Semgrep eventsJoin Semgrep security researchers, advocates, and engineers who are attending DEF CON.
We like to hang out in the AI Village, IoT Village, and AppSec Village to learn about weird edge cases in the wild, tools folks are using, how people are responding to the latest AI models and more.
Let’s debate, share stories, and nerd out.
📍 LVCC West Hall
🗓 August 6-9
Here’s where you can catch the Semgrep team on stage:
"Beyond Your Bookshelf: Hackable eReaders"
IoT Village Stage | Dr. Katie Paxton-Fear (Staff Security Advocate)
Kindles, Kobos, Boox and BigMes, there's no shortage of eReaders to choose from in 2026, with their paper-like eInk displays designed for one thing: reading books. But underneath that minimalist surface sits a surprisingly hackable IoT device! But when it comes to these devices there are a few quirks, from the locked-down Kindle in need of a jailbreak, to the xteink's open source Crosspoint firmware.
"Crypto Is Fine. The Code Is Not: Real-World Cryptographic Failures"
Crypto Privacy Village Stage | Diptendu Kar
Cryptography has a reputation for being intimidating, mathematical, and difficult to reason about. In reality, many cryptographic failures in production systems have very little to do with cryptography itself. They happen because of small implementation mistakes such as skipping a validation check, trusting unvalidated input, or selecting the wrong algorithm.
In this talk, we take a practical and data-driven look at the OWASP Cryptographic Failures category using GitHub Security Advisories collected as of January 2026. We begin with a brief overview of how these vulnerabilities are distributed across CWEs, then focus on two of the most common failure patterns. Using real vulnerable open source libraries, we examine signature verification bypasses and algorithm confusion bugs.
Rather than only showing exploits, this talk actively involves the audience. For each case study, we pause at key moments and work through the vulnerability together, asking questions like what inputs could be sent or what assumptions might be broken. Live demos and CTF-style challenges are used throughout, making the session interactive and approachable even without a cryptography background.