Here is a little project badge I created called the Ouroboros Badge. Its a pure RISC-V Assembler project on a CH32V003 chip with a custom UART game. See you all at Summer Camp!

YouTube VIDEO of Badge

Get them.

Your feet are going to hurt.

All those goons with their knee high programmer socks on are actually wearing compression socks.

Hi everyone!

I am the founder of Hack Smarter - which many people use for OSCP prep (we are featured on LainKusanagi's list, he has actually created a few of the labs on our platform!)

Anyways, I am making all of our labs completely free for Defcon weekend (Thursday - Sunday). We have labs covering Active Directory, Windows, Linux, Web, AWS, and more.

No strings attached... no payment info needed... just one of the many ways we are trying to make hacking accessible for as many people as possible.

Mark your calendar and get registered at https://defcon.hacksmarter.org

--

(Also, we have a bunch of people attending Defcon and multiple informal meet-ups happening all weekend. Link to our Discord is on our website... if you are attending for the first time and looking for a group of people to hang out with, join our Discord and add the defcon-2026 role to yourself!)

Last year taking the hyperloop within the convention center was free. Does anyone know if we can take the hyperloop to and from Resort World to the convention center for free this year?

DEF CON 34 Spotlight:

Ham-In-A-Day Course

Always been interested in getting your ham license but never had the time to study? Now's your chance! The Ham Radio Village is offering a one-day class where you can learn all the required knowledge to pass the exam.

Learn more/register at hamvillage.org

Hey again, you magnificent nerds!

We're getting down to the wire for DEFCON, and the hype is officially overflowing. Last week we gave you a little tease, but today we're dropping the main event...

BADGE SALES ARE OFFICIALLY LIVE!

VERY IMPORTANT STEP BEFORE YOU BUY: PLEASE LOG INTO YOUR CTF ACCOUNT FIRST! Once you're signed in and go to the checkout page, the site will automatically check your score and tell you if you qualified for a FREE BADGE!

If it says you qualified: Boom! Claim your free badge and celebrate!
If it says you didn't qualify: Sorry! But don't worry--you can still purchase one right there on the page. Quantities are super limited (we're just trying to cover costs and keep doing this cool stuff), so grab one before they're gone!

You can head over to https://ctf.puzzledhackers.org/badge right now to grab yours!

A Quick Note on the Weekly Puzzles (#9 & #10)

For all you puzzle enthusiasts: The giveaway leaderboard is officially LOCKED based on Puzzles #1 through #8. We've tallied up all your entries from those first 8 challenges for the free badge calculations.

So what about Puzzles #9 and #10? They're mostly for fun and bragging rights. However, we're going to try to come up with something special for the folks who tackle them! No promises on what that might be, but keep solving and test your brains. Either way, your main badge giveaway standing from 1-8 is locked in!

Meetup Quick Recap (In case you missed the last post!)

Whether you bought a badge, earned a free one, or just want to hang out with a bunch of awesome hackers, everyone is welcome! You don't need a badge to come hang out with us.

• WHEN: Wednesday (8/5) & Thursday (8/6) starting at 7:00 PM.
• WHERE: The Linq - 3535 Bar (aka The Circle Bar)
• COST: $0.00. Free. Nada. Just bring yourself!
• WHAT TO EXPECT: Good vibes, sticker swaps, special guests dropping off random swag, Laser Tag battles, and catching up with old and new friends before Summer Camp officially starts.

A Massive Thank You to Everyone!

Seriously, we want to give a huge thank you to every single one of you for your time, patience, and understanding as we navigate all of this. We're learning as we go on how to handle the growth and keep this smooth, but our ultimate goal is to make this something sustainable that we can bring back to DEF CON for many years to come.

You all make this community amazing, and we genuinely couldn't do it without your support!

If you have any questions, drop a comment below or reach out to us directly!

We can't wait to see you all at The Linq in just a couple of weeks!

