Synack Red Team

The power behind the @Synack platform is an elite team of the world's top cybersecurity researchers. Our best are honored at

[Synack Red Team @SynackRedTeam]

Nobody treats a shortcut label as an attack surface. SRT member Nitesh Shetty did. Result: stored #XSS that fires at every login and spreads through a shared import file. 🎯 Check it out: https://t.co/XfbeUater7

[Synack Red Team @SynackRedTeam]

Hello, Thailand 😎

We're kicking off our annual HackerHangout this week! Big thanks to the partners, family, and friends who support us all year and make the SRT community possible.

[Synack Red Team @SynackRedTeam]

The flaw was in the timing. Synack Red Team researcher Elison Kaloshi sent identical payments in parallel using free Burp Suite. A few milliseconds turned 2,000 units into a 10,000-unit card credit. https://t.co/eVg2252635

#ExploitsExplained

[Synack Red Team @SynackRedTeam]

A random-looking GUID was the only thing protecting guest PII on a food ordering platform. Maybe it wasn’t so random?

Synack Red Team researcher Mustafa Öztaş (rickiex) spotted the pattern. A forgotten endpoint did the rest. CVSS 8.7. https://t.co/PHvCX0rKwZ

[VMblog @vmblog]

On October 21, government websites across Europe went dark. Dutch, French, Danish, and Finnish agencies took public-facing services offline after critical vulnerabilities surfaced in #PHP, the programming language behind approximately 75% of websites. The flaws had been sitting in the codebase for years until AI tools uncovered them.

Although a fix has been shared publicly, #AI has made it easy for attackers to reverse engineer what changed. Amazon reported that its security team saw an exploitation attempt against a honeypot system on October 17, four days before the disclosure. Defenders were behind even before the advisory went out.

In this post, Mark Kuhr and Nabil Hannan answers the broader questions #security teams are asking about how this story illustrates the new normal in offensive security.

https://t.co/fIIHRa8n4H

#cybersecurity #phpflaw

[Synack Red Team @SynackRedTeam]

The sandbox blocked every classic Jinja2 SSTI payload. It still lost, because a Pydantic model in the template context led straight to pickle.loads. gfuzzer breaks it down in this week’s Exploits Explained: https://t.co/r8sqRR9mgO

[Synack Red Team @SynackRedTeam]

Small bugs, big impact. Synack’s Sr. Pentester Ryan Moore shows how three minor epmd defects chain into CVE-2026-42792, a permanent DoS that takes about 34 bytes per second to trigger.

Patch and mitigation steps: https://t.co/IEslb3RsQY

[Synack Red Team @SynackRedTeam]

A dangling CNAME looked like a low-impact finding until Synack Red Team member Plamen Dimitrov (d7x) found a custom JavaScript field in the third-party portal behind it. One line of code gave him cookie control across every subdomain. https://t.co/Y2O5lzFNrQ

[Synack Red Team @SynackRedTeam]

“If you don’t enjoy it, you’re not going to push through those hard times.”
SRT researcher AnInsiderThreat drops some real talk on passion, persistence, and avoiding burnout in bug bounty:

[Synack Red Team @SynackRedTeam]

What do you do when the device you're attacking refuses to talk back?

Synack Red Team researcher Shea Norwood found an unauthenticated command injection bug in a Nortek Linear eMerge E3, the appliance behind badge readers, door locks, and the credential database for facilities. The endpoint would run any command handed to it. It just never said so. No error, no output, no visible change.

So Shea made it talk in a language it couldn't help but speak.

A sleep 5 payload delayed the response by five seconds. Double the sleep, double the delay. Then came the real test: smuggling command output out as a DNS lookup, caught on a Burp Collaborator listener the appliance never knew existed. The HTTP response gave up nothing. The DNS traffic gave up everything, including the exact user the shell was running as.

Full compromise of a door controller isn't just a shell. It's physical access, employee records, and compliance exposure riding on one unsanitized parameter.

Blind doesn't mean unexploitable. Read how timing and DNS turned a silent endpoint into full remote code execution 👇

https://t.co/qJx7mCuKGl

[Synack Red Team @SynackRedTeam]

SRT researcher @mcipekci on why AI will not replace humans:

[Synack Red Team @SynackRedTeam]

Synack Red Team researcher Mạnh Nguyen Dinh pointed an AI coding agent at a car's CAN bus. See what it found in our latest Exploits Explained: https://t.co/XWBpdGkKdu

[Synack Red Team @SynackRedTeam]

“I had three SQLis I submitted two days ago; they got triaged yesterday." ⚡️
- SRT researcher Austin on the advantages of hacking with @synack compared to other platforms.

