ThinkstScapes Research Roundup - Q2 - 2026

Infrastructure under renewed scrutiny Lost in Translation: Text Message Spoofing via Email

Sumanth Rao, Ye Shu, Stefan Savage, Aaron Schulman, Geoffrey M. Voelker, and Enze Liu

[Code] [Paper]

Hack the Source, Of the Source

Tsi-Lin Ng

[Slides]

RebirthDay Attack: Reviving DNS Cache Poisoning with the Birthday Paradox

Xiang Li, Yuqi Qiu, Mingming Zhang, Zuyao Xu, Lu Sun, Baojun Liu, Jia Zhang, Xiaofeng Zheng, Haixin Duan, Zheli Liu, Yunhai Zhang, Dunqiu Fan, and Fasheng Miao

[Slides] [Paper]

Strange Inputs, Critical outputs: Attacking Infrastructure Through Innocuous Network Protocol Fields

Sasha Romijn

[Blog post] [Video]

Clouds raining data Sub:jugation – Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers

Tal Skverer

[Blog post] [Video]

Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities

Mathé Hertogh, Dave Quakkelaar, Thijs Raymakers, Mahesh Hari Sarma, Marius Muench, Herbert Bos, and Erik van der Kouwe

[Code] [Paper] [Site]

OCInferno: An Offensive Security Toolkit for OCI

Scott Weston

[Code] [Lightning Talk Video] [Video]

Zapocalypse: Compromising every Zapier user through a Lambda memory leak

Yair Balilti

[Video] [Website]

Sharp edges in Windows ecosystems Breaking Hybrid Boundaries Across Azure and Windows

Ilan Kalendarov and Ben Zamir

[Slides]

PhantomRPC: A New Privilege Escalation Flaw in Windows RPC

Haidar Kabibo

[Slides] [Code]

Iron Giant: When the vault becomes the victim

Erik Egsgard

[Video]

Hunting with models, and models being hunted RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference

Qijun Wang, Chunqi Qian, and Huacheng Zeng

[Code] [Paper] [Site]

Revelio: Blurred Images Can Still Disclose Your Identity

Haoyu Zhai, Shuo Wang, Pirouz Naghavi, Qingying Hao, and Gang Wang

[Site] [Paper]

Bad Vibes: Pwning Coding Agents 70 Times With The Same Bugs

Philip Tsukerman, Nil Ashkenazi, and Alon Zahavi

[Slides]

System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models

John McIntosh

[Blog post] [Code]

Nifty sundries Protecting Cookies with Device Bound Session Credentials

Benjamin Ackerman, Daniel Rubery, and Guillaume Ehinger

[Blog post] [Documentation]

Turning Spam Filters Into Your Greatest Enemy: Intrusions Via RCEs in E-Mail Spam Filters

Ting-Wei Hsieh and Kai-Ching Wang

[Slides]

AirSnitch: Breaking Client Isolation in Wi-Fi Networks

Mathy Vanhoef, Zhiyun Qian, Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhaowei Tan, and Srikanth Krishnamurthy

[Slides] [Paper] [Code]