Sincerely,

The Puzzled Hackers Team

u/digitard, u/Killroy7777, and u/MetaN3rd

forgot to add the actual ticket to my cart and just added classes a week ago 🤦

happy to pay if anyone has a extra, really appreciate it!!!

got it figured out thank you to the real human who had a extra 🙏🙏

Wiring the Harness: Orchestrating Frontier Models for Vulnerability Hunting at Scale

Tony Martin, Sr. Principal Engineer & Offensive Security Research lead, INT31 Security Research, Intel

Arie Haenel, Principal Engineer & Offensive Security Research lead, INT31 Security Research, Intel

Friday, 14:30 - 15:30, Creator Stage 4

While frontier models are powerful, simply asking one to "find vulnerabilities" is far less effective than pairing with a well-designed harness, a gap that widens further down the stack and peaks at embedded firmware. During Project Glasswing, Intel scanned hundreds of repositories, from firmware to containers. This talk covers common pitfalls in LLM vulnerability hunting and presents a multi-stage harness: reconnaissance and context compression, multi-model hunting, deduplication, false positive detection, and verification. We will explore selecting the right models per stage, cutting token costs, and, the real battle, reducing false positives, especially for lower-level code where accuracy is hardest.

Tony Martin is a Sr. Principal Engineer in Intel’s INT31 Security Research team, where he focuses on emerging threats, software architecture and AI security. He has discovered thirty CVEs and one CWE and is senior staff at DEF CON’s Packet Hacking Village.

Arie Haenel is a Principal Engineer at Intel, where he leads ASSERT, an Offensive Security Research team. He has over 25 years of professional experience, in security research and security product development on a vast number of embedded platforms, at Intel, Cisco and NDS. In his spare time, Arie teaches security engineering as an Adjunct Lecturer at the Lev Academic Center.

PhantomShell: As If Firewalls Didn't Exist

Khael Kugler, Lead Offensive Security Engineer, Praetorian Security, Inc.

Saturday, 13:00 - 14:00, Creator Stage 6

PhantomShell is a Linux command & control implant that sniffs traffic of active TCP services to create a bidirectional C2 channel through any open port, using only stateful inbound traffic. It captures packets at the link layer, allowing it to read packets destined for legitimate services. Responses are constructed as raw TCP frames with sequence numbers derived from the original connection, making them difficult to distinguish from the service's own replies. This effectively turns every open service port into a bind shell, making the implant effectively impossible to firewall so long as any service remains externally accessible.

Khael Kugler is a Lead Security Engineer at Praetorian, where he primarily executes on red team and IoT engagements. Khael also volunteers as a red teamer for multiple CCDC regions, primarily focusing on linux persistence for SECCDC and WRCCDC (if you're interested in helping, reach out!).

There's A Bug in My Boot! Finding Vulnerabilities in U-Boot

Jared Stroud, Lead Reverse Engineer, The Johns Hopkins University Applied Physics Lab

Saturday, 15:00 - 16:00, Creator Stage 6

Bootloaders underpin the security of modern embedded systems. Their privileged position in the tech stack often means a vulnerability early in the boot process can result in total system compromise. Despite this, they frequently lack modern software security protections (ASLR, CFI, Stack Canaries), making them an easier target to exploit. This talk will explore hardware-in-the-loop, emulation, and native binary fuzzing approaches with U-Boot, a popular embedded system bootloader for networking devices, and the challenges each approach presents.

Jared Stroud is a Lead Reverse Engineer at The Johns Hopkins University Applied Physics Lab. Currently he's pursuing a Doctorate of Engineering focused on scaling vulnerability identification and remediation in embedded systems. For the past 7 years Jared has documented independent security research at Arch Cloud Labs (https://www.archcloudlabs.com/projects), and has presented workshops on reverse engineering topics at DEF CON, Shmoocon, and BSides Rochester.

