In late October 2026, hack.lu celebrated its 20th edition in Luxembourg, and Tim Philipp Schäfers from our team was there, not only as an attendee but also as a speaker. hack.lu has been a fixed point in the European security calendar for two decades: a conference where deep technical research, open discussion and the spirit of the hacker community come together. In this post we share our impressions of the venue, the keynote, Tim’s own talk and why we will definitely be back.
A great venue in a beautiful country
This year’s hack.lu took place at the Alvisse Parc Hotel, 120 Route d’Echternach, 1453 Luxembourg. The location was really great: the service was attentive and friendly, the rooms were comfortable, and the whole setting made it easy to focus on talks during the day and on conversations with the community in the evening.
Luxembourg itself is a beautiful country, and its capital is a genuinely nice city to explore. Green valleys, historic fortifications and a compact, walkable old town make it a perfect backdrop for a conference that is all about community and exchange.
Luxembourg Impressions
Venue
Alvisse Parc Hotel with excellent service, comfortable rooms and plenty of space for talks and networking.
Country
Luxembourg combines beautiful nature with a charming, easily accessible capital.
Anniversary
The 20th edition of hack.lu gave the whole event a special, celebratory atmosphere.
Keynote: Thomas Drake on the Panopticon Paradox
The conference opened with a keynote by Thomas Drake titled “The Panopticon Paradox: Cybersecurity in the Digital Age of AI-Accelerated Mass Surveillance”. Drake reminded the audience of the central values of hacker culture: curiosity, openness, responsibility and a critical view of power and control.
Keynote from Thomas Drake
His talk stood out visually as well. Instead of dense technical slides, he used pictures from nature to illustrate his thoughts and draw parallels between natural systems and the digital systems we build. His core message: implemented systems should always help humans, not the other way around. In an age in which AI makes mass surveillance cheaper and more efficient than ever, this is a reminder our industry needs.
Watch the keynote: The Panopticon Paradox: Cybersecurity in the Digital Age of AI-Accelerated Mass Surveillance (YouTube)
Our talk: When Responsible Disclosure Becomes a Criminal Investigation
Tim gave a talk titled “When Responsible Disclosure Becomes a Criminal Investigation: Uncovering CVE-2025-43928 in Law Enforcement Surveillance Systems”. The talk covered our research into the Media Relay Service (MRS) of the manufacturer Infodraw, which is used together with surveillance hardware such as body cameras and police drones. We discovered a path traversal vulnerability that allowed reading sensitive files, including stored credentials, as well as deleting arbitrary files.
After we reported the issue and informed CERTs and operators, affected systems, including ones linked to police units in Belgium and Luxembourg, were taken offline. What followed was unexpected: a criminal investigation was opened in Luxembourg against Tim as the researcher who reported the vulnerability. The investigation was discontinued without any result. Presenting this story at hack.lu, in Luxembourg of all places, made the talk a particularly special moment for us.
The vulnerability
CVE-2025-43928, a path traversal flaw in surveillance software used by law enforcement, allowing file read and file deletion.
The disclosure
Responsible reporting to the vendor, CERTs and operators, which led to affected systems being made inaccessible.
The consequence
A criminal investigation against the reporting researcher, later discontinued, and the question of how we protect those who make systems safer.
Watch the talk: When Responsible Disclosure Becomes a Criminal Investigation (YouTube)
Read more: Path traversal vulnerability in surveillance software and Criminal investigation following reports of IT security vulnerabilities in surveillance systems
Mint Secure GmbH
All talks and the agenda
Besides the keynote and our own talk, hack.lu offered a dense program of highly technical presentations, workshops and plenty of opportunities to talk to researchers from all over the world. If you could not attend or want to catch up on talks you missed, the recordings are available online.
Recordings and program: All talks can be found on cooper’s YouTube channel, and the full program is available in the hack.lu 2026 agenda.
How Mint Secure supports you
The research we present at conferences like hack.lu flows directly into our daily work for our clients.
Penetration Testing
We test your applications and infrastructure with the same depth and creativity we use in our own research.
Vulnerability Management
We help you handle vulnerability reports professionally and set up a disclosure process that works for researchers and for you.
Talks & Workshops
We share our knowledge in talks, live hacking sessions and workshops for your team or your event.
Want to get started? We offer a free initial consultation. Get in touch now.
Conclusion
The 20th edition of hack.lu was a special experience for us. The conference is very technical, hacker-friendly and carried by a community that values openness and the exchange of knowledge. Add a great venue and a beautiful host country, and you have an event that is hard to beat.
We as the Mint Secure team will join hack.lu again in the future, and we warmly recommend it to everyone interested in security research and hacker culture.
Want to talk about our research or your own security questions? Get in touch with us.
'/%3E%3C/svg%3E){kind=small}
