NatJack hijacks TCP sessions and spoofs DNS by manipulating NAT tables — Black Hat 2026 exposes a universal design flaw

On **August 6, 2026**, researcher **Malcolm Stagg** presented **NatJack** at **Black Hat USA** — a new attack class that manipulates NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Windows, Linux, and consumer routers are all vulnerable — because the flaw is in the concept of NAT itself, not any one implementation.