Why Couldn't I See My Own Drone? Remote ID, ESP32s, and the Packet Trail to Friend or Foe

Will Hatzer, Founder, GameChangersAI / Team Charity Case

Charles Grow, Hardware Designer / RF Researcher, Team Charity Case / GameChangersAI

Saturday, 16:00 - 17:00, Creator Stage 6

Friend or Foe started when adding Remote ID support to an Android airspace app still failed to detect our own DJI drone. This led us into DJI Wi-Fi Beacon behavior, vendor information elements, ESP32 promiscuous capture, and conservative evidence handling using Bayesian fusion. This talk covers practical packet analysis techniques for Remote ID (BLE and Wi-Fi), hardware tradeoffs for reliable scanning, and how to avoid turning weak signals into overconfident alerts. Attendees will learn how to build honest, low-cost RF sensors and interpret packet evidence responsibly.

Will "OGThorne" Hatzer is a security engineer, adversarial researcher, and founder of GameChangersAI. He works in security engineering at OpenAI and builds open-source tools across RF, Android, embedded systems, and defensive security. A former DEF CON Car Hacking Village speaker, his work includes a bot-detection patent and Hyundai BlueLink research later referenced by CISA.

Charles "OhYou_" Grow is a hardware designer, RF researcher, and ham radio operator. He designed the Friend or Foe badge hardware, solving component layout, USB-C access, GPIO conflicts, and RF ground-plane challenges. His background in fox hunting, electronics, and field debugging helped turn early prototypes into a practical, wearable device.

Ghost Followers: Using AI to Unmask Fake LinkedIn Profiles at Scale

Aiswarya Venkitesh, Principal Cloud Solution Architect, Microsoft

Saturday, 17:00 - 18:00, Creator Stage 6

LinkedIn hosts over 1 billion profiles and a growing number are fake. From AI-generated profile photos to synthetic work histories, adversaries use fake identities for spear-phishing, social engineering, and influence operations. This talk breaks down the anatomy of a fake LinkedIn profile and demonstrates an AI-powered detection framework using behavioral signals, image forensics, and network graph analysis. Attendees will leave with a hands-on methodology and open-source toolset to identify synthetic identities before they become insider threats. Prior knowledge of networking fundamentals is helpful; no machine learning background is required.

Aiswarya Venkitesh is a Principal Cloud Solution Architect at Microsoft Canada with 13+ years in Data & AI, specializing in agentic AI architecture, multi-agent orchestration, and enterprise Azure deployments. Ranked #4 globally in IT & Tech by Favikon with 55,000+ LinkedIn followers, she studies identity authenticity and influence operations on professional networks as both a practitioner and creator. She is a confirmed keynote speaker at Futura AI Conference 2026 and author of the forthcoming book The Agentic AI Playbook.

Friendly reminder, Training Edition

There are still slots available for DEF CON Training in Vegas next month. There are 30+ classes to choose from, and there are 1, 2 and 4 day options available.
Full details at training.defcon.org.

You deserve a skill upgrade. Treat yourself.

#defcon #defcontraining #defcon34

This trip will be a first of many. First convention and first drive to Vegas solo. Pray to have a good time, meet new people, eat some good food, and make it back home to my family safe.

Hello world. DC710 will be in town all week at Blackhat, BSidesLV, and Defcon! As always, we’ll be handing out a majority of coins for free through random drops, barters/trades, via our CTF (new), and randomly to people we meet. This year we’ll also be selling a few coins to offset our costs — Keep an eye on our socials for our location throughout the week. All sale drops will be outside the conference (circle bar?)

Does anyone know if there’s going to be another Punk Rock Museum meetup this year?

I heard about it last year days late, I definitely would have gone and I’m trying not to miss it again. Does anyone know if its happening again and any details?

Hey everyone, any survival/strat to navigating the conference?

It’ll be my first DefCon, totally have zero expectations

Background: Pentester/Consultant currently. About to be two years in- holder of cwes/cpts, bscp, pentest+

Going with my mentor who is also a director in pentesting.

Hey all! I wanted to amplify my friend's #badgelife indie badge he's releasing at Defcon 34. It's a fully playable top down adventure game filled with puzzles, CTFs, and even Multiplayer supporting up to 50 people!

First time to def con.

Managed to sign up for 2 workshops. One friday, one sunday. Which seems impossible.

Most excited for the friday workshop, unfortunately just learned about octopus game, which seems like a great way to learn the con and meet people-- But the start of octopus game is right in the middle of the first workshop on friday. And if you miss the start, forfeit your spot.

