Hacker Summer Camp 2026: What Black Hat and DEF CON Said About Routers

Every August, Las Vegas hosts what regulars call "hacker summer camp" — Black Hat USA, DEF CON, and BSides Las Vegas, back to back. We don't have a booth there, but we read the talks, the keynotes, and the CVE disclosures that come out of it, because a chunk of it lands directly on the kind of hardware we build. Here's what stood out from 2026.

The events, briefly

DEF CON 34 drew an estimated 30,000 attendees under the theme "Agency" — framed around self-determination in an increasingly automated world, and pushing back against passive "user" defaults in favor of understanding the systems you actually rely on. The badge tradition returned too: an electronic "SAO Edition" badge built to be fully inspectable and modifiable hardware, in keeping with the theme.

Black Hat's two-day main event ran over 200 sessions covering cyber-resilience, malware, detection engineering, supply chain security, cryptography, and — more than any single previous year — AI security, prompt engineering, and autonomous exploit development.

AI: the dominant theme, from both directions

The clearest throughline out of Black Hat 2026 was that AI has stopped being an emerging topic and become the operational center of the security conversation, alongside longer-standing priorities like cloud and identity. It showed up in two distinct, and honestly opposite, ways.

AI as attacker tool

Microsoft's David Weston delivered a keynote arguing that AI is making advanced vulnerability discovery and exploit development cheaper and faster — undermining the old assumption that defenders have time between disclosure and exploitation to patch. His prescription wasn't "respond faster." It was: build more durable systems from the start. Concretely: adopt memory-safe languages like Rust, use AI-assisted engineering to harden existing codebases, and move off the monthly patch cycle toward automated remediation.

The security industry needs to build greater durability into systems rather than attempting to out-respond attackers who now move at machine speed. — paraphrased from David Weston's Black Hat USA 2026 keynote

AI as attack surface

The second thread was newer: researchers demonstrated AI agents themselves becoming targets, not just tools — credential exfiltration through agent workflows, hijacked shopping and personal assistants, and prompt-injection style attacks against systems that were never designed with an adversarial user in mind. The framing that stuck with us: every AI agent is effectively an identity with system access, and the governance tooling for that barely exists yet, industry-wide.

Meanwhile: a rough year for consumer routers

Away from the AI conversation, 2026 was a genuinely bad year for consumer router firmware. In February, eight CVEs dropped within hours of each other across widely deployed Tenda and D-Link models — buffer overflows and command injection flaws, the kind that let an attacker on the local network (or in some cases the internet) run arbitrary code on the router itself. Separately, CVE-2026-59108 documented a MikroTik RouterOS service-exposure issue tied to strict parsing requirements in PPP, VPN, and management API handling — a reminder that the same code paths carrying your VPN traffic are also the code paths an attacker can probe.

None of this is unusual for the category, unfortunately. Consumer routers have a long, well-documented history of being treated as disposable commodity hardware — shipped once, rarely patched, and left running for years past their last security update. That's the exact problem we started GhostPort to address.

What we take from this

• We don't claim GhostPort is unhackable. No hardware maker honestly can. What we can commit to is fast patching, a public bug bounty, and disclosing what we find — not burying it.
• Automated recovery matters as much as prevention. We wrote about our self-healing architecture — tunnel watchdogs, dual-radio failover, multi-region recovery — because a router that silently goes dark is its own kind of privacy failure, independent of whether it was ever exploited.
• The AI-agent governance conversation applies to us directly. As we build more automation into fleet management, the "every agent is an identity" framing from Black Hat is exactly the lens we're using internally.

We'll keep watching what comes out of full talk recordings and post-con CVE writeups as they land. If something concrete and actionable surfaces that affects GhostPort directly, we'll disclose it the same way we handle everything else — publicly, on this blog.