At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller. Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit. 🔍 www.synacktiv.com/en/publicati...

On the podium at #Pwn2Own Automotive 2026 🥉 Synacktiv ranked 3rd in Tokyo 🇯🇵 after successful attacks on #Tesla Infotainment (USB), #Sony XAV-9500ES (USB) and #Autel MaxiCharger (NFC). 📍 Next stop: Berlin!

In a highlight from Day One of #Pwn2Own Automotive 2026, @synacktiv.com targets the #Tesla infotainment system. #P2OAuto youtube.com/shorts/DKYT-...

Confirmed! Synacktiv (@synacktiv) chained three vulnerabilities to gain root-level code execution on the Sony XAV-9500ES, earning a full win of $20,000 USD and 2 Master of Pwn points. #Pwn2Own #P2OAuto

From legacy WEP to WPA3-Enterprise: sharing our recent #WiFi field experiences. 📡 We detail various scenarios to better understand the risks, including WPA3 PEAP relaying & optimized online PSK brute-forcing. ⤵️ www.synacktiv.com/en/publicati...

✨ Happy New Year 2026 ✨ Everyone at REVEL·IO wishes you a successful year ahead. As digital investigation challenges continue to grow, we remain committed to contributing to a safer future. Thank you for your trust!

[New blog post] As part of an R&D project, @tomtombinary.bsky.social identified several critical vulnerabilities in the LAN multiplayer mode of the game Anno 1404 (released in 2009) 🔍 Want to know more? Read the full article on our blog 👇 www.synacktiv.com/en/publicati...

HID recently disclosed HID-PSA-2025-002, a critical flaw in the #ActivID Authentication Appliance 8.7. In our new blog post, @us3r777.bsky.social and @pierregg.bsky.social break down exactly how they uncovered it, from methodology to exploitation 💡 Read it here ⬇️ synacktiv.com/en/publicati...

Missed @hexacon.bsky.social 2025? 🤯 Good news, all #Synacktiv’s deep-dive talks on offensive research & reverse engineering are now online! 🎥 Watch the full playlist: www.youtube.com/playlist?lis... #cybersecurity

At #Pwn2Own2025, our experts Tek & @anyfun.bsky.social remotely compromised a Synology Beestation Plus via a pre-auth exploit, leading to full system takeover. The vuln is now tracked as CVE-2025-12686 🔍 🔗 Full write-up: www.synacktiv.com/en/publicati...

Meet our #Synacktiv and @revel-io.bsky.social experts at #Milipol, from Tuesday 18 to Friday 21 November 2025! 📍 Visit us at Stand H063 (Hall 4 – Forensic Zone). ℹ️ www.milipol.com/fr-FR

[Blogpost] @croco_byte presents how to exploit attack paths related to Active Directory sites' ACLs. As the latter often constitute a blind spot for AD enumeration tools, the article also describes a pull request aiming to integrate them into the BloodHound project:

See you at #MilipolParis 2025 👋 📅 November 18-21, 2025 📍 Paris Nord Villepinte - Hall 4, Stand H063 (Forensic Zone) Meet our experts on site and discover how #REVEL·IO improves the efficiency and reliability of digital investigations 🔗 www.milipol.com/en

A big shout-out to the #Synacktiv team for their strong performance at the latest #Pwn2Own competition in Cork! They proudly secured third place overall 👏 Next stop: Tokyo for the upcoming edition 🇯🇵 👀 More details on the targets and participants here ℹ️ www.zerodayinitiative.com/blog/2025/20...

#REVEL·IO will be exhibiting at #MilipolParis 2025 📢 Developed by @synacktiv.com, REVEL·IO is the first French digital forensics solution designed to help investigators. 📍 Hall 4 - Forensic zone - Stand H063 💡 Learn more about Milipol: www.milipol.com/en 💡 Discover REVEL·IO: revelio.eu

Another busy month with many technical talks from the team! 💪 Links and more details below 👇️

Following their presentation at @hexacon.bsky.social, @mtalbi.bsky.social & Etienne detail how they exploited CVE-2023-40129, a critical vulnerability affecting the Bluetooth stack in Android ⬇️ www.synacktiv.com/en/publicati...

