Pass the SALT Conference

THREAT INTEL SESSION
Let's close the week by giving exposure to our Threat Intel session 🔥

Our topnotch and seasoned speakers will provide you talks and workshops on bleeding edge topics of the field:

- State of the Art of Suricata on IOC by Eric LEBLOND (CTO, Stamus Networks) 🚀 : talk & workshop

- Private Key Leaks Detection using Certificates Transparency by Gaëtan Ferry and Guillaume Valadon 🔦

- Alexandre Dulaunoy will present GCVE, an initiative for Vulnerability Tracking for an Open Security Ecosystem 📣

- Raphaël Vinot & Quinn Norton will teach you how to improve your Web Forensics capabilities with Lookyloo & Lacus 💻️

- And last but not the least, Xavier Mertens 🇧🇪 & Teqagogo will expose their new research, PhishTrack, about credentials leaks reuse monitoring 🚀

🚨 Take your free(!) seat 🥰

🎟️ Booking: https://pretix.eu/passthesalt/2026/

📑 Program: https://cfp.pass-the-salt.org/pts2026/schedule/

📅 Dates: June 30 > July 2, 2026

📍 Université Catholique de Lille, France: https://maps.app.goo.gl/XQfaqsNJmDtwiJ747

🌐 Website : https://2026.pass-the-salt.org/

LOST IN PQC TRANSLATION (OR NOT!) SESSION
Let's start this week by giving exposure to our PQC transition session 🔥

You will discover from experts of the field real world examples of PQC transition in different ecosystems:

- Updated state of the post-quantum transition by Yvan Vanhullebus (tech lead, Stormshield) 🔬

- See how Cryptpad experimented with PQC algorithms and transitioned with Fabrice Mouhartem (Senior R&D Engineer, Cryptpad) 💻

- And last but not the least, discover Merkle Tree Certificates joined initiative by Google & Cloudflare which could revolutionize WebPKI ecosystem by Bas Westerbaan (PQC lead, Cloudflare) 🚀

🚨 Take your free(!) seat 🥰

🎟️ Booking: https://pretix.eu/passthesalt/2026/
📑 Program: https://cfp.pass-the-salt.org/pts2026/schedule/
📅 Dates: June 30 > July 2, 2026
📍 Université Catholique de Lille, France: https://maps.app.goo.gl/XQfaqsNJmDtwiJ747
🌐 Website : https://2026.pass-the-salt.org/

📣 Call for proposals for the 2026 edition.

We are looking for talks and workshops about security and open-source software.

Offensive or defensive security, low level, systems or CI management, tooling, we welcome any security subject as long as it related to a free software or provide an open-source tool!

👉 https://2026.pass-the-salt.org/

📩 A question, doubt? Our support team is listening to you: speaker-support@pass-the-salt.org

⏰ The deadline is March, 31 2026!

HOW IT STARTED vs HOW IT ENDED (aka you should submit to our CFP 🎯 )

During the 2025 edition of Pass the SALT, Guillaume Valadon and Gaetan F. on on side and Philippe Boneff with Roger Ng on the other side gave a talk. Due to our single track format, they listened to their respective talks 🙏

Then, due to the human size of the event, they were able to meet quietly during the social event, spoke a lot ( 🍻? 🤷‍♂️ ) and started to collaborate ... 😎

Finally, their joint research about private keys leaks and insights from Certificate Transparency born on the benches of PTS25 has been accepted at ... Real World Crypto 2026 🎉

🥰 When we say our conference will allow you to have access to quality talks and great networking opportunities, it is not marketing here!

So, you want to be able to meet other great speakers, get new ideas and be motivated to start collab?

📣 Our #pts26 Call For Proposals is open! 🚀

Memento:

👉 https://2026.pass-the-salt.org/

📅 Deadline: March, 31 midnight UTC+2

Only requirement: your research has to speak about Security and Free Software (or open format/protocol)

🔍 If you are interested in, we keep track of contributions/collabs (we are aware of) that were born at Pass the SALT: https://www.pass-the-salt.org/achievements/#contributions 😍

SPONSOR

📣 Today, we are delighted to announce the @quarkslab@infosec.exchange Gold level sponsoring 😍

Since day one (9 years ago!), @quarkslab@infosec.exchange supports us, it is an incredible help for an organization like us 🙏 Thank you so much!

📄 @quarkslab@infosec.exchange provides to companies Security Audit capabilities (pentest, code & architecture) & Consulting expertise powered by its cutting edge R&D. It can also help you with Qshield, its comprehensive security suite designed to safeguard intellectual property (IP), data, devices, and software against modern cyber threats.

