VXCON

We make our community and cybersecurity world better. Organiser of VXCON & VXCTF; Village organiser in DEFCON/HITB; CTF player since 2010

[VXCON @vxresearch]

VXCON 店長 17-and-7-month year old Baileys is now living at Rainbow 🌈 Bridge on last Sunday night after VXCON completion, with love, hugs, and winds.

Sadness and sorrow are still pumping but life must go on

VXCON community always supports animals charity, continue to make them happy with love.

After VXCON, I want to take further action to gather fund / donations to support animals charity including 阿棍屋，taking care of elderly dogs and cats. They need more care and love. Resources are needed.

If you provide donations (like minimum 500 HKD, share and give us receipts), we probably set up a member-only discord channel to share the hardcore and latest engineering, research and hacking techniques there.

I hope I can get at least 10 people to start the group. If yes, please leave comment or PM me.

Thank you very much to everyone, and Baileys is our life-long VX captain 店長, and I hope we can make our animals better.

[Iceman @herrmann1001]

$730k+ raised on Proxmark5 with 2150 backers

Thank you!

We're getting close to the $1M Transparent Casing stretch goal.
What would you like to see unlocked next?

[nedwill @NedWilliamson]

https://t.co/z9z5nH9N5y

Awesome work from Seunghyun and Prof. Brumley!

[NiNi @terrynini38514]

It’s me!

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Hyunwoo Kim (@v4bel) chained a use-after-free and uninitialized memory bug to escalate privileges on Red Hat Enterprise Linux for Workstations in the fourth round, earning $5,000 and 2 Master of Pwn points. #Pwn2Own #P2OBerlin

[Samuel Groß @5aelo]

@dyn___ @orange_8361 @thezdi I like to think https://t.co/mk2paOPGul and other efforts have something to do with it, but hard to tell :) https://t.co/lb1gzRwKUg has also been trending downwards lately but it’s a very sparse signal

[Samuel Groß @5aelo]

* Seems many exploits couldn't be demoed due to bad luck/last-minute fixes. Really sorry for the participants :( great research!
* No V8 (and Chrome?) submissions for the 2nd year in a row
* @orange_8361's chain sounds wild, very curious for details!
Thanks for #Pwn2Own @thezdi

[VXCON @vxresearch]

Congratulations 🥂 we are looking forward for your sharing soon.
@d3vc0r3

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦

[TrendAI Zero Day Initiative @thezdi]

That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin

[tylerni7 @tylerni7]

the commentary by @0x10n is also fantastic! a lot more color than just a number on a table https://t.co/hy2xUO0Hu6

[VXCON @vxresearch]

@orange_8361 @tylerni7 💪

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Dominic Alvieri @AlvieriD]

By popular demand

ShinyHunters active onion

/shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd[.]onion

Enjoy!

[DeadSpecimen @TeamTwiizers]

UPDATE: Canvas was taken off the ShinyHunters extortion page. Did Canvas pay?

[Dexerto @Dexerto]

Hacker group ShinyHunters hacked Canvas and held the website for ransom during finals week

They claim over 9,000 schools were affected and 275 million users' data was compromised

[vx-underground @vxunderground]

Students all across the world react to ShinyHunters

[VXCON @vxresearch]

@herrmann1001 💪

[Iceman @herrmann1001]

I'm writing this on a flight home from Sydney. Two weeks ago I was there for a live hacking event and somewhere over the ocean I caught my own reflection on the little screen in front of me. Sun-tanned. Smiling. Salt still in my hair from a boat ride on the harbour the day before.

And I thought: none of this would have happened without that little green proxmark board. I had no idea what I was signing up for back then. I thought I was buying a tool. What I actually bought was a passport.

A passport to DEF CON nights fuelled by Hacker Juice at 3 AM, where everything that could go wrong did, and we figured it out anyway usually with someone shoving a laptop at me saying "try this."
To CCC Camp fields with what I will defend to my dying breath as the world's best WiFi and network the kind of infrastructure that makes you tear up a little, surrounded by tents and people who get it.
To Balccon, where the rakija flows and a stubborn tag becomes a six-person philosophical debate.
To karaoke nights where hardened reverse engineers belt out power ballads off-key and somehow that becomes one of your favourite memories of the year.
To live hacking events on the other side of the planet Sydney being just the latest stop on a list I never could have predicted.

I bought a tool, and I got a life. I've laughed until my face hurt.

I've watched contributors I'd only known as GitHub handles walk up and shake my hand, and felt that small miracle of oh, you're real, and you're wonderful.
I've seen cities I never would have visited. Sat in airports I never would have been in. Made jokes in languages I don't speak with people I now can't imagine my life without.
The skills came along for the ride. Career doors opened. I learned things about RFID and low-level hardware I never imagined I'd know.

But honestly? That's not the part I think about when I look back.
The part I think about is the people.
The ones who became collaborators, then friends, then chosen family. The ones who pushed code at midnight because they wanted to see the project succeed as much as I did.
The ones who handed me rakija, sang harmony badly, and showed up to every event with a hug and a hardware bug report

One purchase. A decade. A community. A life I genuinely love.

If past-me sitting somewhere with a credit card and a half-formed curiosity knew what that little green proxmark board would lead to, he would have not doubt it.

🧊 Stay frosty. And thank you. All of you. You know who you are

[Asuka Nakajima | 中島明日香 @AsuNa_jp]

I arrived back in Japan from Singapore early this morning!

シンガポールから日本に帰ってきました！🛬BlackHatAsia後は休暇をとり、久々にゆっくりとした時間を過ごすことが出来ました☺️

[Iceman @herrmann1001]

Had a glorious time at DEFCON Singapore.

Loved hanging out with old and new members of the hacker family 🫶

Iceman has left the building

[VXCON @vxresearch]

@tylerni7 @5unKn0wn Greatest CTF guys 🫵🏻💪🫶🏻