OffensiveCon 2025
The premier elite offensive security research conference in Berlin. Browser exploits, kernel vulnerabilities, microcode attacks, and the deepest technical content in the industry — no vendor pitches, no fluff.
→ See editor’s top picks at OffensiveCon 2025
- Pwn2Own Winners Announcement — OffensiveCon Staff
Pwn2Own Berlin 2025, held concurrently with OffensiveCon for the first time, awarded $1,078,750 across three days of competition. StarLabs SG from Singapore won the Master of Pwn title with $320,000…
- Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them — Cedric Halbronn, Jael Koh
Jael Koh, a researcher at PixiePoint Security, discovered two Use-After-Free vulnerabilities in the Windows Kernel Transaction Manager (KTM) driver within three weeks of focused investigation —…
- Fighting Cavities: Securing Android Bluetooth by Red Teaming — Jeong Wook Oh, Rishika Hooda, Xuan Xing
Google's Android Red Team conducted a structured offensive security engagement against the Android Bluetooth stack — the open-source Fluoride/AOSP implementation running in a privileged system…
- Chainspotting 2: The Unofficial Sequel to the 2018 Talk "Chainspotting" — Ken Gannon
Ken Gannon was the sole phone entrant at Pwn2Own Ireland 2024 and successfully compromised the Samsung Galaxy S24 using an unbroken chain of five logic bugs — zero memory corruption required…
- Frame by Frame, Kernel Streaming Keeps Giving Vulnerabilities — Angelboy
Angelboy of DEVCORE uncovered more than 20 vulnerabilities in Windows Kernel Streaming (KS), concentrated in the AVStream subsystem used by webcams and video devices. By abusing a logic inversion in…
- Finding and Exploiting 20-Year-Old Bugs in Web Browsers — Ivan Fratric
Ivan Fratric of Google Project Zero audited the XSLT processing engines embedded in all major web browsers and discovered multiple use-after-free and memory corruption vulnerabilities, some dating…
- Garbage Collection in V8 — Richard Abou Chaaya, John Stephenson
Researchers Richard Abou Chaaya and John Stephenson from Tencent demonstrate how a previously reported V8 bug — dismissed as non-exploitable — becomes a critical use-after-free under V8's new Minor…
- How Offensive Security Made Me Better at Defense — Dino Dai Zovi
In the closing keynote of OffensiveCon 2025, Dino Dai Zovi — veteran of Pwn2Own, Defcon CTF, and co-author of multiple security books — argues that deep offensive expertise is not just complementary…
- Attacking Browsers via WebGPU — Lukas Bernhard
Lukas Bernhard built a grammar-based fuzzer for WebGPU's shading language (WGSL) and aimed it at the shader compilers lurking inside Chrome's GPU process — components never designed to withstand…
- No Signal, No Security: Dynamic Baseband Vulnerability Research — Daniel Klischies, David Hirsch
Researchers at Ruhr University Bochum developed **BaseBridge**, a technique that transplants live cellular connection state from a physical smartphone into a baseband emulator, enabling…
- Skin in the Game: Survival of GPU IOMMU Irregular Damage — Fish, Ling Hanqin
Researchers from Pangu Team dissect GPU IOMMU memory management across Mali, Adreno, and PowerVR — three entirely distinct architectures — and show how each one's private MMU design creates its own…
- Entrysign: Create Your Own x86 Microcode for Fun and Profit — Matteo Rizzo, Kristoffer "spq" Janke, Eduardo Vela Nava, Josh Eads
A Google security team discovered **EntrySign**, a cryptographic flaw in AMD's microcode patch signing scheme affecting every AMD CPU from Zen 1 through Zen 5: the signature algorithm uses AES-128…
- Parser Differentials: When Interpretation Becomes a Vulnerability — Joernchen (Joern Schneeweisz)
Joern Schneeweisz (Joernchen) of GitLab's Security Research team walks through a decade of accumulated parser differential exploits — from a 2018 CouchDB RCE to a 2024 GitLab Workspaces arbitrary…
- Android In-The-Wild: Unexpectedly Excavating a Kernel Exploit — Seth Jenkins
Starting from nothing but a set of kernel panic logs recovered from a Serbian activist's phone — logs that implicated Cellebrite's UFED tool and the Qualcomm ADSPRPC driver — Google Project Zero…
- Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing — Dillon Franke
Dillon Franke of Google developed a coverage-guided fuzzing harness targeting macOS's `coreaudiod` daemon via its Mach IPC interface, introducing a technique called "API call chaining" to guide…
- Automating Your Job? The Future of AI and Exploit Development — Perri Adams
Perri Adams, former DARPA program manager who launched the AI Cyber Challenge, presents a technically grounded assessment of frontier AI models' (GPT-4o, o3, Claude) actual capabilities in exploit…
- KernelGP: Racing Against the Android Kernel — Chariton Karamitas
Chariton Karamitas of Census Labs presents four novel techniques for forcing the Android kernel to delay execution, enabling attackers to win race conditions without relying on `userfaultfd` — which…
- Journey to Freedom: Escaping from VirtualBox — Corentin Bayet, Bruno Pujos
Corentin Bayet and Bruno Pujos of Reverse Tactics present the VirtualBox guest-to-host escape they executed at Pwn2Own Vancouver 2024, earning $90,000. The exploit chains an uninitialized memory…