IOActive

Call Directions Website Contact the hotel

IOActive The industry’s only research-driven global provider of specialist information security services -

Thank you to everyone who joined us at hack::soho last night, in person at our London HQ and on the livestream.A huge th...
30/10/2026

Thank you to everyone who joined us at hack::soho last night, in person at our London HQ and on the livestream.

A huge thank you to Dinis Cruz, founder of The Cyber Boardroom, for “The Ultimate Insider.” Dinis connected three problems the industry usually treats separately: AI agents as an insider threat with capabilities no human insider ever had, infrastructure built for static code that now has to contain them, and risk management still moving at the speed of quarterly spreadsheets.

The way forward he laid out was practical: measure what an agent can actually reach, document what stands in its way, give it a licence to operate that can be suspended, and let it earn its autonomy. The live open-source demos made it real.

Great talk, great questions, and great conversations over food and drinks afterward. That’s what hack::soho is all about.

See you at the next one.

Looking for a vendor risk assessment template free of charge? Use this practical guide to evaluate third-party access, c...
29/10/2026

Looking for a vendor risk assessment template free of charge? Use this practical guide to evaluate third-party access, controls, dependencies, evidence, and when technical validation is necessary. Link in the commnets!

If you’re building or securing AI agents, Vince Ovando’s [un]prompted talk is worth your time.“The Model Is NOT a Securi...
28/10/2026

If you’re building or securing AI agents, Vince Ovando’s [un]prompted talk is worth your time.

“The Model Is NOT a Security Control: Prompt Injection Dies at the Token Sampler”

Vince built Tantalus, a two-round indirect prompt injection arena. It drops you in front of a realistic AI assistant with access to files, email, and chat history, loaded with both legitimate and poisoned tools. The goal: get the agent to exfiltrate data from an IT admin’s workstation.

Then he stress-tested it at scale:
→ ~6.1 million inference calls
→ Models from 1.7B to 119B parameters
→ Every behavioral and structural control was either bypassed or still let malicious output get generated

Except one.

A single control had a provable 100% rate of stopping bad behavior before it was ever generated. The title gives you a hint about where it lives, but the data is the reason to read it.

The takeaway for anyone deploying agents: if your security strategy depends on the model choosing to behave, you don’t have a security control.

🗓️ Session details in the link in the comments!

Learn how to evaluate a cybersecurity provider by comparing technical depth, testing methods, reporting quality, researc...
27/10/2026

Learn how to evaluate a cybersecurity provider by comparing technical depth, testing methods, reporting quality, research, and fit for your security goals. Link in the comments.

We have several events coming up and we hope to see you there! Follow along all IOActive happenings by visiting our Even...
26/10/2026

We have several events coming up and we hope to see you there! Follow along all IOActive happenings by visiting our Events Page. (Link in the comments).

🌟 THIS WEEK | Oct. 27 – 29 | [un]prompted | San Francisco, CA - AI is reshaping both sides of security, from agents that find and exploit vulnerabilities in hours to the controls organizations need to govern them. That’s exactly the ground covered at [un]prompted II, the AI Security Practitioner Conference, taking place October 27–29, 2026, in San Francisco, and IOActive Field CISO Andrew McDonnell will be there.

🌟 THIS WEEK | Oct. 28 | CYSAT Madrid | Leaking a Private Key to Compromise an Entire SATCOM Network | Gabriel Gonzalez | Madrid, Spain - On 28 October, we’ll be at the first-ever Spanish edition of CYSAT, the leading space cybersecurity conference, bringing together agencies, operators, and researchers from across Iberia, Europe, and Latin America. Don’t miss our session: Gabriel Gonzalez, Director of Hardware Security at IOActive, takes the stage from 11:30 to 12:00 (CET, Madrid time) to present ‘Leaking a Private Key to Compromise an Entire SATCOM Network.’

🌟 THIS WEEK | Oct. 29 | hack::soho | Dinis Cruz, Founder of the Cyber Boardroom | The ultimate insider - Join us for an evening of fun at this month’s hack::soho taking place 29 October, 6pm – 9pm, set up to be a loose networking environment where cyber security professionals can chat, get some complimentary food & drink, and discuss rising global trends. This month’s hack::soho features a talk from Dinis Cruz, founder of The Cyber Boardroom.

