Talks·45 min
Katie Paxton-Fear
Traces application security changes through the history of the Neopets virtual pet website, from plaintext passwords to bot defenses.
appsecwebidentity+2
Talks CC14
Mesa, AZ, USA · February 2026 · 31 talks
Talks from CactusCon 14 (2026).
1–24 of 30 talks / 31
Talks·43 min
Aviral Srivastava
Demonstrates three attacks on the tool-call layer of AI agents and the controls that validate model-generated actions.
aiattackapplication+2
Talks·51 min
Lester Godsey
Separates genuinely new AI risks from familiar threats such as phishing, data leakage, and third-party exposure.
airiskmanagement+2
Talks·20 min
Adrian · Henry Danielson Hankashyyyk
Shows how the AMSAT CubeSatSim lets learners build and test a satellite emulator and study space security without launch.
villagelearningembedded+1
Talks·45 min
Royce
Explores how random game outcomes can carry executable bits to reconstruct a payload through four proof-of-concept loader designs.
linuxmalware-analysisdetection+2
Talks·21 min
Brooks McMillin
Shows how a malicious MCP server can steer an AI agent into leaking data, and which classic controls reduce that risk.
aiattackidentity+2
Talks·52 min
strandjs
Explains how old cloud and supply-chain weaknesses keep resurfacing across Office 365, Entra ID and Azure.
cloudsupply-chainidentity+3
Talks·48 min
Covers cross-site scripting, a long-standing web vulnerability class.
webappsecvulnerabilities
Talks·53 min
Ezra Woods
Shows how kiosks and presented apps can be escaped to reach the host, with Windows, ChromeOS and Citrix examples.
devicewindowsattack+2
Talks·23 min
Kristen Sanders
Explains how security skills can help nonprofits, OSINT teams, and families protect children and older adults from online harm.
privacyintelligencesocial+2
Talks·50 min
Christian Demers
Shows how ransomware in hospitals harms patients, and how emergency medicine ideas could guide recovery of clinical systems.
ransomwarehealthcareincident-response+3
Talks·43 min
Glen Sorensen
Shows how tabletop role-playing mechanics can make incident response training more engaging and realistic.
incident-responselearningteam+2
Talks·53 min
Dan Petro
Shows how a WebAssembly stager connects to a Sliver C2 server while staying outside what many EDR products inspect.
red-teamedr-evasionwebassembly+2
Talks·50 min
Average Joe
Shows how consumer router firmware is pulled from debug ports and flash chips, then tested for a buffer overflow.
hardwareembeddeddevice+2
Talks·46 min
Mackenzie
Explains how AI is reshaping open-source malware, covering hallucinated package names, polymorphic payloads and developer tools.
supply-chainmalware-analysisai+2
Talks·18 min
Robert Meylor
Shows how a game mod that passed antivirus scans led to a PayPal account takeover and the personal recovery that followed.
incident-responseidentitylessons-learned+2
Talks·20 min
GingerHacker
Walks through a SOC analyst's blocked legitimate DocuSign mistake, the DMV outage it caused, and the process fixes that followed.
phishingincident-responsesecurity-operations+2
Talks·46 min
Heisenberg
Outlines the mindset, ethics, and practical skills that help newcomers build a penetration testing career.
penetration-testinglearninginterview+2
Talks·29 min
TheTechromancer
Shows how selected Rust components can speed up a Python security tool through PyO3, with benchmarks and packaging steps.
tooldevelopmentcode+2
Talks·45 min
Nate Robb
Explains how an emerging-threats team filters new CVEs into a prioritized investigation queue using exposure and exploitation signals.
vulnerabilitiesthreatrisk+2
Talks·52 min
Nicholas Anastasi · Juan Pablo Gomez Postigo
Shows how a trusted proxy header bypassed authentication in popular self-hosted Servarr media applications.
appsecopen-sourcevulnerabilities+2
Talks·50 min
cybaix
Badge Pirates walk through building the CC14 ESP32-S3 conference badge and show attendees how to modify it.
hardwareembeddedbuilding+2
Talks·51 min
Casey Beaumont
Explains how security metrics can reward noise and activity, and how to measure real risk reduction instead.
managementriskteam+2
Talks·53 min
yltsi
Ranks ways to source hardware for embedded security research by cost, effort, ownership and ethical risk.
hardwareembeddeddevice+3