BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.romhack.io//romhack-camp-2026//speaker//RETUSB
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-romhack-camp-2026-QBPJBB@cfp.romhack.io
DTSTART;TZID=CET:20261004T100000
DTEND;TZID=CET:20261004T104000
DESCRIPTION:We used to treat every CVE as an alert. Each one meant dropping
  what we were building\, classifying severity\, chasing versions\, lightin
 g up the dashboard in red. Endless noise. That works when a serious vulner
 ability is a monthly event. It doesn't anymore. In 2025 the Linux kernel w
 as the single most reported product on the planet\, with thousands of CVEs
 \, **roughly ten every day\, from one project**. And its maintainers don't
  even rank them by severity\, so you can't sit back and wait for the "impo
 rtant" ones. Then the AI era poured fuel on the fire: 2026 is on track for
  **66\,000 CVEs**\, and a single AI model (Claude Mythos) recently surface
 d thousands of high severity flaws that remain **99% unpatched**. The floo
 d is now machine speed.\n\nWhen a CVE lands every few minutes\, you can't 
 sound the alarm every time. So we stopped. Today patching is just part of 
 the workflow\, and we fight AI with AI: automation ingests and rolls out t
 he patches\, while AI triages the flood down to what is actually exploitab
 le for each deployment. This talk shows how a small team keeps **hundreds 
 of Keycloak clusters and thousands of vulnerabilities** under control\, ev
 erywhere and anytime\, without adding a single delay to the product roadma
 p.
DTSTAMP:20260921T190632Z
LOCATION:STAGE 2 (Ghost in the Shellcode)
SUMMARY:When Even AI Writes the CVE - Luis Rubiera
URL:https://cfp.romhack.io/romhack-camp-2026/talk/QBPJBB/
END:VEVENT
END:VCALENDAR