The #Synacktiv team is attending @hexacon_fr 2025, the premier event dedicated to offensive security! Come meet our experts over two days packed with technical talks, real-world feedback, and engaging discussions. 🗓️ Friday, October 10 & Saturday, October 11, 2025 🔗 More info : hexacon.fr/

Our ninja @Butanal_C4H8O identified a high-impact XSS in Netwrix Directory Manager. The CVE-2025-47189 vulnerability can be exploited from the Windows lock screen to gain administrator privileges on a workstation. synacktiv.com/advisories/net…

🔐 Data encryption in Laravel environments is based on one secret: the APP_KEY. Our ninja @_remsio_ studied the impact of its leakage on the internet during an entire year. synacktiv.com/en/publication…

While performing security research on IoT control applications, @Areizen_ and @Anatharrr discovered critical vulnerabilities in the mobile app for the Eachine E58 drone. These flaws could potentially lead to remote code execution on the user's smartphone. synacktiv.com/en/publication…

A pre-auth RCE combining 2 critical vulnerabilities on the Production Environment extension of the PHP low-code website generator ScriptCase has been found by @noraj_rawsec and cabir. No upstream fix yet, please apply the workaround. synacktiv.com/advisories/scr…

While performing penetration tests on SAP Financial Consolidation, our ninjas @l4x4 and @alexisdanizan discovered an authentication bypass for local accounts including the built-in ADMIN account, leading to the underlying system compromise: synacktiv.com/en/advisories/…

On stage at #x33fcon for the lightning talks! Web payloads management, EDR bypasses and insights into CVE-2025-33073🔥

For our last talk, @croco_byte explains how to exploit SCCM policies to harvest credentials 🔑 #SSTIC2025

We still have a few talks for #SSTIC2025 last day! This morning, @hugoclout presents 2 proxy tools used during pentests 🌐

For the final talk of the Synacktiv track, @_bluesheet and Oposs give a retex on post-quantum cryptography #SSTIC2025

It's now time for @aevy__ and Paul Barbe to present Azure conditional access policies ☁️ #SSTIC2025

For our second talk of the day, @flgy presents Mofos, a virtual machines manipulation framework to mimic QubesOS on a standard Linux distribution #SSTIC2025

We're sponsoring @offensive_con again this year. Meet our team at our booth in Berlin on May 16-17th, we’ll be around to chat! 🥷

📢 The new MISC edition is out! Check out the headline research by @_remsio_ and @Kain0x42 on Laravel APP_KEY security. Thanks to @editionsdiamond for the opportunity and enjoy the read! 📚🔒🥷

The FastCGI library, mostly used in embedded equipment, was vulnerable for decades to an integer overflow over the IPC socket in 32-bits architecture. Check out how @ShiroPycatchown found it and exploited it for RCE! synacktiv.com/en/publication…

From firmware dumps to wireless exploration — check out our latest dive into DVB receiver analysis and the hidden attack surface it exposes! synacktiv.com/en/publication…

PagedOut! #6 magazine is out! This edition features two articles from our ninjas: - Implicit Unicode behaviors in database string functions - Calling Rust from Python: A story of bindings Dive into their insights here: pagedout.institute

Synacktiv is looking for an additional team leader in Paris for its Reverse-Engineering Team! Find out if you are a good candidate by reading our offer (🇫🇷). synacktiv.com/responsable-eq…

🚀 This week, @us3r777 & @__pierreg kick off our new Whitebox Vulnerability Research training! Students will dive into PHP, Java, and .NET, analyzing & exploiting 1-day vulnerabilities. Let’s get started! 💻🔍

Exciting news, our Offensive Azure training has been accepted at #x33fcon! 🥳 Can’t wait to see you there and dive into the latest techniques for attacking Azure environments!