voydstack

VR @Synacktiv | CTF with @RMUBYGG, @Hexagonctf, @ECSC_TeamFrance 20/21/22/23/24

[Aikido @AikidoSecurity]

Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”

A significant blast radius.

This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.

Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.

[pilvar (Philippe Dourassov) @pilvar222]

Python2Shell is also a thing now.

Advisory: https://t.co/AyUjw2hD0p

[Calif @calif_io]

Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a much needed feature, inspired by the php2shell hacker @lcfr_hax!

What else there to hack? Wrong answers only.

[Calif @calif_io]

CC @pwnlambda

[voydstack @voydstack]

@xarkes_ @hexacon_fr Glad you liked it dude ! Nice to see you grinding it every year😄

[voydstack @voydstack]

We've open-sourced the Hexacon 2026 Speedrun CTF challenges ! Congratulations to all the players👏See you next year 🍾

[Hexacon @hexacon_fr]

The Hexacon 2026 Speedrun challenges are now open to everyone! How fast can you solve them? Train now for the next edition 🏆

https://t.co/hh3eDiM0Yy

[pepsipu @pepsipu]

i jailbroke the nintendo switch 2

so i modded cinnamoroll, peter griffin, hatsune miku, and more into Mario Kart World, a switch 2 exclusive

now watch my friends and i get cooked by bots

learn more and get the exploit https://t.co/ykjgyfrFRp

[Hexacon @hexacon_fr]

Hope you're all getting back to reality after an amazing edition of Hexacon! Thank you for your support and all the great talks. See you next year!

🗓️ 8-9 October 2027

[Calif @calif_io]

php2shell - A tale of two PHP remote vulnerabilities:

https://t.co/KEUVez9Zdl

[Boris Larin @oct0xor]

Andy Nguyen (@theflow0) presents at #TheSAS2026 on how he hacked the PS5 hypervisor (twice, with two amazing bugs!) and got Linux running on the console, with Steam games playable on it!!! 🤯

[toasterpwn @toasterpwn]

We've released all information from the
@BSidesCbr
2026 Speedrun CTF! Congrats to stackotter for winning, and to jamie who was runner up.

All challenge files, solutions, and info can be found here https://t.co/tnlxX2sFUL
Thanks everyone who watched, see you next year! 🚩⏱️

[InfoSect @infosectcbr]

Congratulations to InfoSect’s Rami on second place in @hexacon_fr’s speedrun CTF! He topped qualifying and took the final to a tiebreaker pwn challenge. A fantastic performance, we’re very proud.

Congrats to abiondo on the win, and thanks to the organisers!

[Marco Bonelli @mebeim]

Here at @hexacon_fr Orange Tsai just showed us how to pop calc from Edge with only logic bugs... and then how to pop Edge from calc ☠️ LMAO

[pwn.ai @pwn_ai]

Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors.

CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:

[V4bel @v4bel]

Galaxy S26 Ultra: untrusted_app → root.

Introducing "Infinity Core": 6 vulns in the Linux kernel's core subsystems.

Their impact spans Linux server LPE, container escape, and Android LPE.

Details: https://t.co/cq2XXfgcHi

[Calif @calif_io]

Demos we presented at Hexacon in Paris today. Everything will be released in due time.

1/ Signal 1-click

[Hexacon @hexacon_fr]

A brand new iPhone jailbreak has just been unveiled on stage at Hexacon by the @calif_io team 😱

[Hexacon @hexacon_fr]

The Last Proof of Human Craft by Orange Tsai 🍊 (@orange_8361)

[Synacktiv @Synacktiv]

J-1 before @hexacon_fr!

We’ll be at the Palais Brongniart tomorrow.
Looking forward to seeing you there 🚀

[Synacktiv @Synacktiv]

🥊 #Rikugan vs #Frontkick: who wins the agentic AI showdown?

Rikugan is open-source and making waves on IDA. Frontkick is built for Binary Ninja.

ToolAgent or CodeAct? Aiglematth breaks down the contenders.

Read the article ⬇️
https://t.co/xWZBqHWuRy