Humanoid robots, home security cameras, Wi-Fi routers and drones were put to the test at SPIRITCYBER26, a live hacking competition organised by YesWeHack in collaboration with the Cyber Security Agency of Singapore (CSA).
Held between 13–15 October 2026, during Singapore International Cyber Week, the event saw five teams of ethical hackers striving to uncover vulnerabilities in connected technologies and maximise their share of a USD 50,000 prize pool.
The live finals followed an online qualifying round, held between 11 August-15 September 2026, which whittled 30 competing teams down to five finalists.
Armed with their expertise, creativity and a collaborative mindset, the finalists spent three days probing hardware and software for security weaknesses, earning Bug Bounty rewards for each validated vulnerability based on its severity.
From drones to security cameras
For “Elweth”, one of YesWeHack’s most successful hunters and member of the brilliantly-named runner-up team One Prompt to Pwn Them All, drones posed an intriguing challenge:
“During the on-site event, we focused on drones because they weren’t available during qualification through remote testing, making them a promising place to look for bugs that hadn’t been found yet. And indeed, we were able to find a few RCEs on this target.”
Elweth, member of runner-up team “One Prompt to Pwn Them All”
The team also tackled security cameras, whose ubiquity and lack of available technical documentation made testing appealing, but taxing:
“The cameras were particularly challenging targets because very little technical information, such as firmware, was publicly available. Despite that, we managed to find several critical vulnerabilities, including multiple RCEs and an authentication bypass.”
Elweth, member of runner-up team “One Prompt to Pwn Them All”
The final leaderboard
Congratulations to the finalists for making it through to the final five – and well done in particular to the overall winners: nullIoT! The final leaderboard looked like this:
🥇nullIoT (bytehx, 0xakm, mgthuramoemyint)
🥈One Prompt to Pwn Them All (elweth, liodeus, cosades)
🥉Peenoise (shipcod3, jeroldcamacho, japzdivino)
🏅Hamtarou (yt, jhf)
🏅Undefined Behavior (floerer, mastersplinter)
“SPIRITCYBER 2026 was an amazing experience, and I’m really happy that our team managed to finish in first place. The targets were interesting and challenging, which pushed us to think creatively and try different approaches.”
bytehx, member of the winning team, nullIoT
More than a competition: collaboration, creativity, community
For all that the event was a hard-fought competition with money at stake, it also offered an opportunity for researchers to exchange ideas and build connections.
“What I enjoyed most was working together as a team, sharing ideas, and combining our skills to find vulnerabilities. A big thanks to YesWeHack and the organizers for putting together such a great event. Looking forward to the next one!”
bytehx, member of the winning team, nullIoT
“We’d spent several weeks looking for vulnerabilities in the same devices, so it was great to get together and compare findings. Working with Thibault and Sébastien [his teammates] was a big part of the experience. We challenged each other’s ideas and combined our strengths to take promising leads further. It was also a chance to chat over a beer in the evening after a long day hunting, which creates some great memories. It was the first time in Singapore for all three of us! We really enjoyed discovering the city. It made us want to come back, whether for a holiday or perhaps another live hacking event next year?”
Elweth, member of runner-up team “One Prompt to Pwn Them All”
The YesWeHack team were also impressed with how the event unfolded, in particular the creativity and dedication of the participating hunters.
“One of the highlights of SPIRITCYBER for me was seeing how passionate and dedicated the participating teams were throughout the event. Testing IoT devices brings its own unique set of challenges, and it was impressive to see the creativity, determination and different approaches the researchers brought to their testing.
“Organising a live hacking event can be complex, but seeing everything come together and watching the teams showcase their skills made the experience incredibly rewarding. It really highlighted the talent within the cybersecurity community and the value of events like this.”
Natasha Veno, customer success manager for the Cyber Security Agency of Singapore, YesWeHack
All the ingredients necessary for a great live hacking event were in place, according to Elweth.
“Everything was well organised, which allowed us to focus fully on hacking and make the most of our time there. At lunchtime, we were served delicious meal platters, which helped us stay focused on our findings. And, most importantly, unlimited coffee: that’s key. The event was also in a great location, in one of the most beautiful spots in Singapore: Marina Bay, it leaves you with great memories.”
Elweth, member of runner-up team “One Prompt to Pwn Them All”
SPIRITCYBER26’s focus on IoT reflects Singapore’s proactive approach to hardening the nation’s cyber defences has it continues to roll out and strengthen digital services under its Smart Nation initiative.
The event also builds on YesWeHack’s wider involvement in Singapore's cybersecurity ecosystem, notably its longstanding Bug Bounty partnership with the Government Technology Agency of Singapore (GovTech), which uses targeted testing sprints to strengthen the security of government digital services.
A huge thank you to the Cyber Security Agency of Singapore (CSA) for its collaboration in making SPIRITCYBER26 possible and its continued commitment to strengthening the nation’s cyber resilience.
And, of course, a heartfelt thanks to all 30 teams for their enormous contributions to the hardening of IoT devices used in Singapore and elsewhere.
What could a live hacking event uncover in your organisation?
Interested in exploring what a Live Bug Bounty could achieve for your organisation? Let's discuss whether it's the right fit for your security objectives.
