Synacktiv

Two of our experts on stage at #hack.lu last week: us3r777 - Improving wordlists with tooling & methodology @remsio.bsky.social - Deep dive into Livewire: from weak typing to pre-auth RCE 🎯 Locked outside your target? Have a look at: ▪️ github.com/synacktiv/di... ▪️ github.com/synacktiv/Li...

CI/CD pipelines are prime targets for attackers. Is your org prepared? Join @matthieub.bsky.social & @rustyphasm.bsky.social at #InsomniHack for 2 days on GitHub Actions, GitLab CI/CD, runner hijacking & secret extraction. Register here ⬇️ www.insomnihack.ch/session/88c0...

Come by our booth, take on our challenge and win some awesome prizes 🎁 The grand finale takes place tonight 🏆 Don’t miss out! #Hexacon26

🚀 Synacktiv is at @hexacon.bsky.social! We’re catching up with the offensive security community, sharing expertise and exchanging ideas. 🤝 📍 Here too? Come say hello! 🔗 www.hexacon.fr

J-1 before @hexacon.bsky.social! We’ll be at the Palais Brongniart tomorrow. Looking forward to seeing you there 🚀

🥊 #Rikugan vs #Frontkick: who wins the agentic AI showdown? Rikugan is open-source and making waves on IDA. Frontkick is built for Binary Ninja. ToolAgent or CodeAct? Aiglematth breaks down the contenders. Read the article ⬇️ www.synacktiv.com/en/publicati...

In 2023, #Synacktiv researchers identified an authentication bypass in #Danfoss SM800 and SC255 controllers. The same vulnerability, reported again in 2025, could be linked to the recent supermarket refrigeration attack. 🔎 www.synacktiv.com/sites/defaul... 🔎 www.synacktiv.com/sites/defaul...

How can an HTTP Range request help exfiltrate files and secrets from VMs? At T-REX 2026, @tg91axmk.bsky.social presented Fusetea, a tool we use during TLPT engagements to speed up Red Team ops. 🔎 Discover Fusetea: github.com/synacktiv/fu... 📑 Check out the slides: www.synacktiv.com/sites/defaul...

🔐 What if your Group Policy Objects were an attacker’s best friend? As part of NULLCON Berlin, join @wilfri3d.bsky.social & @rustyphasm.bsky.social for a webinar on GPO exploitation in Active Directory. 📅 Oct 12 | 11:30 AM-12:30 PM Register ⬇️ events.teams.microsoft.com/event/fb6639...

Our CEO Renaud Feil shared his insights on how AI is shaping cybersecurity at @bsidescbr.bsky.social 🇦🇺 While we wait for the official video, check out and download the slides here: www.synacktiv.com/sites/defaul... Thanks to the organizers and everyone who attended!

During a Red Team assessment, laxa discovered multiple vulnerabilities on Ubika WAAP Gateway, including a pre-auth RCE as root. Technical details are available here ⬇️ www.synacktiv.com/advisories/u...

🚨 Un cluster Kubernetes est compromis. Où sont les preuves ? Conteneurs éphémères, logs distribués, workloads volatils… l’investigation forensique dans #Kubernetes ne s’improvise pas. Retrouvez notre formation : Kubernetes Forensics ⬇️ www.synacktiv.com/offres/forma...

🔥 What are you bringing to #Entrypoint? New technique? Tool release? Real-world compromise? Deep technical offensive security talk? 🎤 CFP closes 20 September. 📅 19-20 March 2027 | 📍 Paris ➡️ cfp.entrypoint.fr/entrypoint-2027/cfp

🔐 Un #ActiveDirectory compromis : savez-vous reprendre le contrôle ? Notre formation AD: Hardening & Post-Compromise Recovery vous apprend à durcir l’AD, détecter les attaques et maîtriser la reprise de confiance après compromission. Inscrivez-vous ici ⬇️ www.synacktiv.com/offres/forma...

