Hello👋! I’m Bocheng Xiang, a Ph.D. student in the System and Software Security Laboratory at Fudan University, advised by Prof. Yuan Zhang. I’m the speaker in Blackhat USA / Europe, and PoC. I am also the captain of Whitzard, the CTF team of Fudan University.
My research interests span web security, operating system security, and Java security. To date, I have published three papers at top-tier security conferences, in USENIX Security、NDSS. In addition to academic research, I have discovered hundreds of high-impact 0-day vulnerabilities, which have been acknowledged in security advisories by major technology companies, including Apple, Microsoft, Intel, HP, Tencent, and VMware. Many of these vulnerabilities have received monetary rewards, with my total bug bounty earnings exceeding $80,000.
Here is my CVE list: CVEs of BoCheng Xiang
🔥 News
- [2026.01] 🎉 One talk about “reverse engineering of ALPC” accepted by RE//verse 2026! See you in Orlando, US! [Talk Abstract]
- [2025.12] 🎉 One paper accepted by NDSS 2026, hope to see you in San Diego!
- [2025.12] 🎉 Got first prize(No.5) at 4rd China Postgraduate Cybersecurity Innovation with 「Whitzard」
- [2025.10] 🎉 One talk about Link Following Attack accepted by PoC 2025! See you in Seoul, South Korea! [Talk Abstract]
- [2025.09] 🎉 One talk about LLM agent security accepted by BlackHat Europe 2025! [Talk Abstract]
- [2025.07] 🎉 I’ve made 2025 MSRC MVR!
- [2025.06] 🎉 One paper received Honerable Mention Award at USENIX Security 2025!
- [2025.05] 🎉 One talk accepted by BlackHat USA 2025! [Talk Abstract]
- [2024.12] 🎉 One paper accepted by USENIX Security 2025!
- [2024.08] 🎉 I’ve made 2024 MSRC MVR!
📝 Publications
NDSS’26 LinkGuard: A Lightweight State-Aware Runtime Guard Against Link Following Attacks in Windows File System (to appear)
Bocheng Xiang, Yuan Zhang, Hao Huang, Fengyu Liu, Youkun Shi.
*In Proceedings of the 33rd Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, Feb 23-27, 2026. (CCF-A)
USENIX Security’25 Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations [PDF]
Bocheng Xiang, Yuan Zhang, Fengyu Liu, Hao Huang, Zihan Lin, Min Yang.
In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)
★ Honerable Mention Award (6.1%=25/407) [AR: 17.1%=407/2385]
USENIX Security’25 Effective Directed Fuzzing with Hierarchical Scheduling for Web Vulnerability Detection [PDF]
Zihan Lin, Yuan Zhang, Jiarun Dai, Xinyou Huang, Bocheng Xiang, Guangliang Yang, Letian Yuan, Lei Zhang, Fengyu Liu, Tian Chen, Min Yang.
In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)
💬 Conferences
[2025.08] Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications Blackhat USA 2025
[2025.11] Follow the Link: Building Full-Chain Local Privilege Escalation on Windows PoC 2025
[2025.12] Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents Blackhat Europe 2025
📖 Educations
-
Ph.D. in National Security, 2023-2028 (expected) 2023.09 - now, Ph.D, Fudan University, School of Computer Science.
-
Bachelor in Cyberspace Security, 2019-2023 School of Cyberspace Security, Beijing University of Posts and Telecommunications
🏅 Rewards
- [Dec. 2025] Got first prize(No.5) at 4rd China Postgraduate Cybersecurity Innovation with 「Whitzard」
- [Jul. 2025] Got first prize at 18th National College Student Information Security Competition with 「Whitzard」
- [May. 2025] Got 🏅 at 18th National College Student Software Innovation Competition with 「复旦大学攻防赛1队」
- [Dec. 2024] Got first prize(No.4) at 3rd China Postgraduate Cybersecurity Innovation with 「Whitzard」
- [Jul. 2024] Got 🥉 at 9th Shanghai University Student Cybersecurity Competition with 「Whitzard」
- [Jul. 2024] Got 🥉 at 17th National College Student Information Security Competition with 「Whitzard」
- [Aug. 2023] Got 🏅 at 2023 “Peak Geek” Cybersecurity Skills Challenge with 「小学生」
- [Dec. 2022] Got 🏅 at 5th “Qiangwang” (cyberspace power) International Elite Challenge on Cyber Mimic Defense with 「Dubhe」
- [Oct. 2021] Got 🏅 at XCTF-SCTF2021 with 「Dubhe」
- [Sep. 2021] Got 🥈 at TCTF2021 Rising Star with 「emmmm」