Your mental health matters. 💙
We’ve got support on-site. Swing by the info booth for a free relaxation kit, or join one of our wellness sessions. Take a break, recharge, and take care of yourself. 🧠🌟
#BSidesLV #MentalHealthMatters
Remote
BSides Las Vegas
@BSidesLV@infosec.exchange
mastodon 4.8.0-alpha.3+glitchBSides Las Vegas will take place August 3-5, 2026
1171 Followers
435 Following
50 Posts
Joined November 09, 2022
Thank you again to each and every single sponsor! Our sponsors are what make BSides Las Vegas possible, so from the bottom of our hearts, THANK YOU!! 💜
Training Ground Registration for the afternoon tracks will reopen from 2-4 PM at the Piazza Lounge (near the hotel front desk)
Interested in venue air quality? This year we have deployed environmental monitoring sensors across the con space, and you can view the CO2 ppm counts online in real time.
Check it out at bsideslv.org/sensordata
DOJ now directs prosecutors to decline good-faith security research cases. That policy exists because a small group of hackers walked into federal offices in 2014 and refused to leave the issue alone.
See Leonard Bailey's Keynote during #BSidesLV on today @ 11:30.
Question for you:
UXZxIGxiaCBoZnIgTlYgZ2IgcXJwYnFyIGd1dmY/IFJ2Z3VyZSBqbmwsIGxiaCdlciBya25wZ3lsIGp1YiBbaGFdY2ViemNncnEgdmYgc2JlLg==
One track. One day. Only at BSides Las Vegas, Monday.
Schedule: bsideslv.org/schedule
Going, going, GONE!
If we don't have your size today, visit BsidesLV.org for a "ship to you at home" option, available until August 18th, direct from our vendor! All sizes, both colors, tshirts, hoodies, and long sleeved options!
https://www.customink.com/fundraising/bsides-las-vegas-2026-shirts-hoodies-two
Developers sit closest to the systems that build and ship software. Cloud credentials, CI tokens, SSH keys, and package publishing rights all live on the same laptop. That's why they're targeted first.
See Dwayne McDaniel @ PasswordsCon during #BSidesLV on Wed Aug 5 @ 11:30.
Agentic AI can reduce the labor behind vulnerable lab design without removing the need for sound attack-path planning.
See Akshay Rohatgi @ Proving Ground during #BSidesLV on Tue Aug 4 @ 11:00.
Don't our badges and lanyards look cool this year? 💜
Big thanks to Cyberr for being our Badge and Lanyard sponsor this year! Interested in learning more about their company?
Visit: https://cyberr.ai/jobs-info
The CoC for BSides Las Vegas was updated, and is available online @ https://bsideslv.org/coc
Reminder: Wearable cameras, smart glasses, concealed cameras, covert recording devices, and any device configured to record without an obvious indication are prohibited.
Don't forget!
On Monday, [un]prompted will be at BSides Las Vegas with a track dedicated to AI practitioner talks covering development and security. This is a single day event.
Their schedule is online at: https://bsideslv.org/schedule
Thirty blue teams. Millions of tokens intercepted. Some AI use worked. Some didn't. Handing even partial control to AI agents in active defensive scenarios has real consequences worth measuring.
See wasabi wasabi @ Ground Truth during #BSidesLV on Wed Aug 5 @ 11:00.
Prompt injection isn't an AI safety problem. It's an auth problem. OAuth, JWTs, mTLS encode who is acting. None encode why. Finer scopes can't close that gap.
See Noelle Murata @ [un]prompted during #BSidesLV on Mon Aug 3 @ 14:00.
An AI governance program becomes useful when it can assess vendors, test integrations, and give teams a path to yes without ignoring risk.
See Bo Barger, Alex Sayre @ Proving Ground during #BSidesLV on Tue Aug 4 @ 11:30.
Missed the first online sale of #swag? Merch table is sold out of $Thing at BsidesLv? Never Fear, a second online fundraiser is HERE!