🌟 THIS WEEK | Oct. 29 – 30 | LASCON | Austin, TX | Jason Kent | SONAR Tech for your apps - Jason Kent, Business Development Manager at IOActive, will speak at LASCON 2026, taking place October 29–30 in Austin, TX. Jason’s talk, “SONAR Tech for Your Apps,” explores the unique threat landscape of AI-powered systems — stress-testing real applications to uncover LLM vulnerabilities from first principles.

24/10/2026

be the ultimate insider this hallowen. only at h::s. link in bio.

⚡ Britain's smallest power generators are facing a four-year cybersecurity gap.A cyberattack took a small-scale UK power...
23/10/2026

⚡ Britain's smallest power generators are facing a four-year cybersecurity gap.

A cyberattack took a small-scale UK power generator offline for four days in July 2026, exposing a troubling reality: many distributed energy assets fall outside existing cybersecurity regulations.

While the UK government has committed to new baseline cyber resilience requirements by 2030, there's a critical catch: Cyber Essentials Plus doesn't currently cover Operational Technology (OT).

That leaves smaller power generators, renewable energy operators, and distributed energy infrastructure facing significant risks today.

In our latest blog (Link in the comments), IOActive explores:
🔴 Why current NIS regulations leave smaller generators exposed
🔴 The cybersecurity challenges that remain unresolved until 2030
🔴 Why OT security requires more than traditional IT compliance
🔴 What energy operators can do NOW to strengthen resilience

Cyber threats aren't waiting until 2030. Neither should your security strategy.

This one is serious, and the cleanup will take a long time.Researchers have found eight intermediate TLS certificates fr...
22/10/2026

This one is serious, and the cleanup will take a long time.

Researchers have found eight intermediate TLS certificates from CA eMudhra with private keys only 3 to 8 bits long. A normal key has around 384 bits. That means anyone could have used them to mint trusted certificates for any website on the internet.

Browsers and many major platforms have already blocked all eight, and there’s no evidence yet of malicious use. But the real risk is in the long tail: Linux distributions, Docker containers, embedded and IoT devices, and tools that ship their own copy of the root store. Go cryptography maintainer Filippo Valsorda expects the cleanup to be bigger than Heartbleed.

What security teams should do now:
🔹 Push OS and browser trust-store updates as soon as they’re available
🔹 Hunt for bundled CA stores in apps, containers, firmware, and language runtimes
🔹 Inventory embedded, IoT, and OT devices that validate TLS, because these are the hardest to update
🔹 Treat untrusted networks and TLS-based VPNs with extra caution until you’re patched

At IOActive, embedded, IoT, and OT security is core to what we do. If you need help finding where this exposure sits in your environment, let’s talk. (Link to article in the comments)

⚠️ Secure application code doesn't always mean a secure application.PHP has issued emergency patches for two critical re...
21/10/2026

⚠️ Secure application code doesn't always mean a secure application.

PHP has issued emergency patches for two critical remote code ex*****on vulnerabilities, collectively dubbed PHP2Shell, with early exploitation attempts already being reported.

The concerning part? These vulnerabilities exist in the PHP runtime itself, potentially exposing web servers regardless of how securely the applications running on them were developed.

It's another reminder that effective cybersecurity requires looking beyond application code to the underlying technologies and infrastructure.

Know your attack surface. Validate your defenses. Patch critical vulnerabilities.

Read more via The Hacker News (link in the comments).

hack::soho is back next Thursday, 29 October, at our London HQ.This month, Dinis Cruz, founder of The Cyber Boardroom, p...
21/10/2026

hack::soho is back next Thursday, 29 October, at our London HQ.

This month, Dinis Cruz, founder of The Cyber Boardroom, presents “The ultimate insider.” His argument: AI agents are an insider threat that never scaled before, the infrastructure meant to contain them was built for static code, and risk management still moves at the speed of quarterly spreadsheets. He’ll connect all three using real incidents from the past 18 months, then walk through a practical way out, with live open-source demos.

📍 IOActive UK HQ, 120 Charing Cross Road, London
🕕 6–9 PM, with complimentary food and drinks
🎥 Can’t make it? The talk will be livestreamed from around 7 PM.

Spots are limited. Register now (link in the comments).

Address


Telephone

+18667600222

Website

Alerts

Be the first to know and let us send you an email when IOActive posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Hotel

Send a message to IOActive:

Shortcuts

  • Want your hotel to be the top-listed hotel?

Share