(I actually managed to watch basically the same talk at a different event on the site pgp.fail, whoops)

For me, I feel like the mistake mentioned was the most dead obvious one. Prefixing a plugin name from the file with a path then literally running the executable named. At the end of the talk, an age dev bought the researchers with stickers on camera.