The 2026 BSidesPDX board election results are in. Please join us in welcoming our newest board member: Stas Lyakhov. Welcome a-board! BIG thanks to our exiting board member Gabriel Gomes for his time as chairperson & CFP lead. Thank you for being a valuable part of our community

Board election reminder! We will be hosting elections for one board position tonight at 7PM. If you're interested in running, please be sure to attend the meeting and join our Google group for more details on how to sign up groups.google.com/g/bsidespd…

Fresh @safebreach Labs research! 🔥 CVE-2025-59199 breaks down a highly creative low-integrity Windows LPE path. Learn how Notifications, COM objects, URIs, DevTools, and Windows Apps chain together in a single exploit. Great work team! 👇 safebreach.com/blog/click-or…

The Three Buddy Problem visits Ekoparty Miami: Jordan Wiens, co-founder of Vector 35 and creator of Binary Ninja, talks about a decade spent building a decompiler in a market everyone told him not to enter. He walks through why accessibility drove the whole project, how Binja's intermediate-language system stacks up against IDA, Ghidra, and Radare, and why language-specific decompilation for Rust, C , and Go is the next real frontier. Plus, thoughts on AI disruption and why "the model can do it" misses the point that the model is just driving the tool, what verifiability really means, whether AI tilts the field toward offense or defense, and questions around subsidized tokens, the collapse of the CTF talent pipeline, and what happens to a craft when the shortcut is always one prompt away. Apple Podcasts podcasts.apple.com/us/podcas… Spotify open.spotify.com/episode/21T… Transcript docs.google.com/document/d/1…

The clock is ticking! This is the last week for early registration prices at @BlackHatEvents USA. I have a new class this year: How to use Secure Boot and Encrypted Firmware. blackhat.com/us-26/training/…

LABScon25 Replay 📺 Joe Fitzpatrick: Please Connect to the Foreign Entity to Enhance Your User Experience (@securelyfitz) sentinelone.com/labs/labscon…

Hardware Hacking and AI* all using LLMs*: I've been teaching courses about *Attacking *IoT at Black Hat for over a decade - often using tools that include *Logic *Level *MOSFETs. Here's my take on some of the hardware courses and what pairs well for different skill levels:

Finally releasing some work with @LennertWo! cfp.recon.cx/recon-2026/talk…

Reverse Engineering a Ledger Nano X Hardware Implant (@_TROPICON) slides are up! grandideastudio.com/portfoli…

AMD is shipping a vulnerable kernel driver in the Razer Blade 16 BIOS updater. its sitting in the same folder as ANOTHER vulnerable driver that's been publicly known and documented as dangerous for years both are signed. both can be weaponized by malware to bypass your antivirus, take complete control of your computer from the inside, read anything stored in memory including passwords and crypto wallet keys, and load ransomware /Malware without your PC putting up a fight this is exactly what ransomware / malware operators and state backed groups hunt for every single day

GPU-Z is on basically every gaming PC on earth. TechPowerUp makes it. they also make Sapphire TRIXX. What I found is insane... both ship TRIXX.sys. IOCTL 0x800060C4 calls HalSetBusDataByOffset with user-controlled bus, device, function, and offset. any local process. no admin. reprogram any PCI BAR to any physical address. map it. arbitrary physical memory R/W from ring 3. a GPU info tool with the keys to your entire system. EV cert. valid through April 2028.

Signed to Kill: Reverse Engineering a 0-Day Used to Disable #CrowdStrike EDR The article presents a reverse-engineering analysis of a kernel driver used in a BYOVD (Bring Your Own Vulnerable Driver) attack to disable security software, including @CrowdStrike Falcon EDR. The researcher discovered multiple variants of a Microsoft-signed driver that expose a dangerous IOCTL interface capable of terminating arbitrary processes. core-jmp.org/2026/04/signed-…

github.com/magicsword-io/LOL… found a 25KB WHQL signed driver from driverscloud.com. its a french hardware inventory tool people install to check what GPU they have. 7 IOCTLs, zero validation. no security descriptor on the device. FILE_ANY_ACCESS on every IOCTL. any user can open it. no admin needed. no UAC. unrestricted wrmsr. no whitelist. write IA32_LSTAR and every syscall on the system hits your code. the instruction takes single digit nanoseconds. arb physmem read up to 2MB per call, MSR read/write, port I/O, PCI config R/W. It wasn't on loldrivers. not on hvci blocklist. no CVE. 0/68 on VT

Russia hid spy hardware in the walls of TechEx, an Ukraine defense company that builds drones. They don’t really explain what it is beyond “wire tap”, so let’s do a quick analysis on the hardware to configure out what it does! 🧵1

We found 9 vulnerabilities across 4 low-cost IP-KVM vendors. These $30 devices give attackers the equivalent of physical access to everything they connect to. Below the OS, EDR, and pretty much every security control you've deployed.

Everyone today is a hacker in a sense but there are very few OG hackers on which shoulders we stand Oh dude, Felix “FX” Lindner you were so much a hackers hacker and you will be missed RIP my friend and thank you

Thank you for everything FX, you will be missed 😞