🔥 @quarkslab@infosec.exchange produces year after year a fantastic number of cyber open source projects and contributions (ex: FLOSS audits) 👏

Two 2026 examples:

⚡️Sighthouse: a tool designed to assist reverse engineers by retrieving information and metadata from programs and identifying similar functions.

👉 https://github.com/quarkslab/sighthouse

⚡️Bitcoin Core audit : @quarkslab@infosec.exchange conducted the first public third-party security assessment of Bitcoin Core, the canonical implementation of the Bitcoin network.

👉 https://blog.quarkslab.com/bitcoin-core-audit.html

CFP PROPOSALS UNDER REVIEW

📣This is just a service message to all our authors to say their proposals are currently under review by the esteemed members of the Pass the SALT 2026 CFP Review Board.

🙏 Be sure they will invest time and effort in this task helped by their expertise and kindness!

📅 Results will be sent to authors between April 28 and May 1!

Thanks again for the hard work and for your trust 👏

SAVE THE DATE!
The organisation of the #pts26 edition is starting 😎

📣 Info we can already share are:
- 🗓️ Tuesday June 30 to Thursday July 2, 2026 ✅
- 📍as asked in your feedback answers, we will be again at Université Catholique de Lille 🎉

Website & more are coming soon! 😘

SPONSORSHIP

📣 We are very proud to announce that Passbolt (@passbolt@mastodon.social) is our new PLATINUM sponsor 🔥

The open source security company supports us now 3 years in a row allowing us to provide you a free conference with high quality security and free software content 🙏

Passbolt is an open source team password solution which provides to its users an always growing set of features. They recently added to their solution:

- new kind of secrets (encrypted notes, key-value),

- zero-knowledge mode,

- management for dynamic roles, secrets versioning.

They also started the process of being certified by ANSSI (CSPN, FR security certification) 🚀

In 2026 are coming:

- offline mode,

- more secrets (ssh, passkeys),

- safari extension

- or security reports among other features 💥

👉 Give it a try if you haven't already do it: https://www.passbolt.com/

CFP ENDING IN 10 DAYS

⏳ It's time to hurry up if you want to be able to give a talk/workshop at Pass the SALT 2026 😍

📅 We are going to close our CFP on March 31 at midnight (GMT+2).

🔥 Just go and submit your Security x Open source (or open format/protocol) proposal 👉 https://cfp.pass-the-salt.org/pts2026/cfp

🥰 See you soon!

🙏 Relay of this message will be highly appreciated!

CRYPTO FOR USERS SESSION
A new day for a new session: today let's look at our Crypto for Users Session content 🔥

- Thibault Meunier will expose how Oblivious HTTP can help web services to NOT know your user IP address. Interesting perspective, isn't it ? 😉

- Marius Cristian will introduce KeibiDrop, a secure tool for a specific use case: getting files from one device to another without uploading them to someone else's server 🚀

- Cedric will present Fractum, an open-source CLI for Threshold-Based Cold Storage of Critical Secrets 🔐

🚨 Last step: book your free seat!

🎟️ Booking: https://pretix.eu/passthesalt/2026/
📑 Program: https://cfp.pass-the-salt.org/pts2026/schedule/
📅 Dates: June 30 > July 2, 2026
📍 Université Catholique de Lille, France: https://maps.app.goo.gl/XQfaqsNJmDtwiJ747
🌐 Website : https://2026.pass-the-salt.org/

ANNUAL REPORT
Salty is back from vacation and well rested! 🏖️

So our mascot dove right into writing Pass the SALT annual report and is very happy to share it with you: https://2025.pass-the-salt.org/annual-report/ 🥰

#pts25

JUST SAYING
Today is the day! Our CFP ends in a few hours (midnight) 👋

👉 https://cfp.pass-the-salt.org/pts2026/cfp

PHOTOS
While Salty has decided to take some good times on the coast 😎, the team has found time to put online photos of #pts25 taken by our own @julioloayzam@infosec.exchange ❤️

Feel the soul of the event 👉 https://www.flickr.com/photos/yobibe/albums/72177720327694710

And all files available on our archives site: https://archives.pass-the-salt.org/Pass%20the%20SALT/2025/photos/PhotosPassTheSALT2025-by-jlm

SPONSOR

📣 We honored to announce our new Platinum Sponsor: @gandi@mastodon.social 🔥

🙏 Thanks so much for this long term support which helps us to build an open event with state of the art content dedicated to Security and Free Software!

