Founder, TitanHex+SentinelLABS https://ift.tt/ZzTCFgW

source https://www.youtube.com/watch?v=2F0mFtGqsl0

Black Hat Asia 2026 | Discovering React2Shell: JavaScript’s Long-Awaited Deserialization Flight-mare

Millions of exposed sites. Over a billion attack attempts in a week. When you hear "Insecure Deserialization", you usually think of legacy Java apps, PHP behemoths, or crusty .NET projects – not the most popular modern JavaScript framework. React2Shell (CVE-2025-55182) challenged this, proving that "this code is widely used and battle-tested, so I'm sure it's secure" doesn't mean we can't teach this new dog some old deserialization tricks. This Briefing will cover the novel attack surface of deserializing complex JavaScript objects and building sophisticated exploits that abuse quirks of the language, V8 engine, and Node.js runtime. As well as detailing how I discovered React2Shell, I'll also share the impact of AI hallucinations, the double-edged sword of day-zero defenses, and lessons learned across the industry. Lachlan Davidson | Security Innovation Lead, Carapace https://ift.tt/ZUhyfKX

source https://www.youtube.com/watch?v=JtYAuqS4fsg

Black Hat Asia 2026 | Post-Quantum Cryptography: A Realistic Guide to Manage the Transition

The quantum computing risk has become a boardroom issue, driven by the emergence of standards, government-issued guidelines, and companies attempting to build quantum computers. Despite lackluster progress, the risk must not be ignored, hence organizations must assess their exposure and ensure appropriate defenses, which mostly consist of post-quantum cryptography. This presentation offers a technical and strategic roadmap for PQC integration: We'll first characterize the risk, mostly via its impact for various systems such as VPNs, encryption-at-rest, and distributed ledgers. We'll discuss the various "harvest now, decrypt later" scenarios and why quantum computers won't steal your Bitcoin (but might affect blockchain systems in surprising ways.) Although the expected timeline is an elusive topic, I'll share my perspective. We'll then describe the technical options, reviewing the standards and recommendations in various regions—in the U.S. (NIST), as well as China (GM/T), Japan (CRYPTREC), and Korea (KISA). Drawing from my work as co-author of FIPS 205 (SLH-DSA), I'll describe the different algorithm types and their respective properties in terms of security assurance and performance, also discussing hybrid deployment modes. Finally, we'll share our experience in managing the risk as a CSO: creating an internal migration plan, performing risk assessments, adapting cryptographic software, and addressing clients' and regulators' concerns. Jean-Philippe Aumasson | Cofounder and CSO, Taurus https://ift.tt/CoKMhUy

source https://www.youtube.com/watch?v=_M0of-6aLpk

Black Hat Asia 2026 | Network Operations Center (NOC) Report

Back with another year of soul-crushing statistics, the Black Hat NOC team will be sharing all of the data that keeps us equally puzzled, and entertained, year after year. We'll let you know all the tools and techniques we're using to set up, stabilize, and secure the network, and what changes we've made over the past year to try and keep doing things better. Of course, we'll be sharing some of the more humorous network activity and what it helps us learn about the way security professionals conduct themselves on an open WiFi network. Bart Stump | Managing Principal, Coalfire Neil R. (a.k.a. Grifter) Wyler | Vice President of Defensive Services, Coalfire https://ift.tt/NrkTzZp

source https://www.youtube.com/watch?v=05w_6iUGFvE

Black Hat Asia 2026 | Hidden Telemetry: Uncovering TraceLogging ETW Providers You're Not Using (Yet)