Interested in joining the Synack Red Team? Visit our website to learn more: https://t.co/m83ncCT8nt

[Synack Red Team @SynackRedTeam]

@turakbusra breaks down three shifts security teams need to account for when pentesting AI systems: https://t.co/nNpg50Tcx4

#ExploitsExplained #PromptInjection #AISecurity #LLMSecurity #SynackRedTeam

[Synack Red Team @SynackRedTeam]

Meet our 2026 Synack Red Team Heroes! 🏆🏆🏆🏆 (Part 4 of 4)

The Hero Award honors our researchers who generate significant value and impact for our customers.

See all 2026 Acropolis winners: https://t.co/AH3tAKyB89

#Acropolis2026 #CyberSecurity #EthicalHacking #Pentesting

[Malcolm Stagg @malcolmst]

Thanks @SynackRedTeam and The Datatech Times! Glad to be able to share some more about this research.

[Synack Red Team @SynackRedTeam]

Nice writeup from The Datatech Times on @malcolmst and his NatJack research. Stagg first discovered that NAT table entries could be corrupted or replaced while on assignment for the Synack Red Team.

In his own words: “For a lot of business and enterprise customers, I would say the TCP and HTTP session hijacking techniques are the most dangerous, since a lot of internal network traffic is still unencrypted, and untrusted/trusted workloads often share the same NAT."

Worth the read if you want the story behind the NatJack research: https://t.co/U8CwAgeMFK

[Synack Red Team @SynackRedTeam]

An AI chatbot flagged every injection attempt it recognized. The one that got through wasn't recognized as an attempt at all.

SRT researcher @N0_M3ga_Hacks realized it was filtering by intent, not syntax. Wrapping the real payload inside a benign, expected-looking request slipped past the filter and returned database schema details in markdown.

Parth broke down the discovery, the bypass, and what it means for AI guardrail design in this week's Exploits Explained: https://t.co/nEKkVaijrW

#ExploitsExplained #AIsecurity #OffensiveSecurity #SynackRedTeam

[Jay Kaplan @JayKaplan]

I have not posted here in a long time. This seemed worth logging back in for.

This week @NetSPI and @Synack signed a definitive agreement to merge, backed by @KKR_Co. Together we are creating the largest expert-led offensive security platform in the world. Nearly 40 years of operating history and more than 13 million hours of real-world offensive testing, with agentic AI underneath all of it.

There are far too many people to name here, so: every Synacker past and present, the investors who backed two guys out of the NSA in 2013 on an idea that sounded strange at the time, and the partners, advisors and customers who took our calls and told us the things we did not want to hear. The people who moved on built the floor the rest of us are standing on. This outcome is yours as much as anyone's.

To the @SynackRedTeam especially. You are the reason the thesis was right in the first place. If I believed autonomous tooling could replace expert judgment, then merging two of the largest concentrations of it in this industry would be a spectacular waste of capital. This deal is an argument for your value, not against it.

And I am looking forward to working alongside @Aaron_Shilts and the NetSPI team as much as anything else about this. Respected them from across the field for years. Glad to finally be on the same side of it.

Briefly on why we did it this way, because it is not the obvious bet.

The industry is spending hundreds of millions of dollars to take humans out of offensive security. "No humans in the loop." "Requires no human input." We just built the opposite.

Every benchmark in this argument measures what agents found. Not one measures what they walked past. A false positive costs an engineer an afternoon. A false negative is the breach, and it is invisible by construction.

The best autonomous agent yet tested beat nine of ten professional pentesters on a live network, out-submitted every one of them on false positives, and reached the finding that mattered only after researchers handed it hints. It was not outmatched. It was undiscerning.

Autonomy was never the goal. It is a means. The goal is knowing which of ten thousand findings gets used against you, and knowing what nobody looked at.

Day one of the next chapter. Thank you for building the last one with me.

Full thesis: https://t.co/wYgP3YI6tR

[Synack Red Team @SynackRedTeam]

SRT researcher @ozgur_bbh hit four dead ends on an Oracle backend. Then he found the exploit hiding inside a reporting function.

Standard boolean tests, time-based payloads, UNION injection and out-of-band callbacks all failed. The lever that worked: Oracle's DECODE function converts its return value to match the data type of its first result, and a mismatched default branch turns that into a type-conversion error researchers can read as a true/false signal.

This is part four of Ozgur's series on blind SQL injection, following posts on MSSQL, MySQL and PostgreSQL, each with a completely different exploitation gadget.

https://t.co/TTatYsMklv

#ExploitsExplained #SQLi #SQLinjection #EthicalHacking