OSS + ELC EU 2026

Modern drone operations have moved from one pilot, one aircraft to multi-agent autonomous fleets. Dozens and even hundreds of vehicles now fly missions while only a handful of operators supervise from the ground. More drones, fewer ground stations, and the station is where all the value is, the operator, the mission data, a full-blown OS, and even access to other drones.

For years, drone security researchers have focused on attacking the vehicle. I flip the target and show how a single infected drone becomes a beachhead, reaching up the command chain to own the very station meant to control it, and the fleet.

This research audited six popular independent ground-control and middleware projects across the MAVLink ecosystem, Mission Planner, QGroundControl, MAVSDK, MAVProxy, MAVROS, and DroneKit and found the same broken trust boundary in all of them. The result is 14 findings rooted in one systemic flaw, including two novel full remote code execution chains against the operator's own machine.