TL;DR — submit today/this week. Only three security CFPs in Belgium/France/Netherlands/Germany are still open on April 30, 2026: BruCON 0x12 (Mechelen, BE) closes today at 23:59 CEST [1]; OWASP AppSec Days France (Paris) closes May 7 [3]; escar Europe 24 (Bonn, DE) closes May 10 — automotive-only [5]. Most heavyweights for 2026 (TROOPERS, OffensiveCon, Hardwear.io NL, leHACK, Pass the SALT, OrangeCon, heise devSec, MCTTP, BSides Frankfurt, ACM WiSec) closed CFP between March 1 and April 15.
Open CFPs (deadline ≥ 2026-04-30)
| Conference | Country | Conf dates | CFP closes | Scope | Speaker perks | Submit |
|---|---|---|---|---|---|---|
| BruCON 0x12 | 🇧🇪 Mechelen | Sept 24-25, 2026 (talks); Sept 21-23 trainings [1] | Apr 30, 2026 23:59 CEST ⚠ today [2] | Broad infosec; talks, workshops, 2/3-day trainings [1] | €1000 travel + accommodation [2] | Sessionize |
| OWASP AppSec Days France 2026 | 🇫🇷 Paris (75013) | Sept 24, 2026 (1 day, in-person only) [3] | May 7, 2026 23:59 CEST [3] | AppSec, GRC, DevSecOps; 20-min lightning or 45-min sessions; FR or EN; first local OWASP in Paris [4] | Notification within 20 days of close [3] | Sessionize |
| 24th escar Europe | 🇩🇪 Bonn / online | Nov 17-18, 2026 [5] | May 10, 2026 [5] | ⚠ Narrow: automotive cyber security (V2X, EV charging, UN R155, ISO 21434, AI/ML in vehicles) [7] | Scientific Track + Industry Track share the deadline [6] | EasyChair |
Three open. None of them is a “general hacker con” with a comfortable runway — BruCON closes the same day this list was compiled, OWASP AppSec Days France gives one week, and escar is automotive-specialised.
Out-of-scope CFPs that are still open
For reference (these countries are outside Belgium/France/Netherlands/Germany but are the natural spillover for the same speaker pool):
- DeepSec IDSC 2026 — Vienna, Austria. CFP open until July 31, 2026; conference Nov 17-20, 2026 [24].
- hack.lu 2026 — Luxembourg (20th edition). CFP open until May 31, 2026; conference Oct 20-23, 2026 [25].
Recently closed (so you know what you missed)
| Conference | Country | Conf dates | CFP closed |
|---|---|---|---|
| TROOPERS26 [16] | 🇩🇪 Heidelberg | Jun 22-26, 2026 | Apr 2 |
| MCTTP 2026 [19] | 🇩🇪 Munich | Sept 16-18, 2026 | Apr 15 |
| heise devSec 2026 [18] | 🇩🇪 Marburg | Sept 21-23, 2026 | Apr 14 |
| BSides Frankfurt 2026 [17] | 🇩🇪 Frankfurt | Sept 10, 2026 | Mar 31 |
| OffensiveCon 2026 [15] | 🇩🇪 Berlin | 2026 | Mar 1 |
| ACM WiSec 2026 [14] | 🇩🇪 Saarbrücken | Jun 30 - Jul 3, 2026 | Mar 3 (cycle 2; firm) |
| Hardwear.io NL 2026 [13] | 🇳🇱 Amsterdam | Nov 16-20, 2026 | Mar 5 |
| OrangeCon 2026 [10] | 🇳🇱 Amsterdam | Jun 4, 2026 [11] | Mar 31 |
| ONE Conference 2026 [23] | 🇳🇱 (NL govt-led) | Oct 6-7, 2026 | (closed) |
| leHACK 2026 [12] | 🇫🇷 Paris | Jun 26-27, 2026 | Apr 12 |
| Pass the SALT 2026 [8] | 🇫🇷 Lille | Jun 30 - Jul 2, 2026 [9] | Mar 31 |
Watch list — CFPs not yet open
- BSides Munich 2026 — workshops Nov 7, conference Nov 9, 2026; CFP page reads “CFP Opens Soon” — Pretalx link will be published on the site and socials [20].
- Elbsides 2026 — Hamburg, June 5, 2026; ticket sales open Apr 20, 2026; no public CFP listed [21].
- German OWASP Day 2026 — Karlsruhe, Sept 23-24, 2026; CfP opening “soon”, CfT for half-day workshops already open [22].
Notes on the open three
BruCON rewards in-person attendance: speakers get up to €1000 reimbursed and lodging covered, which is unusual for a community-led con and worth the rush submission [2]. They take both 45-min talks and full workshops, plus 2/3-day trainings — different review tracks, same deadline [1].
OWASP AppSec Days France is brand-new in Paris (the first local OWASP day there) and explicitly accepts French or English [4]. Commercial pitches are rejected, but vendor talks built around practical case studies are fine [3]. Lightning slot (20m) is the path of least resistance if you’re submitting cold.
escar Europe is the narrowest of the three — submit only if your work is automotive (in-vehicle networks, V2X, UN R155 / ISO 21434 compliance, EV charging security, secure ML in vehicles) [7]. Two parallel tracks (Scientific + Industry) share the May 10 deadline; pick the one that matches your evidence base [6].