BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Pickled and Exposed: RCE in AI Serving Frameworks\n 
   Tags: Intro/Beginner | AppSec Village | Creator Talk/Panel\n   When: Fri
 day\, Aug 7\, 11:10 - 11:40 PDT\n   Where: LVCCW Level 1 Hall 2 604 (Appse
 c Village) Main Stage - [1]Map\n\n   Description:\n\n   Your LLM serving s
 tack is probably listening to the entire internet\n   right now\, and it w
 ill run whatever code that internet sends it. It\n   will not ask who you 
 are. Everyone is busy chasing prompt injection\n   and jailbreaks. Meanwhi
 le\, the boring bugs are wide open. SGLang\n   serves large language model
 s for thousands of deployments\, with 25k+\n   GitHub stars. I read the so
 urce and found two unauthenticated RCEs.\n   There was nothing clever abou
 t it: a network-exposed broker hands\n   attacker data straight to pickle.
 loads(). Send a payload\, get a shell.\n   I will walk the vulnerable code
  and pop a shell live on stage. You\n   will leave knowing exactly what to
  grep for in your own AI stack\,\n   before someone else greps it for you.
  Two CVEs. One grep. Zero\n   sophistication required.\n\n   SpeakerBio:  
 Iggy\n\n   Igor Stepansky is a Security Researcher at OX Security\, where 
 he works\n   on agentic AI for offensive security and automated penetratio
 n\n   testing. Previously\, he was part of Orca Security's Research Pod. H
 is\n   research spans unauthenticated remote code execution in AI/LLM serv
 ing\n   frameworks\, a use-after-free race condition in the Linux kernel's
 \n   ksmbd SMB3 serve\, and supply chain and CI/CD security across modern\
 n   developer ecosystems. His work focuses on finding and exploiting\n   h
 igh-impact vulnerabilities in widely deployed infrastructure\, and he\n   
 is a regular contributor of CVEs in open-source software.\n\n   '\n\n   1.
  #LVCCW_Level1_Hall2\n\n\n
DTEND:20260807T184000Z
DTSTART:20260807T181000Z
LOCATION:AppSec Village - LVCCW Level 1 Hall 2 604 (Appsec Village) Main St
 age
SUMMARY:Pickled and Exposed: RCE in AI Serving Frameworks
END:VEVENT
END:VCALENDAR