This February, I presented at two security events in London – the DevSecOps London Gathering and the OWASP London Chapter meetup.
DevSecOps London Gathering – February 18
On February 18th, I presented at the DevSecOps London Gathering (together with London DevOps), hosted by Glenn Wilson and Matt Saunders.
My talk, “Concrete Evidence: Two Races, One RCE”, covered how I discovered and exploited race conditions in Concrete CMS’s file upload functionality, chaining them to achieve SSRF and ultimately Remote Code Execution.
My colleague Viola Lykova also presented her talk on authentication as a production system, exploring the real-world complexities of building and maintaining authentication at scale.
It was a great evening with an engaged audience. DevSecOps London has always been a strong meetup for bridging the gap between development, security, and operations teams, and this was no exception.
OWASP London – February 26
On February 26th, I presented at the OWASP London Chapter meetup, hosted at Civo Tech Junction. I was invited by Sam Stepanyan, one of the OWASP London chapter leaders, along with co-organisers Sherif Mansour and Andra Lezza.
My talk covered Vesta Admin Takeover – Exploiting Reduced Seed Entropy in Bash $RANDOM, which was nominated for PortSwigger’s Top 10 Web Hacking Techniques of 2025. I demonstrated how the computational domain needed to exploit bash’s random number generation can be reduced by over 98% through technical analysis, and by 99.97% when combining it with a social engineering trick. The live demo completed the exploit in under a minute.
The other speakers delivered strong talks as well. Mariya Hristova presented on North Korean threat actors infiltrating tech firms by posing as Eastern European developers, and Gary Archer covered AI agent security.
The event was sponsored by Curity (who donated a Nintendo Switch 2 as a raffle prize), and we at FORTBRIDGE donated a Flipper Zero. Congratulations to Daniel Trugman who won the Flipper!
Previously, I presented this research at BlueHat IL 2025, where it was also well received. It was great bringing it to the London audience and the always welcoming OWASP community.
Wrapping Up
Two great events in one month. London’s security community is active and growing, and I always enjoy connecting with fellow researchers and practitioners at these meetups. Looking forward to the next one.
About Post Author