🎉 Big win at #Pwn2Own Cork! @pol-y.bsky.social of #Synacktiv successfully breached the @Ubiquiti AI Pro surveillance system 🦈🎶 What a way to wrap up the challenge - congrats, @pol-y.bsky.social 💪

Impressive work from our team today at #Pwn2Own! @mtalbi.bsky.social and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device! Great demonstration of Synacktiv’s offensive expertise 👏 Come on 🔥

Congrats to tek and anyfun for landing the first successful entry at #Pwn2OwnCork - exploiting a stack overflow on Synology BeeStation Plus for $40,000 and 4 Master of Pwn points in the process 💥 Let’s keep pushing 💪 #P2OIreland #Synacktiv

Our post-quantum cryptography series continues! This new article by @bluesheeet.bsky.social unpacks the hybridization of key exchanges, covering theory and implementations. Read all about why it matters, how to approach it safely, and some misconceptions here 👇 www.synacktiv.com/en/publicati...

LinkPro: new stealthy #Linux rootkit based on eBPF 🔍️ Our #CSIRT team discovered and named LinkPro, a new Linux rootkit, during an incident response. It exploits eBPF for evasion and persistence. Here are the four key technical points in the image below. 💡 🔗 www.synacktiv.com/en/publicati...

That's a wrap for Hexacon 2025! We hope that you've enjoyed the event at least as much as we did 🤩 Please take a moment to fill out our satisfaction survey and help us make Hexacon 2026 even better 🔥 Thank you for trusting us year after year 🙏

🎯 New training session: #ActiveDirectory Intrusion Tactics – Advanced Level 5 intense days diving into advanced AD intrusion techniques. Don’t miss our upcoming offensive #cybersecurity courses! 🔗 www.synacktiv.com/en/offers/tr...

LLM Poisoning [1/3]: Local LLMs are vulnerable to supply chain attacks. Inject a trigger-activated Trojan in a LLM. First step, build a probe to read a transformer's pre-down MLP activations to detect your chosen trojan trigger. 🔗 Full article www.synacktiv.com/en/publicati...

#LesAssises2025, here we go 🚀 Come and meet us at 𝘀𝘁𝗮𝗻𝗱 𝗙𝟮𝟴 to discuss your challenges and find out how we can strengthen your #cyber posture. Adrien, Augustin and Neder will be on hand to answer all your questions and share their insights. Seeing you there 🤝

A look back at our ninjas' first day at @hexacon.bsky.social ! We are proud of our experts Quentin and Etienne, who are leading the ‘iOS for Security Engineers’ training course. At the same time, Matthieu and Paul are hard at work on the ‘Azure intrusion for red teamers’ training course 🚀

📢"Paint it Blue: Attacking the Bluetooth stack" by Mehdi Talbi and Etienne Helluy-Lafont

Tick tock... 7 days to go until #Hexacon2025 kicks off ⏳ The @synacktiv.com team can't wait to see you at this crucial event for the #cyber ecosystem. Our experts will be on hand to discuss the latest innovations in pentesting and reverse engineering with you ! ℹ️ www.hexacon.fr

In our new blogpost, Alexandre Z. shows how one can abuse Unicode characters to bypass filters and abuse shell globbing, regexp, HTTP query parameters or WAFs when #MySQL strict SQL mode is off 👇 www.synacktiv.com/en/publicati...

Join us on 24 November for the Azure Intrusion Tactics training course 🛡️ Learn offensive techniques for compromising Azure environments. Realistic scenarios, stealthy approaches and cutting-edge expertise. Information & registration 👇 www.synacktiv.com/en/offers/tr...

Last sponsor to announce: Synacktiv! 🥷 @synacktiv.com strives to help firms evaluate and improve their IT security, everybody there is working to make it the 🇫🇷 standard in offensive security. There will a be a lot of ninjas lurking around, feel free to reach them out!

