AppSec & Supply Chain research

• August 9, 2026 Talk AppSec & Supply Chain AppSec Village — DEF CON 2026 Filipi Pires BR From commit to compromise: securing the full pipeline with AI-assisted remediation

  Most vulnerabilities aren't found because teams lack tools they persist because the cost of fixing them is too high. A finding without a concrete, context-aware fix is just noise developers learn to ignore. This talk walks through three real-world attack scenarios a secret leaked into git history, a compromised dependency in a supply chain attack, and an injection vulnerability introduced in a PR and shows how each is detected, mapped to OWASP Top 10:2025, and automatically remediated using AI running entirely on local infrastructure. No source code leaves the machine. The AI receives the vulnerable code block, CWE identifier, CVSS score, and OWASP category and returns a fix that is specific, correct, and ready to apply. Attendees leave with a working open-source tool and a new mental model for what AppSec remediation can look like.

  ResearchersFilipi Pires BR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 8, 2026 Talk AppSec & Supply Chain La Villa Hacker — DEF CON 2026 Davidson Mizael BR Self Hosting Nightmare - Exploiting AI models for supply chain attacks

  In this presentation I'll go through the process of how you could possibly exploit this vulnerability in one of thousands servers exposed to the internet running the top one tool in the world for self hosting AI models. The process I'll demonstrate in this presentation involves exploring vulnerable by default decisions to achieve total control of this model serving tool, and the vulnerability research I have done on top of this tool that led me to find 7 0day vulnerabilities that allows anyone to achieve the following results:

  • Free token usage
  • Cause unavailability in the servers
  • Steal top of the market secret models
  • Cause chaos within dependent services with a model defacement
  • Craft a supply attack

  ResearchersDavidson Mizael BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk AppSec & Supply Chain La Villa Hacker — DEF CON 2026 Natan Morette BR The CVE-Hunters Project: From Noobs to Researchers

  The presentation explores how the Brazilian CVE-Hunters Project transformed beginners with zero published research into recognized vulnerability researchers contributing to global cybersecurity. By breaking down the myth that CVEs require genius-level exploits or zero-days, the talk reveals a structured, repeatable methodology that turns curiosity into impact.

  Key topics include how vulnerability research can be systematized, how responsible disclosure works behind the scenes, and how publishing a first CVE can change technical credibility, career trajectory, and confidence.

  The speaker emphasizes this goes "beyond a technical presentation" to provide "a blueprint for moving from learning hacking to becoming a researcher" and contributing meaningfully to the security ecosystem, framing the first CVE as about "responsibility, growth, and raising the bar for global security."

  ResearchersNatan Morette BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Workshop AppSec & Supply Chain Payment Village — DEF CON 2026 Dan Borgogno AR Introduction to the Wall of Wallets Challenge

  Wall of Wallets is a hands-on CTF challenge where the goal is simple: collect as many mock payment card details as you can from other participants. Using intentionally vulnerable services in a safe, isolated environment, you'll learn how common implementation mistakes expose sensitive data.

  Compete to top the Wall of Wallets leaderboard while discovering the real-world techniques attackers use and, importantly, how to defend against them.

  ResearchersDan Borgogno AR

  Presented at Payment Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop AppSec & Supply Chain Red Team Village — DEF CON 2026 Natan Morette BR Quality over Quantity: How to Publish CVEs that Actually Matter

  This hands-on tactic focuses on making CVE discovery and publication practical, accessible, and repeatable. Instead of treating vulnerability research as an individual or highly specialized skill, this session introduces a structured workflow that attendees can immediately apply.

  Attendees will follow a step-by-step approach to:

  • Explore a scoped attack surface
  • Apply a curated vulnerability pattern checklist
  • Identify and validate a potential vulnerability
  • Structure the finding in a simplified CVE-style format

  All materials are prepared in advance to ensure the activity can be completed within 30–60 minutes and repeated across multiple waves of participants.

  This tactic emphasizes doing over theory, helping attendees leave not just with knowledge, but with a clear, reusable method for identifying and documenting vulnerabilities and a better understanding of how CVE publishing can be integrated into team workflows.

  ResearchersNatan Morette BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Arsenal AppSec & Supply Chain AppSec Village — DEF CON 2026 Filipi Pires BR Drogonsec: SAST + SCA + Secrets + IaC in one open-source scanner

  Drogonsec is an open-source, high-performance security scanner built for developers and CI/CD pipelines. In a single run, it combines four analysis engines: SAST for 20+ languages, SCA for dependency CVEs, secret detection with 50+ patterns (AWS, GCP, GitHub, JWTs, SSH keys), and IaC misconfiguration analysis for Terraform and Kubernetes, all mapped to OWASP Top 10:2025 and CWE, with CVSS 3.1 scoring and SARIF output for GitHub and Azure DevOps integration.

