Who's missing #BSidesSF & #RSAC 2026? 💙 Quick runZero recap:

✅ Making memories: #BSidesSF social sponsor & special Yeti badge!
✅ 2 RSA talks (available on RSAC website).
✅ Tongacon!
✅ Hosted 2 book signings & debuted runZero Day livestream.

Read the full recap: www.runzero.com/blog/rsac-bs...

Anyone know when the #BSidesSF 2026 talks will be posted? Or have the recordings from the streams? There are some really great talks I'd love to watch and share with others.

So did anyone happen to pirate @k8em0’s rendition of “You’ll Adapt?” from her #BsidesSF keynote?

If you were there, you will surely agree that it should be nominated for the Best Song Pwnie Award this year.

GitHub - ljagiello/ctf-skills: Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more - ljagiello/ctf-skills

Built some AI skills for CTFs → tested at #BSidesSF CTF.

🤖 Agent solved 50/54 challenges almost effortlessly.

Feels like a real shift in security problem-solving.

github.com/ljagiello/ct...

That’s a wrap on #BSidesSF 2026: The musical! 🎭

We danced, we sang, and we enjoyed connecting with the insightful and highly skilled people in the security community.

Thanks for another great conference BSidesSF, and see you next year!

#BSidesSF 2026
Your AI Agent Has Production Access: Now What?
from Jack, from Anthropic

#BSidesSF 2026

Hunting Malicious IDE Extensions: Building Detection at Scale Across Developer Workstations

Vinod Tiwari, Story Protocol

#BSidesSF 2026
A blueprint for building a generic authorization service for your organization
Ashwin Sidhalinganahalli, Roblox
and
Fletcher Ramee, Roblox

#BSidesSF 2026
A Worm in the Apple: Wormable Zero-Click RCE in AirPlay Impacts Billions of Apple and IoT Devices
Avi Lumelsky
and
Uri Katz

#BSidesSF 2026
How We Red-Teamed Our Own AI Agent: Lessons from Operation Pale Fire
Josiah Peedikayil, Block

#BSidesSF 2026
The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend

From
Christo Roberts
and
Dan Hollinger

Amazing day 2 #BsidesSF keynote by @k8em0.bsky.social !!!
Against the Tyranny of Optimization: On the Stability of Automated Republics
Katie Moussouris

@k8em0.bsky.social 's keynote hitting all my buttons! #bsidessf

#BSidesSF 2026
Against the Tyranny of Optimization: On the Stability of Automated Republics
Katie Moussouris

https://media2.giphy.com/media/NpL4D3Oc2bJUMAXF9P/200.gif

Nope, not at #RSA #RSAC #BSIDESSF

#BSidesSF part two!

The vendor hall is basically an ear worm factory and I am kinda loving it.

(Needs more Oklahoma and Music Man.)

good morning #bsidessf come see my standup routine at 11:15 in theatre 7 it will be a chill and fun story time and require very few brain cells 😇

Ready for a little downtime today at #BSidesSF 2026? Escape to the runZero sponsored Lounge (outside) & the Bar & Chill Out space (inside) from 9 AM-5 PM PT.

Stop by, say hello, get some swag, & take a selfie with Zeti!

👉️ Don’t forget, 2 complimentary drink tickets were provided at registration!

BSidesSF 2026: 📙 Power Dynamics in Security Leadership:... View more about this event at BSidesSF 2026

I will be speaking on Sunday at BSides on "Power Dynamics in Security Leadership: a legato leitmotif lullaby on leading lightly and luminously"
Sunday 4:25pm, AMC Theatre 12
https://sched.co/2E1io
#BSidesSF

#BSidesSF 2026
Breaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
Bhaumik Shah, CEO, SecurifyAI

Finally at @bsidessf.org 🎉
I'm giving a talk tomorrow at noon ✌🏻
bsidessf2026.sched.com/event/2E1hG/bu… #bsidessf

#BSidesSF 2026
When the supply chain hits a sour note
Kennedy Toomey, Datadog

#BSidesSF 2026
The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns
Julie Agnes Sparks, Datadog

SSH certificates and git signing When you’re looking at source code it can be helpful to have some evidence indicating who wrote it. Author tags give a surface level indication, but it turns out you can just lie and if someone isn’t ...

Blog post covering what I'm discussing in my #bsidessf talk on git commit signing with SSH certificates: codon.org.uk/~mjg59/blog/...

@allanfriedman.bsky.social #BSidesSF mystery resolved. Cancel the search drones! (Unless they've got a Hardware Bill Of Materials, of course!)

#BSidesSF 2026

Not My Vibe: When AI Coding Agents Go Off the Rails 🤖

Aonan Guan
and
Zhengyu Liu

#BSidesSF 2026

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi, Eureka DevSecOps | Forward Security

At #bsidessf and giving an opinionated talk on git signatures in theatre 9 at 3:50

I really like the idea of this updating sidebar for a presentation on an investigation #bsidessf

#BSidesSF 2026 panel I have been looking forward to for a while:

State of (Absolute) AppSec

Seth Law, Principal Consultant, Redpoint Security
Ken Johnson, CTO, DryRun Security
Kevin McDermott, Head of Security, Superhuman
Astha Singhal, Director of Sec, Netflix
Clint Gibler, tl;dr sec