📢"Inside Apple Secure Enclave Processor in 2025" by Quentin Salingue

Sharing is caring ❤️ This month, our ninjas presented their research all over the world to the offsec community! Links and more details below 👇️

Missed our post-quantum cryptography series? In our latest article, we explore cryptographic hybridization, with a focus on digital signatures. Learn how to ensure a safe transition and avoid basic implementations pitfalls here👇 www.synacktiv.com/en/publicati...

How safe is your browser? Our ninja, Riadh Bouchahoua, uncovers how attackers can exploit Chromium extension loading to steal data, maintain persistent access, and breach confidentiality on Chromium-based browsers. Read more here ⬇️ www.synacktiv.com/en/publicati...

A technical look at @grapheneos.org Hardened Malloc, a memory allocator designed to mitigate heap corruption vulnerabilities (UAF, overflows) and break common exploit primitives. Deep dive for security researchers & exploit developers by @nicoski.bsky.social www.synacktiv.com/en/publicati...

This summer @synacktiv.com organized an interesting challenge: the aim was to craft a container image as small as possible which replicated itself (i.e. an OCI Image Quine), bsky.app/profile/syna.... I am now publishing a write-up of what I did (Rust/asm/code golfing/...): github.com/fishilico/sy...

DCOM is everywhere, but its inner workings feel like black magic. 🪄 Unveil the mystery with @kevintell.bsky.social's new article on DCOM basics. Trust us, it's way cooler than it sounds! www.synacktiv.com/en/publicati...

Aaaand the first talk to be announced is... 🥁 Exploiting the Undefined: PWNing Firefox by Settling its Promises by Tao Yan & Edouard Bochin

🚨 Time to reveal our first-class lineup for HEXACON 2025! ✨ A few training spots are still available if you want to join the party! 🎉 Unfortunately, trainings + conference packs are sold out www.hexacon.fr/conference/s...

🧑‍🎓 Boost your offensive Active Directory skills with our Entry & Advanced trainings. Hands-on labs with dozens of machines + latest research from DEFCON, x33fcon & more! Seats are limited, don’t miss out! 🔗 Entry: www.synacktiv.com/en/offers/tr... 🔗 Advanced: www.synacktiv.com/en/offers/tr...

🚀 Grab your seat for Sept 29! 🚀 Join our Cloud Intrusion Tactics training for a hands-on overview of offensive security across AWS, Azure, GCP & Kubernetes. Seats are limited, don’t miss out! 👉 www.synacktiv.com/en/offers/tr...

⚡️ Ready for some Rust ⚙️ + hacking 🕵️‍♂️? Two of our ninjas will land in Florence 🇮🇹 for #rustLab2025! 📅 Nov 2–4 🔥 Workshop: Network Interception in Rust – Build a MITM Tool from Scratch Hands-on. Real packets. Real fun. 👉 rustlab.it/talks/networ...

We’re thrilled to announce Donncha Ó Cearbhaill (@donncha.is) as our keynote speaker for HEXACON 2025! 💥 No doubt he has plenty of juicy stories up his sleeve 👾

We've just released a tool to decrypt all Synology encrypted archives! We used it to compare SynologyPhotos versions and highlight our #Pwn2Own Ireland 2024 vulnerability on the BeeStation BST150-4T. Check out our blog post for more details. www.synacktiv.com/en/publicati...

🔥 A few hours ago our experts took the stage at #DEFCON33, sharing cutting-edge research on SCCM exploitation and modern GPO attacks in Active Directory. Proud of the team! 🙌 cc @kalimer0x00.bsky.social @quent0x1.bsky.social @wilfri3d.bsky.social

🔒 Can you really trust your zero trust? We (re)discovered a vulnerability in Zscaler Client Connector that allowed bypassing device posture checks, and it was still exploitable in the wild. Full technical deep dive + remediation tips 👉 www.synacktiv.com/en/publicati...