Security "expert" @synacktiv ⛩️

Earth
Joined March 2013
On se retrouve le lundi 26/10 pour le meetup d’Octobre👾 Apparemment on va parler frigo & pentest 👀 📍Boulangerie Bar - 26/10 à partir de 19h (Salle du bas) #cybersecurite #lille #defcongroup
4
7
322
During a security assessment, our ninja @ImNotFl0 found vulnerabilities allowing to execute commands as root in the Danfoss SM800a, SM800 and SC255 controllers, mainly used to monitor and configure industrial fridges. Patch now! synacktiv.com/sites/default/… synacktiv.com/sites/default/…
1
10
1
37
6,472
In 2023, @Synacktiv researchers identified an authentication bypass in #Danfoss SM800 and SC255/SC355 controllers. The same vulnerability, reported again in 2025, could be linked to the recent supermarket refrigeration attack. 🔎 Authentication Bypass - Danfoss SM800 & SC255/SC355: synacktiv.com/sites/default/… 🔎 Multiple Vulnerabilities - Danfoss SM800A: synacktiv.com/sites/default/…
23
2
76
5,369
CI/CD pwnage with a pre-auth RCE in #ArgoCD by @hugow_vincent 💥 Discover how a single misconfiguration in a Helm chart can lead to a full cluster compromise sprinkled with some CodeQL shenanigans! 🥷 synacktiv.com/en/publication…
1
29
2
81
9,142
We've been working on something for a while. The talks your blue team doesn't want you to see. 🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation. 📍 Paris - Le Dernier Étage 📅 March 19–20, 2027 entrypoint.fr CFP and additional details coming soon.
1
54
2
102
20,763
iOS for Security Engineers by Quentin Meffre (@0xdagger) and Victor Cutillas (@v1csec) 📅 Oct 12-15 📍 Espace Vinci or Espace Cléry, Paris 2nd 👉 hexacon.fr/trainer/ios_for_s…
5
19
1,896
So glad to finally be able to present this research at @BlackHatEvents Asia! Blogposts are coming soon, on the menu: LPE via local NTLM reflection and RCE via a new arbitrary Kerberos authentication coercion technique 👀
Tomorrow, @yaumn_ will be presenting his research on Windows authentication reflection at @BlackHatEvents Asia 2026 in Singapore! The talk will be at 15:20 local time in Simpor Junior Ballroom 4810, come say hi! 😄 #BHASIA ℹ️ blackhat.com/asia-26/briefin…
11
1
43
3,576
Double trouble at #SOCON2026! Our ninja @kalimer0x00 was busy breaking down Microsoft SCCM (once again!), while @croco_byte unveiled new GPO-based attack paths & his latest BloodHound contributions targeting OUs & AD Sites. Awesome job! 👏
1
6
44
4,205
On se retrouve demain à partir de 19h ! 👇🏼 📍Boulangerie Bar - 02/03 (salle du bas)
Le prochain meetup aura lieu ce lundi 02/03👾 Au programme : - @Lefnui : Fonctionnement d’un DRM - @4rchib4ld : La Corée du nord et le remote 📍Boulangerie Bar - 02/03 à partir de 19h (Salle du bas)
1
3
336
Le prochain meetup aura lieu ce lundi 02/03👾 Au programme : - @Lefnui : Fonctionnement d’un DRM - @4rchib4ld : La Corée du nord et le remote 📍Boulangerie Bar - 02/03 à partir de 19h (Salle du bas)
3
1
6
665
Proud to finally share the write-up of our VMware Workstation escape from P2O Berlin 2025, featuring a generic bypass for Windows LFH mitigations using side-channels. I hope it will be as fun to read as it was to exploit! xitter.cf/Synacktiv/status/20157…
At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller. Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit. 🔍 Full technical write-up 👇 synacktiv.com/en/publication…
1
27
189
18,013
At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller. Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit. 🔍 Full technical write-up 👇 synacktiv.com/en/publication…
4
149
2
525
50,308
Something big is coming... @Bug_Recon
3
1
1
2
1,035
In a normal world, this should be an immense scandal in Europe. Le Monde has a long article (lemonde.fr/international/art…) describing the hellish life of Nicolas Guillou, a French judge at the ICC in The Hague, due to U.S. sanctions punishing him for authorizing arrest warrants against Netanyahu and Gallant for war crimes in Gaza. Guillou's daily existence has been transformed into a Kafkaesque nightmare. He cannot: open or maintain accounts with Google, Amazon, Apple, or any US company; make hotel reservations (Expedia canceled his booking in France hours after he made it); conduct online commerce, since he can't know if the packaging is American; use any major credit card (Visa, Mastercard, Amex are all American); access normal banking services, even with non-American banks, as banks worldwide close sanctioned accounts; conduct virtually any financial transaction. He describes it as being "economically banned across most of the planet," including in his own country, France, and where he works, the Netherlands. That's the real shocking aspect of this: the Americans are: - punishing a European citizen - for doing his job in Europe - applying laws Europe officially supports - at an institution based in Europe - that Europe helped create and fund and Europe is not only doing essentially nothing to protect him, they're actively enforcing America's sanctions against their own citizen - European banks closing his accounts, European companies refusing him service, European institutions standing by while Washington destroys a European judge's life on European soil. Again, in a normal world, European leaders and citizens should be absolutely outraged about this. But we've so normalized the hollowing out of European sovereignty that the sight of a European citizen being economically executed on European soil for upholding European law is treated, at best, as an unfortunate technical complication in transatlantic relations.
1,458
16,559
1,891
36,775
3,919,337
Watch how reflection attacks are still a thing in 2025 on the livestream where @yaumn_ and I will present how we discovered and analyzed CVE-2025-33073 !
Follow No Hat 2025 research track live streaming at youtube.com/live/f-nIbNcx_SA
5
7
1,204
That's a wrap for Hexacon 2025! We hope that you've enjoyed the event at least as much as we did 🤩 Please take a moment to fill out our satisfaction survey and help us make Hexacon 2026 even better 🔥 Thank you for trusting us year after year 🙏
11
4
92
11,997
The web is a prime target for attackers. Want to refine your intrusion methods? Join our ‘Attacking Web Applications’ training course from 17 to 21 November! ▪️ 5 days of expertise ▪️ 35 hours of lessons, more than 30 exercises ▪️ Java, PHP, Python, ASP.NET... Information & registration via 👇 synacktiv.com/en/offers/trai…
7
17
2,854
Hello ! Rendez-vous ce lundi 29/09 pour le meetup de septembre ! 👾 On parlera CTI avec @4rchib4ld Au programme : - Iranian APT tracking 📍Boulangerie Bar - 29/09 à partir de 19h (Salle du bas) #Lille #Cyber #infosec
1
2
257
Bonjour je tente le tout pour le tout ici on sait jamais. Ma copine recherche un job en consultant GRC à Rennes ou aux alentours. Elle a une bonne expérience et elle vient de finir ses études en alternance. Elle a trouvé un CDI à Paris mais elle tient vraiment à rester à Rennes.
1
6
8
1,734
🧑‍🎓 Boost your offensive Active Directory skills with our Entry & Advanced trainings. Hands-on labs with dozens of machines + latest research from DEFCON, x33fcon & more! Seats are limited, don’t miss out! 🔗 Entry: synacktiv.com/en/offers/trai… 🔗 Advanced: synacktiv.com/en/offers/trai…
11
20
2,973