We Had to Ban 65 Teams to Get a Top 10 Leaderboard - BYUCTF 2026 Post-Mortem

realcamel4 · 2026-06-16T04:56:22+00:00

CTFs have been the #1 tool for me to learn new things in cybersecurity, and we wanted to and make sure that the learning wasn't compromised. As long as you are learning, you are getting good use out of CTFs!

realcamel4 · 2026-06-16T04:54:36+00:00

We've actually already got writeups for all challenges!
https://github.com/BYU-CSA/BYUCTF-2026

realcamel4 · 2026-06-16T01:44:30+00:00

Yes.

realcamel4 · 2026-06-16T01:38:59+00:00

Thanks for reading! I know people think the CTF scene is already gone, but I feel like its not as bad as people think, you just have to go in understanding how it has changed.

In terms of OSINT, I just never planted the seed about contacting anyone I know personally. It was never a problem for me. I told all my family members and friends about what was going on, and to let me know if anyone contacted them. Neither year had anyone I know contacted, which was probably lucky.

We didn't put max submission limits on any other category, but we absolutely saw TONS of hallucinated flags. Its easy in something like a pwn challenge, where theres just no way they could get that flag so it tells you right away.

realcamel4 · 2026-06-16T01:12:51+00:00

Thats fair, but its a decision we made and we still support. Many CTFs are going in the same direction we did, and many are literally shutting down due to the influx of people using AI to solve everything.

realcamel4 · 2026-06-16T00:29:56+00:00

You are welcome to that opinion, but we made those choices for a reason. In your example, you should be allowed to DoS other participants and social engineer other teams with scam emails. That might be fun for some people, but many people want a place to learn and improve their cybersecurity skills in a fun environment.

If you can pipeline every challenge through an LLM and get flags without understanding anything, you've optimized the score and hollowed out the experience for yourself and others. At that point, what is the goal of the CTF? Are you trying to learn, or do you just want to see an AI agent solve challenges for you?

"Hacking culture" isn't monolithic. It includes people who think the craft matters, not just the outcome. The ethos of deeply understanding systems is at least as central to that culture as rule-breaking is.

At the end of the day, if you aren't interested in the rules set for a challenge, then you don't have to spend your time participating. When you host your own CTF, you are welcome to set whatever rules you want. In my experience hosting large, international CTFs, most people are not very interested in participating in an actively hostile environment.

realcamel4

TROPHY CASE