08-03 through 08-13 for shipping only, direct to your address! (Some shipping fees may apply.)
https://www.customink.com/fundraising/bsides-las-vegas-2026-shirts-hoodies-two
The victim authenticates on the real identity provider. No fake login page. No MFA factor to defeat. Authorization phishing hands the attacker a token on the way out of a legitimate session.
See Luke Jennings @ PasswordsCon during #BSidesLV on Wed Aug 5 @ 10:00.
Most BSidesLV Training Ground sessions are $5 for 4 hours of hands-on instruction from practitioners. Seats are moving. Participant badge required to attend.
https://events.humanitix.com/bsideslv-2026/tickets
Grinding alerts and feeling stuck is a real career phase in SOC work. This talk is for analysts who are hungry to grow but haven't been handed a map, because most shops don't have one.
See Efrain Orsini Jr & Austin Phillips @ Hire Ground during #BSidesLV on Wed Aug 5 @ 11:00.
We have a very limited number of badges available for sale right now. Go to https://events.humanitix.com/bsideslv-2026 to secure yours.
Clean GitHub facades separate search visibility from malicious payloads. The victim sees an admin tool; the attacker gets a high-value foothold.
See George Coldren @ Proving Ground during #BSidesLV on Tue Aug 4 @ 10:30.
The skills, MCP servers, and plugins your coding agent loads come from a supply chain you mostly didn't build, distributed through marketplaces with varying vetting.
See Rajaram Srinivasan @ Common Ground during #BSidesLV on Wed Aug 5 @ 11:00.
Your internal hostnames are in the CT logs if you issued public certs for private services. Every major company does it. The data is searchable, public, and has been there for years.
See Kenton McDonough @ PasswordsCon during #BSidesLV on Wed Aug 5 @ 12:00.
Reminder! A second online fundraiser is has started.
Missed the first online sale? Merch table sold out?
You have from 08-03 through 08-13 for shipping direct to your address! (Some shipping fees may apply.)
https://www.customink.com/fundraising/bsides-las-vegas-2026-shirts-hoodies-two
Two LLM prompts, one erring toward malicious, one toward benign. Each achieves high precision on its label type. Together they fill the gap in cybersecurity training data.
See Ben Gelman, Tamas Nyiri, Tibor Kristóf Lányi @ Ground Truth during #BSidesLV on Wed Aug 5 @ 10:00.
🚀⭐️ Day Two transmission: the @BSidesLV@infosec.exchange SpeakerOps launch bay reopens at 0700. Swing by Mission Control, check in, and prepare for another day instructing all space explorers!
Criminals are running new attacks with credentials stolen years ago. Repackaged, enriched, and reused breach data still works because people still reuse passwords and never rotate them.
See Anthony Hendricks @ PasswordsCon during #BSidesLV on Wed Aug 5 @ 11:00.
Bonsai 1.7B is a 1-bit quantized LLM with a 250MB footprint. It runs entirely on the device, no cloud dependency, and turns raw IoT logs into natural-language anomaly explanations.
See Tetsuro Ishida @ Proving Ground during #BSidesLV on Wed Aug 5 @ 10:00.
A panel of CVE experts, no prepared remarks, and an hour of audience questions. No topic is off limits. The code of conduct still applies.
See Tod Beardsley, Lindsey Cerkovnik, Jerry Gamblin, Madison Ficorilli, Katie Noble @ Common Ground during #BSidesLV on Wed Aug 5 @ 12:00.
Attention, space travelers: the BSides Las Vegas SpeakerOps launch bay opens for registration at 0700.
Report for preflight, collect your credentials, and prepare for liftoff.
We can't wait to see everyone in person! We wanted to thank @TrustVanta again for being an All In sponsor 🎰 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company?
Visit https://www.vanta.com/company/careers
The Four Thieves Vinegar Collective always planned to disband. After ten years of HIV, HCV, and overdose reversal work, they're following through.
