• Kulkan Newsletter
  • Posts
  • Ekoparty is coming, payment integration risks, plus other offensive security highlights

Ekoparty is coming, payment integration risks, plus other offensive security highlights

The latest from Kulkan: what to expect from Ekoparty 2026 (we'll be there again as official sponsors!), a deep dive into the attack surface hiding inside your payment integrations, and the vulnerabilities, exploits, and research making noise in the offensive security landscape.

September 29, 2026

šŸ—“ļø Key Industry Events:

Ekoparty 2026 is Coming!

Ekoparty is right around the corner, and Kulkan will once again take part as an official sponsor of the leading hacking conference in LATAM.

As we've done for several years, we're proud to keep supporting the growth of this community from our perspective as penetration testing experts, helping global companies raise their security posture.

Will you be at the conference? Come visit our booth to meet a team of consultants who think like real attackers, grab some of our stickers, plus other surprisesā€¦

See you at Ekoparty!

šŸ’” Security Highlights:

Inside the Payment Integration Attack Surface

If your app connects to a payment processor through code your team wrote, your biggest financial risk may be the part nobody has ever tried to break.

The risk isn't the payment processor. The risk is the in-house 'glue' you wrote to turn its "payment succeeded" into your product's "access granted." What happens when that ā€˜glueā€™ is never tested adversarially?

šŸŒ Industry News:

What's shaping the threat landscape this month?

A zero-click privilege escalation in Google Pixel devices under active exploitation, internal OpenAI agents uploading malicious packages to RubyGems, critical MikroTik RouterOS vulnerabilities enabling full device takeover, and other cybersecurity articles worth readingā€¦

šŸ“ Latest from Our Blog:

U-Boot as an attack surface on a Xiaomi L09G Smart Speaker

A root shell on a Xiaomi smart speaker obtained through Secure Boot bypass and custom kernel image injection, using nothing beyond a UART connection.

A Zip encryption downgrade caused by an incorrect operator

A single-character typo in pyzipper silently downgraded AES encryption, leaving files recoverable by brute force without ever attacking the password.

Reversing a 433 MHz Weather Sensor

A commercial weather station's RF protocol decoded from scratch, with arbitrary readings successfully injected and accepted by the base station.

Any penetration test in scope?

Let's start the conversation and explore how an attacker-led approach can strengthen your defenses and support your business growth.