Seems like i could maybe have time to leave the workshop and go to the registration and come back, but i have no idea how far they are from each other, i could lose valuable time/information from the workshop and just generally seems like trying to do too much.

Should i stick with the workshop? Go for the octopus game?

Somehow try and do both? (Least likely option)

I'm so excited for everything, and there's just so much.

Let's split up, gang! We've got a real spooky mystery on our hands this week, and we're going to need a lot more than a box of Scooby Snacks to solve it.

Mystery Inc. recently rolled up to a seemingly abandoned web server, but Velma's triage notes show some seriously eerie activity. It looks like a phantom visitor slipped right through the front door, triggered a hidden mechanism, and walked away with a secret package--all while leaving the rest of us staring at a completely normal, boring wall. The creature left a trail of glowing electronic footprints scattered across the system logs, but they're completely jumbled up. We need you to jump into the Mystery Machine, pull out your magnifying glass, and reconstruct exactly how that phantom pulled off the heist before they get away with it for good!

Help us solve this mystery: https://puzzledhackers.org/challenges/2026/08

If you want to keep track of your completions and be considered for part of our giveaways at the r/DEFCON subreddit meetup, please head over to https://ctf.puzzledhackers.org/ and select "Phantom Headers".

Badge sales will go live early next week. Those of you that are eligible for a free badge will have the ability to redeem it before checkout. Our goal isn't to make money, we just want to recoup what we invest to make these events fun. Thank you to everyone that decides to throw a little money our way to make all of this happen.

As always, if you run into any issues or have questions, reach out to me or u/digitard and we'll happily assist.

Don't forget that we're holding the subreddit meetups on Wednesday 8/5 and Thursday 8/6 starting at 7:00 pm. We hope to see you all there!

The Puzzled Hackers Team (u/Killroy7777, u/digitard, and u/MetaN3rd)

Stats:

• Puzzle #1: 227
• Puzzle #2: 158
• Puzzle #3: 109
• Puzzle #4: 92
• Puzzle #5: 88
• Puzzle #6: 78
• Puzzle #7: 68
• Scooby Snacks Eaten: over 9000
• Rate limit triggers: 117

Will be flying in Wednesday around Noon and would love to attend the Defcon Shoot, however I will not have a vehicle and Uber looks insane. Any Carpool at all that anyone knows of where I can pay for the person who is driving registration fee? https://dcshoot.org/

I am traveling all the way from Denmark and want to get “root” tattooed, so wanted to hear if anyone got a recommendation for an artist or place to get it? As I expect Vegas to have a lot of touristy traps 😆

Or even cooler is there some at defcon? 👀

I have some DJ gear available for use for anyones village/party if anyone is interested.

Gear: Pioneer DJ XDJ-XZ (With ancillary CDJ 2000 Nexus 2 or turntables if you want 4 deck setup), Traktor S4 MK3, Traktor S4 MK2, Traktor Kontrol Z2 (Mixer is compatible with Serato too, can be paired with with turntables or CDJs), various Powered Speakers (RCF, Mackie, JBL), Technics Turntables and Phase Essential Wireless DVS Controller available to use during the week for Def Con or BsidesLV.

Also, if anyone is looking for anyone to do visuals for their party/event, I can perform visuals with Resolume Arena and ancillary computer programs to run shaders and such and have ultra short throw projectors.

So there's definitely a huge sticker culture at DefCon. I've seen tons of stickers over the years and some are definitely personal art while others are AI, or maybe a combination of both. What are your thoughts and feelings on stickers that have artwork generated by AI? I'm not talking about selling AI art stickers as your own either-- I'm purelly talking about making fun stickers to trade with others during the con for entertainment. Yay, nay, and why?

(Also clearly not talking about stickers for the sticker contest which is strictly no AI art and I fully support!)

Edited to add: Thanks for all the feedback! I appreciate all of them on both sides. I just want to give back to the community in any way that I can. Some of the stickers I have are original, commissioned art, some are going to be the best art I can come up with, and a couple will be some AI generated help. I appreciate everyone's point of view!