  This Arsenal session will demo Drogonsec scanning real-world repositories live, showing findings across all four engines, explaining rule design decisions, and showcasing how teams can extend it with custom YAML rules. Attendees leave with a running tool they can drop into their pipelines the same day.

  ResearchersFilipi Pires BR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 7, 2026 Talk AppSec & Supply Chain La Villa Hacker — DEF CON 2026 Santiago Sepúlveda Veliz CL State Desync as a Weapon: Breaking Transactional Integrity in Payment Systems (ESP)

  El Price Tampering no es un simple cambio de parámetro ni un bug, es una falla de arquitectura que permite alterar el valor de una transacción sin romper ningún control tradicional en cualquier sistema que procese pagos, provocando fraude en diferentes industrias y negocios. En esta charla abordaré cómo un atacante modela el flujo de compra y pago completo, identifica puntos de desincronización entre cliente, backend y pasarela, y explota la ausencia de invariantes de negocio server-side para manipular el valor final de una transacción sin necesidad de CVEs, exploits ni malware. Basado en una investigación propia con casos reales autorizados y anonimizados en entornos de banca, retail y fintech en LATAM, presentaré una taxonomía de tres patrones de ataque recurrentes y un modelo defensivo concreto llamado FinSecure, sustentado en el principio del backend soberano, donde el precio nunca puede nacer fuera del servidor. La audiencia se irá con una visión diferente del problema y herramientas accionables para detectarlo y eliminarlo por diseño.

  ResearchersSantiago Sepúlveda Veliz CL

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 3, 2026 Talk AppSec & Supply Chain BSides Las Vegas 2026 Aldo Salas MX Came for the AppSec scans, stayed for the flaky tests

  I'm an AppSec lead. My job was rolling out security scans in CI. Once the scans shipped, I stayed and fixed the parts of the pipeline nobody else would touch. Six months, solo, on top of the day job. Four AI-driven bots later, this talk focuses on two of them.

  The one that worked best: a CVE-fixing bot that's kept us at 0 CVEs for three months and counting. The one that miserably failed: a flaky DB test bot that couldn't see flakiness. To a one-shot AI review, a test that sometimes passes and sometimes fails just looks broken. The DB suite went from 42.3% peak failure rate to near zero, not by automating harder but by ditching the bot and pairing with Claude on each failure by hand.

  The fixes were technical (race conditions and cache, mostly) but the reason they didn't get fixed wasn't. People click "Run again" several times a day instead of looking at why. Nobody fixes it until somebody who isn't supposed to does. Walk out and measure your team's rerun rate (I'll share the script). Then go fix the smallest thing nobody else will.

  ResearchersAldo Salas MX

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Talk AppSec & Supply Chain BSides Las Vegas 2026 Paulo Sarrin MX One Package, One Backdoor: Can AI Stop the Next Supply Chain Attack Before It Reaches You?

  Open source packages are the foundation of modern software development. They save time, reduce cost, and accelerate delivery. But every package you install is also a potential entry point for an attacker. This session takes a hands-on approach to understanding software supply chain attacks from both sides of the attack.

  On the offensive side, attendees will see how attackers introduce malicious code into a new package release without raising immediate suspicion. We cover how a malicious package establishes a command and control channel during installation, how it reads and exfiltrates environment variables including API keys, cloud credentials, and database connection strings, and how typosquatting tricks developers into installing the wrong package. We use real documented cases across npm, PyPI, and Maven to ground every concept in reality.

  On the defensive side, we explore how AI is changing the speed and accuracy of supply chain threat detection. We walk through the architecture of tools like the Elastic Supply Chain Monitor, which watches package registries in real time, generates diffs between old and new releases, and sends those diffs to a large language model for classification. The LLM looks for obfuscated code, unexpected network connections, process spawning, and credential access patterns. When it finds them, it alerts the security team before any developer installs the package.

  We also cover the hardening techniques that reduce your attack surface before an incident happens: using lockfiles to pin exact dependency versions, avoiding exposure of dependency files on public websites, using private artifact repositories to control what enters your environment, and integrating automated dependency scanning into your CI/CD pipeline. Attendees will leave with a clear mental model of the threat, a reference architecture for AI-assisted detection, and a practical checklist they can bring back to their team on Monday.

  ResearchersPaulo Sarrin MX

  Presented at BSides Las Vegas 2026

  View official session
• May 22, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Ashley Hiram MX Minutos que salvan millones: Identificación y análisis de CVE-2025-71257 en menos de 3 hrs.

