A look back at the 2025 edition—we can't wait for 2026!

Using ADCS to Attack HTTPS-Enabled WSUS Clients: @cookieTheft and I have extended the research by @Coontzy1 on WSUS attacks and explored how to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients. 1/2🧵

Thank you for being part of our amazing community. Let’s make 2026 unforgettable—starting with THCON 2026!

As 2025 ends, we wish you a New Year full of success, inspiration, and adventure. If you are looking for new year resolutions (other than 1920x1080) what about submitting a paper to the THCon Call For Papers ? https://t.co/K3pKOpRF6W

🎄✨ The THCon team wishes you a Merry Christmas! May it be filled with joy, warmth, and precious moments with your loved ones ✨🎄

🤝 𝗧𝗛𝗖𝗼𝗻 𝟮𝟬𝟮𝟲 𝗦𝗽𝗼𝗻𝘀𝗼𝗿𝘀𝗵𝗶𝗽𝘀 𝗮𝗿𝗲 𝗼𝗽𝗲𝗻! Support one of the region’s biggest indie cybersecurity events, reach a highly technical audience, and showcase your products/services. Perks: visibility, booth options & more. 📧 sponsoring@orga.thcon.fr

🎤 𝗧𝗛𝗖𝗼𝗻 𝟮𝟬𝟮𝟲 – 𝗖𝗙𝗣 𝗥𝗲𝗺𝗶𝗻𝗱𝗲𝗿 CFP is open! Now’s a great time to submit your talk. Looking for: vuln research, RE/malware, crypto, cloud & supply-chain sec, IR/forensics, tooling + more. 🎫 Accepted talks = free THCon 2026 ticket 👉 https://t.co/vYaflVDCkb

Last week’s answer is Romain Cayre → check:  https://t.co/RJhpU5vBnr Next: What is QBDI? 1️⃣ A packet-sniffing toolkit for Wi-Fi 2️⃣ A kernel module rootkit framework 3️⃣ A dynamic binary instrumentation (DBI) framework built on LLVM 4️⃣ A binary patching plugin for Ghidra

🎟️ 𝗧𝗛𝗖𝗼𝗻 𝟮𝟬𝟮𝟲 𝘁𝗶𝗰𝗸𝗲𝘁𝘀 𝗮𝗿𝗲 𝗟𝗜𝗩𝗘! Early Bird tickets are now available, and cheaper than regular ones 🔥 Grab yours before they’re gone! 👉 https://t.co/8doKmgDAIF

Answer to last question is: 1 TB of data → check: https://t.co/BekFuvreZF Next: « What caused the Ariane 501 crash? » 1️⃣ Fuel tank rupture 2️⃣ Collision with space debris 3️⃣ Software error caused by a data overflow 4️⃣ Failure of ground communication systems

Here is a picture of the 2023 team💪.

Then starting 2022 the THCon moved to a bigger venue, welcomed sponsors, added proper lunch breaks and became a full 2-day festival of hacking! 🚀 The CTF now starts at 10AM on the Saturday, but for the night owls' pleasure, the online version lasts 24 hours.

THCon History 2/2 For years, THCon was as follows : The Friday was for talks, then participants jumped straight into an all-night CTF until Saturday morning ☕💻. Zero sleep, full hacking.

Last question was: “What is the year of the oldest THCon talk recorded?” Answer is 2018 → check: https://t.co/ABvlAHFJCi Next: How much data did Mathias Payer's script (that "was supposed to download a few apps on the Play Store") download? 1️⃣ 10GB 2️⃣ 100GB 3️⃣ 1TB 4️⃣ 10TB

Ready for THCon 2026 ? In the meantime, you can (re)watch some highlights of the previous years. This is a short extract from "The Bugs I've Found, The Bugs I Have Yet To Find" presented in 2025 by Mike Ryan 👉 https://t.co/6f7Ag9DOdW

THCON Quiz! Last question was: “What does MFA stand for?” The answer is Multi-Factor Authentication → check:  https://t.co/QckarcFRtb. Time for a new one (a little late sorry)! 👉 What is the year of the oldest official video of a THCon talk? 1️⃣ 2016 2️⃣ 2017 3️⃣ 2018 4️⃣ 2019

And boom: 300 people showed up to the very first edition! 🤯 From that totally DIY student adventure grew the biggest free cyber conference in town. The first THCON program😉

THCon History 1/2 Did you know THCon started back in 2015 as a wild idea from TLS-SEC students ? A bunch of passionate geeks decided Toulouse needed its own cybersecurity party — no program committee, no CFP, just friends inviting speakers to the B00 amphitheater at ENSEEIHT.

This is just a quick overview, please read the full CFP if you are interested in submitting. We accept original work that has never been submitted elsewhere, but we also welcome replays of papers previously presented at international conferences.

- "Industry papers" : Focused on practical research. Most of the authors must be affiliated with the industry. A more "𝗕𝗹𝗼𝗴 𝗣𝗼𝘀𝘁" 𝗳𝗼𝗿𝗺𝗮𝘁 𝗶𝘀 𝗮𝗰𝗰𝗲𝗽𝘁𝗲𝗱 for submission. - "Student Papers" : If you are a student, you can submit student research work.

This year, the Call for Papers has been divided into three categories : - "Regular papers" : Like previous years, academic papers focused on research