hack.lu 2026 agenda is live!

We are happy to announce that the hack.lu 2026 agenda is now published!

The 20th edition of hack.lu will take place in Luxembourg from 20 to 23 October 2026, with four days of security research, practical experience, open-source tooling, workshops, trainings and, most importantly, opportunities to meet and exchange with the community.

As usual, the programme mixes deeply technical subjects with the broader societal, operational and human aspects of information security.

Opening keynote: The Panopticon Paradox

We are particularly pleased to open hack.lu 2026 on Tuesday, 20 October at 09:00 with Thomas Drake and his keynote:

The Panopticon Paradox: Cybersecurity in the Digital Age of AI-Accelerated Mass Surveillance

The keynote explores a very timely paradox: AI is accelerating both cyberattacks and cyber defence, while the monitoring technologies deployed to protect systems can themselves become part of an increasingly pervasive surveillance infrastructure.

Thomas Drake will discuss approaches to cybersecurity built around human-centric and privacy-preserving defence, correlated signals, adaptive architectures, zero trust for machines and computation over encrypted data.

The topic goes beyond purely technical security. It asks an important question for our community: how can we build effective cyber defences without undermining the human agency, privacy and freedoms those systems are ultimately supposed to protect?

This intersection between technology, security and society has always been an important part of the hack.lu spirit, and we believe it is a fitting way to open the 20th edition.

A packed four-day programme

The agenda covers a particularly broad range of topics this year. Some highlights include:

Vulnerability research, exploitation and reverse engineering, ranging from Linux kernel and Windows internals to Livewire RCE, firmware analysis, CAN bus reverse engineering, iOS exploitation and even cracking a 1983 Apple II hardware copy-protection system.
Cyber threat intelligence and incident response, with sessions around NetFlow and nfdump, MISP, Flowintel, RansomLook, Shadowserver telemetry, web forensics with Lookyloo and Lacus, and practical Microsoft 365 investigations.
AI and security, including applied transformer NLP for cyber threat intelligence, agentic engineering for security tooling, AI-assisted vulnerability hunting, and AI-agentic threat hunting with Suricata.
Detection engineering and defensive operations, with hands-on sessions covering Sigma, Suricata, malicious documents, supply-chain attacks, Qubes OS and operational detection workflows.
Hardware, mobile and embedded security, including voltage glitching, wireless medical devices, iOS Sysdiagnose analysis, satellite security and Windows kernel exploitation.
Surveillance, disclosure and the human side of security, with research into stalkerware, responsible vulnerability disclosure, social engineering and the operational pressures faced by incident-response teams.

And these are only a small selection of the talks and workshops scheduled during the four days.

Hands-on workshops

hack.lu has never been only about sitting in a conference room and watching presentations.

Alongside the main track, several rooms will host hands-on workshops and training sessions, covering subjects such as:

NetFlow analysis and network forensics;
reverse engineering with Ghidra-based tooling;
Microsoft 365 incident response;
transformer-based NLP for cybersecurity;
Sigma detection engineering;
ransomware intelligence collection;
Flowintel and MISP workflows;
voltage glitching;
Qubes OS;
web forensics;
Suricata and AI-assisted threat hunting;
CI/CD supply-chain attacks;
iOS analysis;
malicious document analysis;
Windows kernel exploitation;
MISP threat-intelligence workflows;
and many more.

There should be something for offensive researchers, defenders, incident responders, reverse engineers, threat-intelligence analysts, developers and people simply interested in understanding how technology affects society.

The programme reflects what we want hack.lu to remain: a place where researchers and practitioners can present new work, demonstrate failures as well as successes, release and discuss open-source tools, challenge established assumptions and exchange experiences with the community.

And, of course, the published agenda is only part of hack.lu. Lightning talks, hallway discussions, workshops and unexpected conversations are often where some of the most interesting exchanges happen.

So start planning your four days.

20–23 October 2026 — Luxembourg

See you at hack.lu 2026.

Break. Build. Share.