  Exploraremos el ciclo de vida de un ataque real en el cual se explotó el CVE-2025-71257 en un servidor de Ticketing llamado BMC Footprints y se encontraba expuesto a internet, lo cual permitió que atacantes de Sur Corea, USA, Malasia y España cargaran distintas Webshells a la aplicación web para generar persistencia, la ejecución de comandos de sistema operativo y posteriormente, movimientos laterales.

  ResearchersAshley Hiram MX

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Jaime Andrés Restrepo CO I know kung fu

  "I know kung fu" — downloading skills Matrix-style to power up your bug bounty process

  ResearchersJaime Andrés Restrepo CO

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Miguel Alonso Lopez Abarca PE Errores y problemas en APIS Corporativas y su abuso

  Exploraremos vectores de ataque como la manipulación de lógica de negocio y APIs. Además, discutiremos cómo los atacantes combinan errores de configuración, malas prácticas de desarrollo y falta de controles compensatorios para comprometer entornos críticos

  ResearchersMiguel Alonso Lopez Abarca PE

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Ricardo Sánchez Bermúdez PE SUPPLY CHAIN ATTACKS: when the vector is the pipeline, not the code

  The most recent supply chain attacks don't exploit vulnerabilities in code. They exploit the pipeline. Nobody treats it as an attack surface, and that's exactly how Shai-Hulud compromised 14k+ secrets without touching a single application. Through a live demo you'll see the attack from the attacker's perspective and walk away with a practical framework to evaluate and strengthen your own pipelines.

  ResearchersRicardo Sánchez Bermúdez PE

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Adrián Pedrazzoli AR From Changing Diapers to Changing Requests: Unboxing an SSRF

  New features are the most fertile ground for bug hunters. In this turbo talk I walk through how an endpoint in the "Unboxing" feature of a major e-commerce platform turned out to be vulnerable to SSRF: the first sniff at the feature, the validation bypass, and the road to the report in the bug bounty program.

  ResearchersAdrián Pedrazzoli AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Agustin Aguirre AR Fuzzing meets Recon: Dynamic Wordlists for Serious Hunters

  Static wordlists are a lie we tell ourselves: same wordlists == same bugs. This talk shows why content discovery and fuzzing in real-world bug bounty targets fail when every assessment starts from the same stale inputs. This talk walks through dynamic fuzzing techniques and introduces an open-source tool that builds, mutates and combine wordlists based on the live context of the assessment, tested across bug bounty programs and pentest engagements.

  ResearchersAgustin Aguirre AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Luciano Paccella AR Hacking Without Explicit Consent: Bug Bounty's Gray Area

  Discovering a vulnerability outside program scope poses an uncomfortable question: how far can I go without legal exposure? This talk examines that boundary in practice: minimal validation, controlled impact, and responsible disclosure—all with one goal: preventing your bug from becoming your legal liability.

  ResearchersLuciano Paccella AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Rafael Soares Ferreira BR Exploitation techniques for the OWASP Top10

  This talk provides a practical overview of exploitation techniques aimed at the most critical web application vulnerabilities from the OWASP Top 10. The presentation highlights how Artificial Intelligence can help at various stages of the exploitation process, including reconnaissance, creating payloads, automation, analysis, and researching vulnerabilities.

  ResearchersRafael Soares Ferreira BR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 6, 2026 Talk AppSec & Supply Chain 8.8 UnReal Perú 2026 Daniel Malvaceda Canales PE·Ricardo Sánchez Bermúdez PE Tu pipeline CI/CD es vulnerable. Y no es tu culpa… ¿O sí?

  Los ataques más recientes a cadenas de suministro no explotan vulnerabilidades en el código. Explotan el pipeline. Casos reales han comprometido miles de secretos y organizaciones enteras usando como vector el sistema que construye y despliega tu software. Shai-Hulud es solo un ejemplo; +14k secretos expuestos sin tocar una sola aplicación.

  En esta charla analizamos cómo ocurren estos ataques, por qué los controles tradicionales no son suficientes y qué significa esto para los equipos que construyen software hoy. A través de una demo veremos cómo un pipeline mal configurado puede convertirse en el atacante, y con buenas prácticas para robustecer la seguridad desde el build.

  Una sesión para equipos que quieren dejar de tratar el pipeline como zona de confianza y empezar a tratarlo como superficie de ataque.

  ResearchersDaniel Malvaceda Canales PE·Ricardo Sánchez Bermúdez PE

  Presented at 8.8 UnReal Perú 2026