Security research starts with a question: what happens when a system behaves differently from what its designers intended? At Ekoparty, that question reaches far beyond computers. It extends to transportation networks, connected cameras, wireless infrastructure, artificial intelligence, and the technologies woven into everyday life.
This October, Zarego visited Ekoparty 2026 in Buenos Aires, joining an event that brings together researchers, developers, students, and cybersecurity professionals. We attended as visitors, with an interest in learning from the research and exploring the conversations shaping the community.
Held from October 7 to 9 at the Centro de Convenciones Buenos Aires, the conference’s 22nd edition adopted the theme “Embrace the Chaos.” Its program offered plenty of reasons to question how much control we really have over the systems around us.
A Meeting Point for the Hacker Community
Ekoparty has been bringing the hacker community together since 2001. Its identity combines technical investigation with a willingness to experiment, challenge assumptions, and share discoveries. That combination helps explain its appeal across different backgrounds and levels of experience.
The main stage is only one part of that experience. Community spaces, workshops, and challenges create opportunities to approach security through discussion and practice. Experienced researchers can explore specialized subjects, while newcomers have different entry points into a field that can otherwise feel difficult to navigate.
For a software development company like Zarego, this exchange matters. Building reliable products requires understanding how people investigate failures, discover unexpected behavior, and test the boundaries of technology. Events like Ekoparty bring those perspectives into the same space.
Familiar Technologies, Unexpected Exposure
Some of the most relevant research concerned products people use without thinking much about their underlying infrastructure.
Sammy Azdoufal’s presentation, “Nobody puts baby in a corner,” examined the cloud platform behind connected baby monitors and home security cameras. The research described a messaging access weakness affecting a platform serving 1.1 million cameras, with exposure extending to device events and sensitive household information.
The implications reach beyond one product category. A connected device depends on an ecosystem of services, permissions, communication protocols, and administrative tools. A weakness in that ecosystem can undermine the privacy people expect from the device itself.
For engineering teams, this raises an essential question: are security boundaries enforced consistently across the entire service? A polished interface offers little reassurance if the infrastructure behind it gives users access to information belonging to someone else.
Privacy Beyond Message Encryption
Messaging platforms brought another dimension to the privacy discussion. Research by Gabriel Gegenhuber, Max Günther, and Philipp Frenzel examined WhatsApp’s contact discovery system and the enumeration of approximately 3.5 billion accounts. Their presentation highlighted how account discovery and metadata can create exposure even when message contents remain protected.
This distinction is important for anyone building digital products. Privacy includes information about whether an account exists, how it can be discovered, and what a service reveals through ordinary interactions.
Features designed to make an application convenient can behave very differently when used systematically at scale. Contact discovery illustrates why teams need to evaluate both individual requests and the information someone could accumulate through repeated use.
The broader engineering lesson is to assess privacy across the complete user journey, including the seemingly minor features surrounding a product’s core functionality.
AI Enters the Security Research Workflow
Artificial intelligence appeared as a practical research tool as well as a security concern.
Jon Williams’s “Prompt Critical: AI-driven Weaponization of a UniFi OS RCE Chain” explored an AI-assisted investigation into UniFi OS. The announced research described using commercially available AI tools to work from firmware analysis toward a functioning exploit, while examining where those tools succeeded and where they fell short.
For developers, the significance lies in how AI changes the effort required to investigate software. Tasks that once demanded extensive manual work may become more accessible, accelerating experimentation for researchers and attackers alike.
Our takeaway is that faster development needs equally thoughtful verification. As we explored in AI Is Making Software Less Secure, greater speed makes architecture, review, and engineering judgment more important. Teams adopting AI should consider how it affects testing, permissions, and vulnerability discovery.
Infrastructure Connects Digital and Physical Risk
Other presentations focused on technologies that support movement and connectivity.
Federico Kirschbaum and Gaston Aznarez investigated Ubiquiti AirMax wireless equipment in “Root From Kilometers Away.” Their work explored proprietary wireless behavior and vulnerabilities affecting multiple device families, challenging assumptions about the protection offered by obscure implementations.
Ignacio N.’s presentation on public transportation examined weaknesses in an Argentine city’s mobility ecosystem, including access controls, administrative systems, and connected equipment. The research connected technical vulnerabilities with services used by more than 1.5 million people daily.
Together, these subjects show why security requires a system-wide view. Networks, applications, devices, and operational processes depend on one another. Reviewing each component separately can miss the paths that emerge between them.
Established Platforms Still Deserve Scrutiny
The program also challenged assumptions about mature software ecosystems. Nick Powers’s “MSIX’d Up: Weaponizing the Modern Windows App Packaging Ecosystem” investigated ways to abuse Windows application packaging features. The research paired offensive techniques with detection guidance for defensive teams.
That pairing reflects a valuable aspect of security research: explaining a weakness should help others recognize and address it.
Established platforms remain complex, and features designed for legitimate purposes can interact in unexpected ways. For software teams, platform maturity does not remove the need to understand deployment behavior, default settings, and the privileges applications receive.
Preparing for the Next Cryptographic Transition
Sheila Ayelen Berta’s “A Practical Approach to Post-Quantum Readiness at Scale!” brought a longer-term infrastructure challenge into practical focus. Her presentation addressed measuring post-quantum readiness across TLS services, including implementation work within the ZMap ecosystem and the difficulties of migrating legacy and operational technology environments.
The useful shift was toward assessment: understanding what infrastructure exists, what it supports, and where change will be difficult.
That approach applies to many engineering challenges. Organizations need visibility into their dependencies before they can plan a meaningful transition. Preparing for future security requirements begins with knowing the systems operating today.
Learning Happens Beyond the Main Stage
Ekoparty’s villages reflected the breadth of the field. The 2026 lineup included spaces dedicated to hardware hacking, mobile security, malware, cloud security, social engineering, DevSecOps, operational technology, and AI resilience. Communities including Bug Bounty Girls Club, Chicas en Tecnología, and Mujeres en Ciberseguridad were also represented.
These spaces give specialized communities room to exchange knowledge and help people find others who share their interests. They also make clear that cybersecurity includes human behavior, education, infrastructure, and software engineering.
Our visit continued conversations explored during Zarego at Nerdearla 2026, where privacy, community, and AI’s contribution to security research also featured prominently.
For Zarego, visiting Ekoparty was an opportunity to stay close to that wider conversation. The research offered concrete examples of why secure development depends on curiosity, careful design, and continuous questioning. The community provided the setting in which those questions could be shared, explored, and carried back into everyday work.
Let’s Talk.
