Overview
Join Nullcon Berlin 2026 for five days of technical talks, hands-on trainings, CTFs, and real-world cybersecurity research in Berlin. This conference is for hackers, researchers, red teams, blue teams, developers, product security teams, students, CISOs, and practitioners who care about the details of how systems actually break.
Schedule
Taking Control of GRUB: Building a Linux UEFI Bootkit from the Boot Chain Up
Explore how to build a Linux UEFI bootkit by reverse engineering GRUB and the boot chain to control early execution before the kernel loads.
Hostile Inference: A Tale of Exploiting Docker Model Runner for Container Escapes
Explore CVE-2026-28400, a Docker Model Runner vulnerability enabling container escapes and host filesystem writes with no user interaction.
Hypervisor? IDS? A silent Head Unit takeover with physical impact on modern EVs
Discover how vulnerabilities allow silent head unit takeover in Volkswagen EVs like ID.4, bypassing IDS for physical and remote attacks on infotainment systems.
Security Check – Rewinding iOS Virtualisation for Spyware Analysis
Explore iOS virtualisation advancements for spyware analysis with new open-source tools enabling secure and dynamic research on virtual iPhones.
Pay 2 Win: What Anti-Cheat Catches That Your EDR Doesn’t
Discover how kernel-level anti-cheat catches malware your EDR misses. Learn unique detection methods and ransomware bypass insights in this Nullcon talk.
Pwn the Hub, Own the Home: Breaking Home Assistant at Pwn2Own
Discover how a vulnerability in Home Assistant 'Green' device was exploited for full root access at Pwn2Own 2025. Learn about the risks to smart home hubs.
From Phone Farms to Cloud Phones: Industrialised Abuse at Mobile Scale
Explore how phone farms and cloud phones power large-scale mobile abuse. Learn detection strategies and insights into industrialised fraud at mobile scale.
Infected Drones: How Compromised Autonomous Systems Pwn Ground Control Stations
Discover how infected drones can compromise ground control stations, threatening autonomous drone fleets through systemic security flaws in MAVLink projects.
DMA-After-Free: Exploiting a Stale IOMMU TLB for Privilege Escalation on Qualcomm-Based Mobile Devices
Explore the DMA-after-free exploit leveraging stale IOMMU TLB on Qualcomm-based mobile devices for privilege escalation, demonstrated on Samsung Galaxy phones.
A router exploitation journey: From breaking into my ISP router to finding a MediaTek kernel 0day
Explore the router exploitation journey and discover how a Media Tek kernel 0day vulnerability was found and exploited on an ISP router.
Opening Brief: Europe's Cybersecurity Operating Reality in 2026
Morning Brief: From Technical Findings to Leadership Action
NIS2 in Practice: What Security Leaders Need Beyond Compliance
Critical Infrastructure Under Pressure: Energy, Transport, Healthcare, Manufacturing, and Public Services
DORA and Operational Resilience: ICT Third-Party Risk, Testing, and Incident Readiness
When Identity Becomes the Breach Path: Humans, Workloads, APIs, and Non-Human Access
Cloud, Identity, and SaaS Dependency: Where Enterprise Risk Is Concentrating
Ransomware, Extortion, and Business Continuity: What Resilience Looks Like After Compromise
Lunch Break
Cyber Resilience Act and Product Security: What Secure-by-Design Means for Leaders
AI Governance Meets Security Testing: What Leaders Should Ask Before Deployment
Third-Party and Supply Chain Exposure: The Risk You Do Not Fully Control
Crisis Tabletop: Supplier Compromise, Cross-Border Notification, and Public Response
Closed-Door Roundtable: What Are European CISOs Being Asked to Prove?
Command Room Roundtable: What Should Security Leaders Prioritize Next?
Closing Brief: What Comes Next for European Security Leadership
Day 1 Close: Decisions Leaders Should Take Back
Taking Control of GRUB: Building a Linux UEFI Bootkit from the Boot Chain Up
Hypervisor? IDS? A silent Head Unit takeover with physical impact on modern EVs
Pay 2 Win: What Anti-Cheat Catches That Your EDR Doesn’t
From Phone Farms to Cloud Phones: Industrialised Abuse at Mobile Scale
DMA-After-Free: Exploiting a Stale IOMMU TLB for Privilege Escalation on Qualcomm-Based Mobile Devices
Hostile Inference: A Tale of Exploiting Docker Model Runner for Container Escapes
Security Check – Rewinding iOS Virtualisation for Spyware Analysis
Pwn the Hub, Own the Home: Breaking Home Assistant at Pwn2Own
Discover how a vulnerability in Home Assistant 'Green' device was exploited for full root access at Pwn2Own 2025. Learn about the risks to smart home hubs.
Infected Drones: How Compromised Autonomous Systems Pwn Ground Control Stations
A router exploitation journey: From breaking into my ISP router to finding a MediaTek kernel 0day
Taking Control of GRUB: Building a Linux UEFI Bootkit from the Boot Chain Up
Explore how to build a Linux UEFI bootkit by reverse engineering GRUB and the boot chain to control early execution before the kernel loads.