Synacktiv recrute un Dev QA Red Team (H/F) ! Ta mission : tester & faire évoluer notre arsenal offensif (stabilité, perf, furtivité). 🛠️ Requis : Python, QA, culture cyber offensive, virtualisation. 📍 Paris 2e 🔗 www.synacktiv.com/developpeur-... 📩 apply+dev@synacktiv.com

Approfondissez votre expertise #ActiveDirectory avec deux formations complémentaires : 🔹 AD Intrusion Tactics: Advanced : 16-20 nov ➡️ www.synacktiv.com/offres/forma... 🔹 AD Hardening & Post-Compromise Recovery : 23-27 nov ➡️ www.synacktiv.com/offres/forma... Inscrivez-vous dès maintenant !

In our latest article, Quentin presents new scripts allowing to simulate legitimate AD services in a flexible manner, and demonstrates their use through GPO exploitation ⬇️ www.synacktiv.com/en/publicati...

🚨 Une fuite de données vient d’être détectée. Et maintenant ? Investigation, crise, conformité : préparez-vous à prendre les bonnes décisions. 📅 29/09 - #CampusCyber 🎓 Formation #Synacktiv x #Alcyconie 🔗 synacktiv.com/offres/formations/data-breach-investigations-crisis-management-compliance

#NIS2, #DORA and the #CRA all aim to strengthen cyber resilience - but how can organisations demonstrate that their security measures are truly effective? Read our latest article ⬇️ www.synacktiv.com/en/publicati...

Envie de développer vos compétences en sécurité des systèmes embarqués ? 🔐 Inscrivez-vous à notre formation : 📅 Embedded Systems Exploitation : 19-23 oct. Firmware, QEMU, analyse statique, fuzzing AFL++ et exploitation de vulnérabilités ⬇️ www.synacktiv.com/offres/forma...

🚨 Une fuite de données ne se résume pas à un incident technique. Le 29 septembre, Synacktiv & Alcyconie proposent au Campus Cyber une formation sur l’investigation, la gestion de crise et la conformité. 🔗 synacktiv.com/offres/formations/data-breach-investigations-crisis-management-compliance

Cet automne, renforcez vos compétences en sécurité offensive dans les environnements cloud. 🔹 Cloud Intrusion Tactics : 28 septembre - 2 octobre ➡️ www.synacktiv.com/offres/forma... 🔹 Azure Intrusion Tactics : 5-9 octobre ➡️ www.synacktiv.com/offres/forma... Inscrivez-vous dès maintenant !

Vous souhaitez renforcer vos compétences en sécurité DevOps, Linux et Kubernetes ? Participez à nos prochaines formations : 🔹 DevOps & Linux Breach Tactics : 28 septembre - 2 octobre ➡️ www.synacktiv.com/offres/forma... 🔹 Kubernetes Forensics : 12 - 14 octobre ➡️ www.synacktiv.com/offres/forma...

Ready to take your malware analysis skills to the next level? Join our experts at #Nullcon Berlin 2026 for our hands-on Malware Analysis training. 📅 2-4 Nov 2026 Sign up 👉 nullcon.net/training/adv...

Register for our Active Directory Intrusion Tactics: Advanced Level training with @wilfri3d.bsky.social and @rustyphasm.bsky.social at #Nullcon Berlin, from 2-4 Nov 2026 📚 Learn real-world AD attack paths, lateral movement, and defence strategies ⬇️ nullcon.net/training/act...

Interested in old video game vulnerabilities? 🎮 Checkout our latest blogpost on Titan Quest : Anniversary Edition by @tomtombinary.bsky.social ⬇️ www.synacktiv.com/en/publicati...

Compliance is no longer enough. Technical evidence is what matters. How can you prove your security measures are actually effective? Discover how #Synacktiv helps organisations move beyond compliance with evidence-based security assessments ⬇️ www.synacktiv.com/en/publicati...

Synacktiv recrute de nouveaux profils Red Teamer H/F 🥷 🎯 Exercices Red Team (AD, Cloud...), Lab & Furtivité, 0-Day 👤 3+ ans d'expérience 📍 6 bureaux en France ou 100% remote 📩 apply+pentest@synacktiv.com 🔗 www.synacktiv.com/red-teamer

After MySQL, it's now SQL Server's turn. noraj takes a deep dive into Unicode-related security issues. 📚 Read the full article: www.synacktiv.com/en/publicati...