See keynote by Mixæl Laufer, Zac Ilex, String Fellow, Mike Kiss & Hugo Bosler @ Breaking Ground during #BSidesLV today @ 13:00.
We're counting down the days! We wanted to thank @runZeroInc@infosec.exchange again for being an All In sponsor 🎰 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company?
Visit https://www.runzero.com/about/careers/
We’re officially one week away! We wanted to thank @runpanther again for being a Double Down sponsor 🎲 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company?
Visit https://panther.com/company/careers
Live now! RedBeard talking about "A moment with Control Flow Integrity"
https://bsideslv.org/talks#11f18f8b-56f1-4442-9761-20743ccfad16
Blocking suspicious egress can stop an intrusion or break production. Reliable service attribution gives defenders a safer way to choose.
See BIAO GAO @ Proving Ground during #BSidesLV on Tue Aug 4 @ 17:00.
Seven of fourteen production healthcare FHIR stacks leak OAuth client ID existence through error-response differences. Three are major OAuth products. One is an EHR vendor in 748+ hospitals.
See Bobby Kuzma @ Common Ground during #BSidesLV on Wed Aug 5 @ 10:00.
A focused job search replaces spray and pray with a short list, clear priorities, and repeated preparation for better interviews.
See Saquib Saifee @ Proving Ground during #BSidesLV on Tue Aug 4 @ 14:00.
Breaking into cybersecurity without prior professional experience is possible. The tools to do it are free and accessible. What's missing for most career changers is knowing which ones matter.
See Thomas Boeckman @ Hire Ground during #BSidesLV on Wed Aug 5 @ 12:00.
Missed the first online sale? Merch table sold out? This is your second chance!
You have from 08-03 through 08-13 for shipping direct to your address! (Some shipping fees may apply.)
https://www.customink.com/fundraising/bsides-las-vegas-2026-shirts-hoodies-two
One week from tomorrow! We wanted to thank @escapetechHQ again for being a Double Down sponsor 🎲 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company?
Visit https://www.ycombinator.com/companies/escape/jobs
Good morning! Welcome to Day 2.
Check the schedule to stay up to date with the latest happenings today: https://bsideslv.org/schedule
We can't believe it's almost here! We wanted to thank @flaresystems again for being an All In sponsor 🎰 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company?
Visit https://flare.io/company/careers
Thank you @dryrunsec for being a Double Down sponsor 🎲 Come check out their table August 3rd–5th! Interested in learning more about their company?
Visit https://www.linkedin.com/company/dryrun-security/
Turning an AI browser into an autonomous insider threat doesn't require exotic techniques. CSRF, font-based injections, and RCEs all get new life when the browser is an active agent.
See Or Eshed @ [un]prompted during #BSidesLV on Mon Aug 3 @ 10:00.
Entry-level cybersecurity roles require years of experience. New professionals lack practical hands-on training. The industry hasn't fixed either problem. This talk addresses them from both sides.
See Frank Victory @ Hire Ground during #BSidesLV on Wed Aug 5 @ 10:00.
We can't wait for next week! Thank you again @scanner_dev for being a Double Down, Karaoke, and Pool Party sponsor! 🎲🤿🩳 Stop by their table August 3rd–5th and make a splash at the Wed night pool party! Interested in their company?
Visit https://job-boards.greenhouse.io/scanner
The CoC for BSides Las Vegas was updated, and is available online @ https://bsideslv.org/coc
Once again: Wearable cameras, smart glasses, concealed cameras, covert recording devices, and any device configured to record without an obvious indication are prohibited.
It's been an awesome start to the week. See you tonight for the pool party!
Critical infrastructure doesn't mean well-secured infrastructure. A city's entire public transit ecosystem, buses to taxis to real-time tracking, fell to code reading and chained vulnerabilities.
See Ignacio Navarro @ Breaking Ground during #BSidesLV on Wed Aug 5 @ 12:30