Event Tracing for Windows (ETW) is a built-in Windows logging and tracing framework that collects system and application events, providing detailed visibility into what's happening on a machine. In security, ETW is widely leveraged as one of the key telemetry sources for modern Endpoint Detection and Response (EDR) products because of the wealth of data it provides. This trace data is generated by components known as providers. While four types exist—Managed Object Format (MOF), Windows software trace preprocessor (WPP), Manifest-based, and TraceLogging—Microsoft generally recommends using the two modern variants: Manifest-based and TraceLogging providers [1]. However, a significant knowledge gap exists. While Manifest-based providers are relatively well-understood [2], information regarding TraceLogging providers remains scarce. Consequently, it is questionable whether the security community is truly maximizing ETW's full potential. To bridge this gap and enable defenders to better leverage ETW, we will present our findings on TraceLogging providers in the latest Windows. We will cover how to work with them, highlight providers potentially useful for security (e.g., AttackSurfaceMonitor), and walk through practical use cases. Asuka Nakajima | Senior Security Research Engineer, Elastic https://ift.tt/PNbRd1M

source https://www.youtube.com/watch?v=ubFcs1M62P4

Black Hat Asia 2026 | Beyond the Golden Image: A Self-Healing Image Supply Chain

Cloud images are frequently stale on arrival. Traditional hardening depends on manual patch cycles and periodic rebuilds—an approach that breaks down in large enterprises running thousands of rapidly changing workloads. Reactive remediation creates persistent security debt, long exposure windows, and an image supply chain that cannot keep pace with modern Agile delivery. This Briefing presents a security-first framework for a self-healing image supply chain that continuously delivers deterministic, verifiable, and zero-CVE operating system images at enterprise scale. The approach replaces legacy package-manager–driven workflows with hermetic, declarative builds that remove non-determinism and guarantee 100% reproducibility. Every image is cryptographically signed, attested with SLSA-aligned provenance, and verified prior to promotion, preventing compromised or untrusted components from reaching production. Our platform implements this framework, with layered hardening and minimal-footprint custom builds that eliminate unnecessary utilities, reducing attack surface while preserving developer flexibility. Strict policy gates ensure that only images meeting integrity, compliance, and vulnerability criteria are deployable. To sustain security posture at scale, the system continuously tracks vulnerability intelligence feeds and upstream base-layer updates. When a patch or new CVE is released, images are automatically regenerated, validated, and published—guaranteeing updated images in less than 24 hours without manual intervention. In production use, the framework is actively consumed by 500+ SREs impacting 1000s of developers across 70+ engineering teams, has reduced organization-wide CVE backlog by approximately 40%, and scales to support thousands of workloads. Today it supports hardened Linux and Windows OS images across AWS and Azure, with a design extensible to data-center images and container pipelines. We will share the architecture framework, threat model and implementation techniques as a vendor-neutral blueprint so security and platform teams can transform image security from a reactive process into an autonomous, continuously verified supply chain. Neelu Tripathy | Senior Security Architect, Adobe Inc. Lovlesh Malik | Engineering Manager, Adobe Systems India Pvt. Ltd https://ift.tt/7OeFs2o

source https://www.youtube.com/watch?v=ueG0ynK0I7A

Black Hat Asia 2026 | Inside Cybercrime Inc: Lessons From Covering the Global Fraud Boom

Drawing on three years of on the ground reporting across South East Asia, this talk examines the rise of an industrial scale cybercrime economy, an ecosystem now generating an estimated $500bn a year, rivaling the global drug trade. I'll unpack how these syndicates operate as fully fledged multinational enterprises, and explore the human, political and economic forces that allow them to thrive. By tracing how online fraud has evolved, industrialised and globalised, I'll outline what this transformation reveals about the future of organised crime and why defenders, policymakers and investigators need to rethink the threat landscape ahead. Sue-Lin Wong | Asia Correspondent, The Economist https://ift.tt/xcOnhQI

source https://www.youtube.com/watch?v=ChQ-wvvgGNU

Black Hat Vault | Cyber Granny

Meet Cyber Granny! 🔐 Hear her thoughts on the Black Hat community, advice for newcomers, and the importance of staying cyber aware.

source https://www.youtube.com/shorts/vgyZ7AaAZCM

Black Hat Stories | Daniel Cuthbert

From world-class research to the collaborative spirit that brings the global security community together, Daniel shares how Black Hat has helped shape some of the most important moments in cybersecurity history.

source https://www.youtube.com/shorts/GiWY0pNKH_4

Black Hat Stories | More Than a Conference

Three years, three different Black Hat experiences. Gaurav Keerthi, CEO and founder of StrongKeep, shares what makes it special.

source https://www.youtube.com/shorts/5Qq_L_qp7R8