🔒 #Recrutement | @synacktiv.com recherche un(e) Officier de Sécurité à Paris. Vous souhaitez contribuer à la protection de l'information au sein d'une société d'expertise en cybersécurité ? 👉 Postulez dès maintenant : www.synacktiv.com/officier-sec...

During an internal assessment, our expert found several vulnerabilities in #Xpra (Screen for X11) which, chained together, allow a malicious server to gain RCE on the client. Update your packages! ⬇️ www.synacktiv.com/en/advisorie...

Tu aimes chercher des failles et passer ton temps sur de la technique et de la R&D ? L'équipe Pentest de @synacktiv.com recrute. 📍 Paris, Rennes, Toulouse, Lille, Lyon, Bordeaux (+ télétravail pour profils expérimentés) Je postule 📝 www.synacktiv.com/pentester-di...

🚀 Le pôle Reverse de @synacktiv.com recrute ! Vous poncez les CTF ? Vous aimez la R&D et vous souhaitez évoluer aux côtés d'experts reconnus dans le domaine ? Rejoignez-nous ! 📍 Paris, Rennes, Toulouse, Lille, Bordeaux, Lyon ou full remote (France). 👉 www.synacktiv.com/recherche-et...

Who said KYC is not fun? Discover how @kevintell.bsky.social and @log-s.bsky.social exploited new #AI techniques to bypass Age Verification and how this technology reshuffles the deck ⬇️ www.synacktiv.com/en/publicati...

A huge thank you to everyone who stopped by our stand at @le-hack.bsky.social ! Congrats to everyone who took on our challenge 🎯 Missed it? It's now available on our #GitHub, along with the write up: github.com/synacktiv/le... See you next year 🚀

A month ago we pointed our local LLM at #FreeBSD and it helped us find a local root exploit plus an ASLR bypass on SUID binaries to go with it 🚨 Both now patched (CVE-2026-49415 & CVE-2026-49414). Update your boxes! ➡️ www.freebsd.org/security/adv... ➡️ www.freebsd.org/security/adv...

CI/CD pwnage with a pre-auth RCE in #ArgoCD by @rustyphasm.bsky.social 💥 Discover how a single misconfiguration in a Helm chart can lead to a full cluster compromise sprinkled with some CodeQL shenanigans! 🥷 www.synacktiv.com/en/publicati...

"We're compliant." But can you prove it? With #NIS2, #DORA and the #CRA, compliance is no longer just about documentation. Organisations must demonstrate that their security measures actually work. Learn how technical evidence strengthens compliance 👇 www.synacktiv.com/en/publicati...

🚨 The #Entrypoint2027 Call For Papers is now open! Have original offensive security research to share? New techniques, tools, or attack stories ? We want to hear from you. 📅 CFP closes: Sept 20, 2026. Our review board will be revealed soon. 👉 cfp.entrypoint.fr/entrypoint-2...

📚 Kindle research, exploitation methodology, and jailbreak development. Missed @le-hack.bsky.social? SidewayRE's talk, "Bootstrapping Kindle Research for the Lazy Attacker", is now available. Read the slides 👇 www.synacktiv.com/sites/defaul...

Using #Helm and #Kubernetes in your CI/CD pipeline? An attacker only needs access to the values.yaml file to compromise your cluster. Recent research by Paul BARBE details a new injection technique to escalate privileges and deploy unauthorized resources ⬇️ www.synacktiv.com/en/publicati...

🚀 @le-hack.bsky.social starts today! Come meet the #Synacktiv team at stand 22 and try the challenge we designed for the event: puzzles to solve, secrets to find, and flags to capture 🔒 See you there 👋

Kernel LPEs dropping before patches are widely available? It's been a wild month for Linux defenders. Our CIO breaks down how tried-and-true hardening measures can raise the bar and buy your Blue Team time against N-days. 🔗 www.synacktiv.com/en/publicati...

⏳ 7 days to go until #LeHack ! On 26-27 June, visit #Synacktiv and take on a challenge designed especially for the event 🔒 Gain access, uncover secrets and solve puzzles. Can you capture every flag before time runs out? ⏱️ 📍 Stand 22 Who’s up for the challenge? 👀