Here are my fav talks at the first @UnpromptedAU: @chompie1337 shared her 1-day exploit factory. Although she focused on Windows, many of the ideas also apply to other platforms and systems. She's a fantastic speaker who made a deeply technical topic accessible and easy to understand, even for noobs like me. @moyix's thesis is that AI has made reverse engineering much easier, and therefore security through obscurity is dead. I completely share this view. I won't say more because I don't want to spoil Brendan's talk, but man, he really loves what he does, and that love is contagious. Now I want to hack with a cat too! Ash Fox shared how his team at Google is building an AI red teamer. This one hit very close to home! I really enjoyed hearing how they teach their agents to maintain OPSEC. I also loved his idea of "living off the agents", leveraging existing agents to move laterally. @justdionysus shared the story of his first week at Calif, when he bypassed Apple's MIE with AI. I'm 100% biased, but Dion had the most beautiful slides at the conference. I'm fucken jealous -- how the hell he could make them look that good. It's a great conference, small enough to feel like a real community where everyone knows one another, but big enough to make new friends. It reminds me of Ekoparty in the early 2010s. Sydney is lovely, too. I'll definitely be back.

Attacks always get better. Here's a new nginx RCE that bypasses ASLR, tested on the latest nginx 1.30 and 1.31. This still requires a non-default config, but unlike some previous bugs, it does not depend on any additional vulnerabilities or external helpers to get to RCE. We reported the bug on May 15. F5 has confirmed it, and hopefully a patch will land soon. This is getting ridiculous 😅. We have enough nginx bugs to do an entire week of MAD Bugs on it. Who could have thought nginx is starting to feel like the new Linux kernel? This is the funniest time in computer hacking. And yet the world is completely unprepared for this new reality.