CppCon 2026

There is no classical treatise on the design and implementation build systems; no faithful textbook every toolchain engineer has on their bookshelf. If there were we would need to throw it out anyway, because C++20 modules required a significant rethink of how build systems orchestrate compilation of C++ software.

It's been said over and over again that C++20 modules complicate the classic compile and link steps for C++. However, few have dived into how exactly build systems are dealing with this step-change in complexity. Talks will demo a few raw compiler invocations and say no more about the subject. This leaves engineers unequipped to deal with problems that arise in their builds; frustrated by opaque error messages and baffling build logs.

In this talk, we're going to fill in the rest of the blanks and explore exactly how build systems are tackling modules.

Many codebases contain several spots of type punning, and unfortunately a whole lot of those are incorrect and undefined behavior. While many current versions of compilers seem to do the correct thing, they might no longer do that tomorrow. Safety considerations wants to reduce/eliminate UB.

It might be worthwhile to inspect your reinterpret_cast constructs, most probably they are wrong. In this talk we will inspect what is wrong about those, we will learn about alignment, strict aliasing, object lifetime. 3 areas which might flag a red card on our type punning constructions.

Luckily the language evolved and gave us more tools to do it correctly, things like memcpy, memmove, bit cast, start lifetime_as, launder. It does however remain a dark corner and a dangerous territory to wander in. Because let's face it, zero copy is something we love in C++, and those bytes that came from the network, really are an array of integers, array of coordinates, ... Compiler, trust me, I know what I am doing. Am I?

Much of the public criticism of C++ safety comes from vulnerabilities rooted in C patterns: raw pointer arithmetic, unchecked buffer indices, manual memory management. Modern C++ offers real answers to those problems through RAII, smart pointers, containers, and type-safe abstractions. But C++ also has its own distinct safety issues that have nothing to do with its heritage. Temporary lifetime rules that silently create dangling references. Iterator invalidation semantics that differ across containers in ways even experienced developers get wrong. Smart pointer ownership pitfalls that RAII cannot prevent. Coroutine frames that outlive their captured locals. Implicit conversions that turn a safe string into a dangling view between one line and the next. These are purely C++ problems. They compile cleanly, look correct in code review, and ship to production.

A survey of public CVE reports and security-fix commits across prominent open-source C++ projects shows the same patterns recurring again and again. This talk walks through those patterns, in code that looks correct in review, compiles cleanly, and then breaks at runtime. The session is aimed at intermediate-to-experienced C++ developers who already know modern C++ but want a working catalog of the subtle patterns that ship past typical code review.

Recognizing these patterns has long been the domain of library authors and security researchers. This talk distills a catalog from real-world fixes for everyone else: not a prescriptive standard like the Core Guidelines, but a pattern-recognition toolkit any C++ developer can apply in their next code review. The session also makes the case for expanding the community-level safety conversation to give these C++-unique patterns the same attention as the C-heritage debates.

Every software engineer needs to understand the fundamentals of how your computer works. My mantra for teaching computer systems is 'no more magic', and in this talk I'll do my best to dispel what feels like 'magic' in our hardware in a single hour. In this talk, we will investigate '3' pictures of the 'the compilation process', 'program stack', and a 'cpu' to understand how these components work together to ultimately compile and execute code. An emphasis during this talk will focus on the 'CPU' and the hardware components (e.g. registers, cache memory, main memory, page table) interact with the operating system to efficiently execute a program. Hardware will be presented side-by-side with code so we can understand what happens in the hardware as software executes. Attendees will leave this talk with a better mental model of how their hardware works, and the implications their software design choices have on performance.