USENIX WOOT Conference on Offensive Technologies

@microsvuln @notippenhauer Pre-Print: arxiv.org/pdf/2606.26967

By reverse engineering AirDrop and building the AIRFUZZ fuzzer, @microsvuln @notippenhauer uncover six vulnerabilities across macOS, iOS, Android, & Windows, incl. zero-click DoS bugs, authentication and encryption bypasses, and use-after-free with remote-code-execution impact.

How are you solving this dilemma?

Huber & Schink of @FraunhoferAISEC evaluate BBI-based online and offline manipulations of on-microcontroller flash memory, providing stealthy data manipulation and the ability to re-enable new µC interfaces & features.

Project Repo: github.com/Trust-AI-ua/Ne… #TAI Lab.

Models like BLIP can leak training data, unless you rethink the architecture. @Davidamebley @sayantonv introduce NEURO(++) topological regularization. The twist: resilience is highly model- & dataset-dep., i.e., attackers can’t assume one-size-fits-all behavior. #TrustworthyAI

SEMSAN is an eBPF-based, configurable sanitizer that detects semantic bugs – such as a 21-year-old path traversal bug in graphena, command injection, and privilege escalation -- introducing under 1% overhead in real-world systems like Apache and PostgreSQL.

GRAPE is cross-context code-pattern scanner that scans the entire Chromium code base in 12 minutes and earned the Authors of "Squeezing Juicy Variant Bugs Out of Modern Browsers" $17k5 for 24 newly-found vulnerabilities. Pre-print: kdsjzh.github.io/assets/pdf/26W…

DEADLINE EXTENSION!

Submit a poster to any offensive security topics you'd like to discuss with or show to the WOOT audience! usenix.org/conference/woo…

Put a Tesla into a Faraday tent and test its LTE security. It did not end well. See “Security Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla” at USENIX WOOT’26. @tuxmaniac github.com/Signal-Intelli…

Microsoft's 6-year-old Zerologon patches use AES-CFB8 incorrectly. The novel Onelogon attack provides two ways to take over an vlunerable AD account in apx 30 minutes. #AESCFB8fail #WONTFIX softsec.link/woot26.onelogon @al3x_n3ff

Preprint: sickcell6000.github.io/HotWire/2026_W…

With about $180 of off-the-shelf hardware, HotWire sickcell6000.github.io/HotWire/ steals charging billed to victims, and drains an EV's batteries until they won't start — demonstrated on production cars and live public charging networks. Paper and presentation at @wootsecurity 2026.

SynthIR tricks deepfake image detectors using a simple optical filter and cardboard. To defend from their attack Ishizue, Rampazzi, & Sugawara propose a detection method based on dual-pixel sensors. tetsuishizue.github.io/BreakingInfrar… see the full WOOT'26 lineup: usenix.org/conference/woo…

Constant time programming is the primary defense against timing attacks, but the meaning of the term actually varies. On a key loading case study, Brumley finds BoringSSL's leak orders of magnitude stronger than OpenSSL's, despite, surprisingly, a stricter threat model.@riteslgci

If you have a better poster, we like to hear from you! Submit your poster by June 25th at usenix.org/conference/woo…

USENIX WOOT Conference 2026: two submission deadlines this year! - Cycle 1: December 12, 2025 *only one month away* ! - Cycle 2: March 3, 2026 WOOT still has a SoK track and an "Up-and-coming track" (~Industry), CFP for details : usenix.org/conference/woo…

WOOT 2025 closing Keynote "Escaping Cantor's Find-Fix Cycle" by @FalconDarkstar from @dartmouth and @aiven_io

Last papers session "Exploit All the Things" (Chair: Cristine Hoepers) - Soufian El Yadmani: SecurePoC—detecting malicious GitHub exploits - Andrea Mambretti: SoK on kernel vuln discovery & auto exploit generation - Junho Lee: BOOTKITTY—stealth bootkit-rootkit for modern OSes