PoC-public

PoC-public This repository collects PoC code that we published at various security conferences. Black Hat EU 2020 CODE BLUE 2021 Black Hat Asia 2023 CODE BLUE 2023...

Conferences

Conferences Conference presentation slides: BlackHat USA 2025 August 2-7 Offensivecon 2025 May 16-17 Black Hat Asia 2025 1-4 April Black hat Europe 2024 9-12 December Hexacon 2024 Slides 4-5 October Black Hat USA 2024 slides 3-8 August REcon 2024 Slides 28-30 Jun Offensivecon 2024 May 10-11...

presentations

Presentations by Christopher Peacock Year| Organization| Talk Title| Slides| Video ---|---|---|---|--- 2023| BSides Tampa| Purple Team 101| Slides| 2022| SANS PenTest HackFest 2022| In the Trenches: Purple Team Do’s and Don’ts| Slides| YouTube 2022| BSides St Petersburg| TTP Pyramid| Slides|...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking online via Zoom at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET. I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conference runs September 30–October 1, 2026; the time of my talk i...

Practice Makes (Im)Perfect: A Look Back at Benchmarking Practices for Microarchitectural Side-Channel Attacks

Microarchitectural side-channel research has grown at an exceptional pace in recent years, increasing the need for rigorous and meaningful benchmarking. Early attack papers typically relied on indirect proxies, such as covert-channel bandwidth or key-recovery on naive AES and RSA implementations,...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking, signing books, and participating in panel discussions at LAcon V in Anaheim, California, USA. My full schedule is here. I'm speaking online via Zoom at a League of Women Voters event on Tuesday, September 22, 2026, at...

Reflection, Education, Consistency: Towards Best Ethics Practices at Security and Privacy Conferences

Research ethics is a controversial and emotionally charged topic in the security and privacy community, sparking discussions at conferences and on social media. In recent years, some of the leading conferences have introduced interventions such as mandatory ethics sections, with mixed reactions...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the users process of the admin organization interface when untrusted input from params:term is interpolated directly into SQL ORDER BY expressions before sanitization. An attacker can execute arbitrary SQL expressions...

CVE-2026-4219

A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown functionality of the file com/index/event/BuildConfig.java of the component ae.index.apgcs. Executing a manipulation of the argument...

INDEX Conferences and Exhibitions Organization YWF BPOF APGCS App 安全漏洞

INDEX Conferences and Exhibitions Organization YWF BPOF APGCS App is an application for organizing conferences and exhibitions. Versions of INDEX Conferences and Exhibitions Organization YWF BPOF APGCS App prior to 1.0.2 have security vulnerabilities. These vulnerabilities stem from improper...

CVE-2026-4219: Use of Hard-coded Credentials

A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown functionality of the file com/index/event/BuildConfig.java of the component ae.index.apgcs. Executing a manipulation of the argument...

CVE-2026-22800

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800

PILOS (Platform for Interactive Live-Online Seminars) before version 4.10.0 contains a CSRF vulnerability in an administrative GET endpoint that terminates all active video conferences on a single BigBlueButton server. Although authorization checks exist, the use of GET allows implicit invocation...

CVE-2026-22800 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800: Cross-Site Request Forgery (CSRF)

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

PILOS 跨站请求伪造漏洞

PILOS is an open source front-end software from THM. A cross-site request forgery vulnerability exists in PILOS versions prior to 4.10.0, which stems from a cross-site request forgery in the management API endpoint that could result in termination of all active video conferences...

PT-2026-2312

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.10.0 Description PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. A Cross-Site Request Forgery CSRF issue exists in an administrative API endpoint responsible for terminating all...