📄 Gandi is a pioneering French internet company and a leading provider of digital services, specialising in domain names, web hosting and cloud solutions. With a presence across three continents and over 2.3 million domain names under management, the company supports individuals, businesses and large enterprises in creating, managing and securing their online presence through reliable, transparent and high-performance solutions.

🛠️ Gandi also supports many organisations like The Electronic Frontier Foundation, Spamhaus, or VLC, PostgreSQL and Ubuntu with whom we share many values like the fight for Internet access freedom, Privacy and Free Software ❤️

LAST CALL: CFP ends in 4 DAYS 🚨

🔥 Last reminder for our dear potentials authors: go & submit your Security x Free Software (or open protocol/format) research or tool NOW!

👉 https://cfp.pass-the-salt.org/pts2026/cfp

📅 CFP ends: Tuesday March 31 at midnight GMT+2

🌐 https://2026.pass-the-salt.org/

👋 See you soon in Lille & 🙏 for relaying!

SPONSOR
📣 We are so proud to announce our first #pts26 sponsor: Synacktiv 🚀
The company supports us since many years and it is a real great pleasure to have them onboard!

📖 "Synacktiv aims to help companies assess and strengthen the security of their information systems. Founded in 2012 by two IT security experts, Nicolas Collignon and Renaud Feil, the company has grown over the years to become the French benchmark in offensive security. Synacktiv brings together more than 200 specialists in its pentest, reverse engineering, incident response, offensive tool development and REVEL·IO digital investigation tool divisions. The company has offices in Paris, Toulouse, Rennes, Lille, Bordeaux and Lyon, and is CESTI-approved by ANSSI and PASSI LPM-qualified."

💻 🛠️ Free Software is a long story for Synacktiv and just last year, among others contributions, its experts aka ninjas produce and release under open licence the 3 following offensive/defensive Security tools :
- KcMapper: tool for exporting Keycloak configuration data to a Neo4j graph database.
- Laravel crypto killer: tool designed to exploit poor implementations of encryption mechanisms within Laravel applications.
- DepFuzzer: a tool used to identify dependency confusion vulnerabilities or projects where the owner's email address can be hijacked.

👉 Github Synacktiv: https://github.com/synacktiv/

LAST REMINDER - 3 DAYS BEFORE CFP END

⏱️Hurry up guys, the CFP ends next Sunday midnight!

👉Submit your free software (or open protocol/format) & security talk to: https://cfp.pass-the-salt.org/pts2025/cfp

🙏boosts welcome!

SPONSOR

📣 Whilst our program committee members are reviewing the submissions to the CFP, let’s give a warm welcome to our new Gold sponsor: Ledger 🎉

📄 Founded in 2014, Ledger is the global leader in digital asset security for individuals and institutions. Ledger Wallet™, the all-in-one crypto app, offers a complete, secure platform where users can securely buy, sell, swap, spend, and earn rewards with their crypto, secured by the iconic Ledger signers. With more than 8 million signers sold in 165+ countries and 10+ languages, Ledger is the trusted solution for individuals to exercise digital ownership, portfolio management, and control. Almost 30% of BTC and more than 30% of Dollar stablecoins held by retail investors is secured by Ledger. 🚀

🛠️ Its world-renowned white-hat security team, Ledger Donjon, is a crucial resource for securing the entire digital asset space. It develops and open-sources their research and assessment tools: https://donjon.ledger.com/tools-suite/ 🔥

Thanks so much for the support & welcome to the Salty family 🙏

EXPLOITATION SESSION
Let's continue our program exploration by discovering the Exploitation Session content 🔥

- Rémi Matasse & Pierre Martin will expose deep details about the CVE-2025-54068 preauth RCE they found in Livewire & tooling they develop around it 💣
- Gal Zaban & Ido Shani will share with us two CVE found in Chainlit, a framework helping building apps for conversational AI 💣
- Cassius Garat will expose a practitioner's field report of current Bitlocker bypass state of the art 🔐
- and Marius G. will propose a workshop to walk through the full attack chain of a real-world Fancy Bear (APT28/GRU) intrusion with all participants 🔬

🚨 Last step: book your free seat!

🎟️ Booking: https://pretix.eu/passthesalt/2026/
📑 Program: https://cfp.pass-the-salt.org/pts2026/schedule/
📅 Dates: June 30 > July 2, 2026
📍 Université Catholique de Lille, France: https://maps.app.goo.gl/XQfaqsNJmDtwiJ747
🌐 Website : https://2026.pass-the-salt.org/