SAS-2026: the world’s first cyberpunk hacker-squat in a five-star hotel!

Our annual conference for cybersecurity experts – the Security Analyst Summit (this year – SAS-2026) – has thundered its way to a close. It was fun, it was lively, and this time it came with a ground-breaking design:

Attendee registration:

As tradition dictates, day one was given over to the CTF competition for teams of cybersecurity experts, who had to complete some real tricky specially designed tasks – both hacking ones (find, crack, break in, and discover what’s hidden inside), and the reverse: defending against an enemy attack.

It was a big event: several… thousand teams took part in the two qualifying rounds for the final. Making it through to the SAS CTF-2026 final were 14 teams – from China, Colombia, Italy, Japan, Kazakhstan, South Korea, Russia, Singapore, and the United Arab Emirates.

The competition lasted eight hours, and the participants were given six complex services to find vulnerabilities in. Since it’s already become an established tradition for everyone to use AI on challenges like these, this year we decided to do some experimenting. For example, one task was set in an isolated environment with no internet and no artificial intelligence: one player from each team had to find the vulnerabilities, fix them, and attack the other teams using nothing but their own knowledge. Incidentally, this service turned out to be every team’s favorite.

First place in the competition went to BunkyoWesterns from Japan (how about that!), who were with us for the third time. Second place went to PwnSec from the UAE, and third – to the Russian team CUT from Central University in Moscow.

The upshot: the participants managed to exploit all six services – but even with AI they couldn’t find all the vulnerabilities planted in them. Anyway, I seem to be rambling on and getting bogged down in the details – it’s high time we got to the conference!…

SAS-2026 drew 180 folks from 26 countries. As per another tradition, let’s take a moment to marvel at our flight champions. So, this time the longest (non-direct) flight belonged to both a speaker from Córdoba, Argentina, and a CTF participant from Santiago de Chile, who each spent a whopping 36 hours getting here! The shortest flight (just one hour) was made by a guest from the Indonesian city of Surabaya.

And we’re off!…

As our event organizers tell it – and I quote: “This year, the Security… Anarchist Summit took over a marble-heavy five-star hotel in Bali, and turned it into… a punk hacker squat.” Well, I saw it, felt it, and can confirm it!

But it was time to get the conference underway:

This time the organizers and designers really outdid themselves, building a full three-story installation on the stage. And once again it was me they let loose onto it to open the proceedings :)

Some of the talk titles were a little on the scary side:

Zero Days to Chaos
Every Ride you Take: Hacking a City’s Public Transportation
Into the Dark: the Anatomy of an In-the-Wild iOS Kernel Exploit

In all, the two days of the conference featured no fewer than 20 talks. The ones that made the biggest splash have already been published online: The journey of a paper unicorn: adventures inside a modern warehouse (hacking a warehouse via… a barcode scanner, and more), Operation FlashHole: Lazarus breaks security, defies control (new exploits from some old hackers), and How APT41 revived the BlackLotus bootkit (bootkits haven’t gone anywhere!).

And the traditional shots (and I don’t mean photos) at the end of every talk :)

And all of us together:

In closing, I’d like to remind you that one of my core principles is “work hard, play hard”, or – my own adaptation: “business and fun – shaken (hard!) and not simply stirred!”

So, I’ve briefly covered the working hard/business side of SAS-2026. What about the playing/shaking hard? Simple: every evening, we played/shaked (= partied) hard! We did it in different places and with slightly different activities – but we did it every single evening.

There was also the awards ceremony for the various winners of best this, that, and the other; and let’s not forget the conference sponsors: familiar old faces – thank you!

After that came dances by locals, drinks and snacks, all kinds of entertainment, and various other [legal] stuff – and we were simply on fire (as were some of the performances!)…