Posted by    on   Sep 16, 2026

The Péter Szőr Award celebrates the life and works of security researcher Péter Szőr by recognizing, each year, an outstanding piece of technical security research.  

The award aims to recognize a piece of work that demonstrates the kind of rigorous, in-depth research that Péter became known for. Nominations for the award are sought from the security community at large.

The standard of this year's nominations was particularly high, making the job of the selection committee – whose task is to vote for a winner – extremely difficult.

The nominations were, in the end, narrowed down to a shortlist of three:

• Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode
  by Aleksandra "hasherezade" Doniec (Check Point Research)
• BPFdoor in Telecom Networks: Sleeper Cells in the Backbone
  by Rapid7 Labs (Edoardo Giuggioloni, Christiaan Beek and Jindrich Karasek)
• VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun
  by Check Point Research

The following gives a little more detail about each of the finalists and why they were nominated by members of the community: 

Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode by Aleksandra "hasherezade" Doniec (Check Point Research)

Why this research was nominated:

"This research tackles a problem that most analysts would simply give up on. JSCeal doesn't just obfuscate its JavaScript, it compiles it into V8 bytecode and ships it as cached data, stripping away nearly everything that source oriented tooling depends on. Rather than treat this as a dead end, hasherezade built a fully static deobfuscation pipeline from the ground up, extending an existing open source decompiler and writing dedicated passes for value propagation, string reconstruction, control flow unflattening, and proxy resolution, all without ever executing the malware.

"What sets this apart is that the outcome isn't just a one time analysis of a single sample. It's a reusable, publicly released toolkit that lets any researcher recover readable structure from this class of compiled bytecode malware going forward.

 BPFdoor in Telecom Networks: Sleeper Cells in the Backbone by Rapid7 Labs (in particular Edoardo Giuggioloni, Christiaan Beek and Jindrich Karasek)

Why this research was nominated:

"This research combined deep technical research with direct, real-world impact.

VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun by Check Point Research

Why this research was nominated:

"This research is the first documented case that gives real evidence, not speculation, that a fully capable malware framework can be built almost entirely by AI. The team traced operational security failures by the malware's own developer back to the AI generated planning artifacts themselves, uncovering a Spec Driven Development process where the model was first tasked with producing a full multi team development plan, sprint schedules and all, before it ever wrote a line of code. That plan was then followed to build a working implant with eBPF and LKM rootkit capabilities in under a week.

"This matters because it's not just a trend piece about AI and security. The team reconstructed the entire development timeline from leaked artifacts and cross checked it against the malware's technical capabilities, eBPF hooks, cloud enumeration modules, container escape logic, to prove the AI generated code held up to real scrutiny rather than just looking plausible, giving the industry its first hard evidence of a shift that people have been predicting for years without proof."

VB congratulates all the finalists, both for their nominations and for the outstanding research they have contributed to the field. The winner will be announced at the VB2026 gala dinner on 15 October in Seville.