Inside NUS GreySummit 2026
Lego gachapon machine, built by a student organiser, was one of the challenges at this year’s event run by NUS Greyhats.
This year’s NUS GreySummit brought 1,422 participants and 145 attendees to the NUS School of Computing for a day of competition, talks, and hands-on activities with industry professionals working in cybersecurity.
The day’s centrepiece was Grey Cat The Flag (GreyCTF) 2026, a cybersecurity competition that drew teams from 28 local institutions and internationally, with the winning team from Tsinghua University. The winning local team brought together Yuan Xi Yap, Jia Jie Lee, Haowei Chen, and Joey Tang – Yap currently serving National Service before starting at the University of Cambridge, with teammates at NUS, Hwa Chong Institution, and the University of Illinois Urbana-Champaign.
One of the day’s standout challenges involved a gachapon machine, built from Lego by one of the student organisers.
Participants were given an NFC card and had to modify it to trick the machine into unlocking.
Booths were staffed by cybersecurity organisations and communities including DSO National Laboratories, Defence Science and Technology Agency (DSTA), Centre for Strategic Infocomm Technologies, Internal Security Department, Home Team Science and Technology Agency (HTX) and Division Zero.
NUS Greyhats, the student group behind the event, says most sponsors come from government agencies with a stake in cybersecurity talent development, and the group has been working to bring in more private-sector partners. “Being in the cybersecurity field, we often tackle software challenges and vulnerabilities in the digital world,” says Joshua Goh of NUS Greyhats. “Being able to hack the gachapon is especially interesting as it gives us the rare chance to see the physical impacts of cybersecurity.”
Josiah Rachmat, a student at SUTD who attended the event, took part in both the 1v1 CTF match and the gachapon challenge. “The adrenaline of actively having made more progress on my challenge than my friend did was truly special,” he says of the CTF match.
On the gachapon challenge: “It was my first time ever getting to play with a Flipper Zero, and it was so cool being able to hack an NFC card. It was also amazing hearing that the student behind this activity learned how to build his gachapon machine with Lego from scratch.”
NUS Greyhats sees the event’s format changing in the years ahead. “Given the rapid AI advancements over the past year, CTFs – much like the wider cybersecurity industry – have seen significant disruption, with AI now able to solve challenges that were once considered extremely difficult,” Joshua said. “As we embrace these changes, GreyCTF will need to adapt and invent new formats so the competition remains dynamic, competitive, and fun for all skill levels.”
“Seeing everybody else truly enjoy learning about cybersecurity in innovative ways deepened my desire to get better and to build a similar community to enjoy this interest within my own school as well,” Josiah added.
