#13 EBG13
OWASP Porto Chapter meetup: #13 - EBG13, November 24th, 2026, 18:00.
With support from Ordem dos Engenheiros - Região Norte (OERN) (Venue, Snacks and Drinks).
Agenda:
18:00 - Intro and Welcome by the OWASP Porto chapter leadership
18:15 - Performance Under Fire: The Science of Decision-Making in Security by Teresa Limpo
19:00 - PHP2Shell: Anatomy of a Shell Takeover by Milton Araújo
20:00 - Snacks and Drinks
Talks
Performance Under Fire: The Science of Decision-Making in Security by Teresa Limpo
Abstract: In high-pressure situations, such as live incident response, emergency zero-day patching, or high-stakes threat triage, decision-making is the most taxed resource. Even for highly skilled professionals, stress triggers cognitive shortcuts that can lead to fatal errors, overlooked risks, and slower response times.
This session moves beyond theoretical psychology to offer a practical look at how the human brain functions under technical duress. I will explore why our analytical capacity narrows during a crisis and, more importantly, how to "patch" these cognitive vulnerabilities.
The focus is on immediately applicable strategies to improve judgment and reduce human error when it matters most:
Pause Protocols: How to interrupt reactive patterns to avoid "copy-paste" fixes that introduce new risks.
Cognitive Load Management: Techniques to maintain focus and mental clarity during an active breach.
Decision Checkpoints: Simple mental frameworks to avoid the common trap of "tunnel vision."
Performance Resilience: Building the mental habits that allow experts to remain effective under extreme stakes.
Key Takeaway: Participants will leave with a science-backed toolkit to navigate high-pressure moments with more clarity, fewer errors, and better outcomes for their teams and systems.
Bio: Teresa Limpo is a PhD Psychologist with 20 years of experience in human behavior and performance. Her work is recognized globally, having been included in the Stanford University/Elsevier World's Top 2% Scientists list. During her tenure as a Lead Professor at the University of Porto, she headed several academic courses, published 70+ scientific articles, delivered 300+ hours of professional training, and gave 120+ international talks. She served as Principal Investigator for a 250,000€ funded research project, where she led the development of a digital app in close collaboration with the Faculty of Engineering, an experience that gave her deep insight into the intersection of technology and psychology. In 2025, she transitioned from academia to apply this scientific rigor to real-world challenges, helping individuals and organizations thrive through psychotherapy, business consulting, and high-level mentorship.
External links:
Website: https://teresalimpopsykhe.pt/en/
LinkedIn: teresa-limpo
PHP2Shell: Anatomy of a Shell Takeover by Milton Araújo
Abstract: What happens when a vulnerability turns a web application into an entry point for attackers?
In this technical session, we will dive into PHP2Shell (CVE-2026-109618), exploring the vulnerability, its underlying mechanisms, and the security implications for vulnerable PHP environments.
We will break down how the vulnerability works, examine the conditions required for successful exploitation, and explore how attackers could leverage it to compromise affected systems.
Moving beyond theory, the session will feature a live proof-of-concept demonstration, walking through the exploitation process in a controlled environment to illustrate the vulnerability's real-world impact.
Finally, we will discuss practical detection strategies, mitigation techniques, and defensive measures that security teams can implement to reduce their exposure.
No slides full of theory. Just technical insights, real exploitation, and lessons from an attacker's perspective.
Bio: Milton Araújo is a security researcher and offensive security specialist with deep expertise in penetration testing, evasion techniques, malware development, and reverse engineering. He leads advanced red team operations focused on bypassing modern defensive technologies such as EDRs, antivirus engines, and sandbox environments, developing custom payloads, in-memory loaders, and obfuscation techniques to simulate real-world threats. He is an active contributor to the OWASP community, a postgraduate-level cybersecurity instructor in malware development, exploit analysis and offensive security operations, and the creator and host of the "Hackers Behind the Code" podcast and conference.
External links:
Website: https://r19.io/
LinkedIn: milton-araujo