🟢 Last call to join the Speed Pwning bracket-based CTF at @BsidesLisbon on Thursday, October 29! Two players go head-to-head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Check out all the details below ↓

Two critical RCE flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Every PHP stack is in scope. Fixes ship today at 14:00 UTC. Early signal flagged by Ethiack Zero. Ethiack now identifies the PHP runtimes you expose and flags EOL ones. ethiack.com/info-hub/researc…

Yesterday we asked: what if you could turn back the clock? We can’t, but we can see it sooner. Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing. zero.ethiack.com

Testing an AI pentesting agent only once means you're only seeing half the picture of how it actually performs. 👀 Because LLMs are probabilistic, outputs change from run to run. In agentic pentesting, small shifts in early exploration multiply, leading to entirely different results by the end of an engagement. A single run tells you almost nothing. But running dozens of end-to-end tests is expensive, so most teams test only 2 or 3 times. In this low-replication zone, standard p-value testing stops being reliable: with so few runs, a non-significant result often just means your sample size is too small to detect a real difference, not that the upgrade failed. We built Ethibench to test AI pentesting agents properly, with the replication these systems actually need. Find out more in the repo👇

Think you are the fastest hacker? Prove your skills in the CTF at @BsidesLisbon 2026 run by Ethiack For this edition, we are bringing: Speed Pwning CTF Two players go head to head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Losers are eliminated. - 8 participants - Single-elimination bracket - 30-minute matches - No qualifiers - Brackets are drawn at random Find all the details and register below↓

Ethiack is running the CTF for the second year at @BSidesLisbon 2026. For this edition we have created two experimental competitions split between the two days of the conference (Oct 29-30). First up a Speed Pwning bracket-based CTF, fast, head-to-head, human-only. Following we will host the first Ethiack SOHO Smashup, a home office hardware exploitation event in the spirit of Pwn2Own's SOHO category, where AI-assisted exploitation is explicitly encouraged. One competition measures raw individual skill under time pressure; the other measures what hackers can achieve against real consumer hardware with AI-assisted tooling. Read all the details below ↓

Ethiack is running the CTF for the second year in a row at @BSidesLisbon 2026. This October 29, we're bringing a new format: Speed Pwning CTF. Two players go head to head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Losers are eliminated. - Single-elimination bracket - 30-minute matches - 8 participants - No qualifiers — entry is by registration, first come first served - Brackets are drawn at random Rules? Simple: No AI. At all. There are three categories in play: pwn, misc and web. Players decide which category they'll play before each match through a veto process, each player can veto one category. The remaining category will dictate the challenge played by both players during the match Want to participate? Register below ↓ Participants must have a BSides Lisbon 2026 ticket to be eligible.