Open Source Summit Korea 2026

As Generative AI and Agentic AI continue to evolve, cyberattacks have become increasingly automated. With hundreds of new CVEs disclosed every day and AI-powered attacks are automated in zero-hour, traditional security and patch management approaches have reached their limits.

This session explores how organizations can build a lightweight hardened infrastructure and a trusted Zero-CVE environment with Red Hat AI on a proven platform that leverages the strengths of the open source ecosystem. It also examines the need for autonomous defense systems and approaches to implementing them, enabling real-time threat response while maintaining infrastructure stability through controlled AI-driven automation.

Institutional blockchain systems need collective defense, yet the data behind the vulnerabilities they discover cannot leave the institution. The OpenReagent project was launched to break that paradox through an open standard built on sharing signatures, not source. A year in, the concept has become a working technical foundation, with early benchmark evidence and first conversations with institutions testing real fit. This session shares what that foundation now enables, and what it doesn't yet, and issues a direct call to researchers ready to deepen the technical frontier, and to institutions ready to join the initiative as early partners.

The automotive transition to Software-Defined Vehicles (SDVs) relies on mixed-criticality architectures, consolidating open-source infotainment (Automotive Grade Linux) alongside safety-critical Real-Time Operating Systems (RTOS). This virtualization boundary—often KVM/Xen—is assumed to be a secure airgap. However, guest-to-host communication requires hardware abstraction, primarily via the VirtIO standard.

This 40-minute session conducts a hardcore technical teardown of the virtqueue shared-memory mechanism, exposing how legacy C-based VirtIO backends (vhost-net) introduce critical vulnerabilities into the automotive supply chain.

We will dissect a hypervisor escape utilizing custom fuzzing. By crafting malformed descriptor chains to bypass frontend validation, a compromised guest can force the host's backend into out-of-bounds memory corruption, effectively bridging the airgap into the control plane.

Finally, we will architect the open-source defense: migrating to memory-safe rust-vmm virtualization components to mathematically eliminate buffer overflows, and deploying zero-overhead eBPF probes for kernel-level I/O anomaly detection.

Popular open source operating systems like the Linux Kernel and Zephyr RTOS accept up to 9 commits per hour. Safety standards, like 61508, 26262, and others were developed without this rate of change in mind. Safety standards also expect the requirements to be explicit, which is not part of OS development processes. By using AI tools, we're able to accelerate the analysis of OS code to derive the requirements and traceability to tests. By storing this info in tools that can import and export System Package Data eXchange (SPDX) 3.0+, we're able to capture the requirements in a way that can be leveraged for wider system analysis necessary for safety. Associating integrity methods with the requirements and code snippets, also enables monitoring. Combining requirements traceability with precise build SBOM metadata, gives us a framework to keep a component compliant to a safety profile after a security fix.

This talk will provide a view on the latest experiments occurring with the Linux Kernel in the ELISA project, as well as in the Zephyr Safety Working group, and SPDX Functional Safety working group to extend SPDX to meet the needs of establishing these frameworks.