@Synacktiv – previously @ambionics @LexfoSecurite – blogs: https://xitter.cf/t.co/cLoNdCGPU7 https://xitter.cf/t.co/JVMLjUzTJU https://xitter.cf/t.co/t9a5IcOXSU
Joined July 2018
- Tweets287
- Following708
- Followers4.4K
- Likes1.6K
Pinned Tweet
The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…
Charles Fol retweeted
Still thinking about submitting a talk? Now’s the time.
The CFP for EntryPoint 2027 closes on 20 September 2026.
19–20 March 2027
Le Dernier Étage, Paris
Submit your talk before the deadline:
cfp.entrypoint.fr/entrypoint…
See you on stage!
Charles Fol retweeted
🚨 The #Entrypoint2027 Call For Papers is now open!
Have original offensive security research to share? New techniques, tools, or attack stories ? We want to hear from you.
📅 CFP closes: Sept 20, 2026.
Our review board will be revealed soon.
👉 cfp.entrypoint.fr/entrypoint…
Charles Fol retweeted
The Review Board for Entrypoint 2027 is complete🔒
10 security experts from around the world will be reading your submissions this year !
Reminder: CFP closes on September 20, 2026 at 23:59 UTC
Submit your paper now at entrypoint.fr/
Meet the team below (A-Z)👇
The CFP for #EntryPoint2027 is now open – expect Hexacon, but for red teaming – submit your fancy web, AD, RT research!
🚨 The #Entrypoint2027 Call For Papers is now open!
Have original offensive security research to share? New techniques, tools, or attack stories ? We want to hear from you.
📅 CFP closes: Sept 20, 2026.
Our review board will be revealed soon.
👉 cfp.entrypoint.fr/entrypoint…
Charles Fol retweeted
We've been working on something for a while.
The talks your blue team doesn't want you to see.
🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation.
📍 Paris - Le Dernier Étage
📅 March 19–20, 2027
entrypoint.fr
CFP and additional details coming soon.
Charles Fol retweeted
🔓 On an asset under our continuous monitoring, our pentester @nol_tech turned a SELECT-only PostgreSQL SQLi in Drupal (CVE-2026-9082) into a full RCE when DB role is superuser. Details below 👇
📝 blog.lexfo.fr/drupal-postgre…
🛠️ github.com/ambionics/cve-202…
#Drupal #PostgreSQL #RCE #SQLi
Charles Fol retweeted
La billetterie est ouverte ! N'hésitez pas à prendre aussi le t-shirt imaginé et dessiné par l'équipe BeeRumP 🍻
helloasso.com/associations/b…
Charles Fol retweeted
Our second blog post is out here: bugscale.ch/blog/here-we-go-… ! We managed to install arbitrary APKs on the Samsung Galaxy S25 from an app without install permissions. For this, @SachaKozma did most of the work, but it was great looking into Samsung's cloud gaming component with him
Charles Fol retweeted
MAD Bugs: Finding and Exploiting a 21-Year-Old Vulnerability in PHP
@i0n1c was "the PHP security guy" twenty years ago, so we thought it'd be fun to welcome him with a fresh unserialize UAF.
open.substack.com/pub/calif/…
Charles Fol retweeted
Après 4 ans d'absence, BeeRumP revient ! 🍻
Le concept : des rumps (~10min) et de la bière à volonté, l'occasion de présenter des projets perso avec humour !
La soirée aura lieu dans les locaux d'Epita à Paris, le vendredi 19 juin.
Envoyez vos rumps à [email protected] :)
Charles Fol retweeted
🚨 Critical File Upload to RCE in @NinjaForms File Uploads @WordPress plugin (CVE-2026-0740)!
Deep dive & PoC:
👉blog.lexfo.fr/ninja-forms-up…
🔍By @whattheslime from @Ambionics CTEM solution
🛡️Patch available (v3.3.27) — Update now!
#WordPress #RCE #InfoSec #CyberSecurity #CVE
Charles Fol retweeted
Thanks to the @wordfence team for the bounty! 🙏 A blogpost with detection method and exploitation script will soon be released on blog.lexfo.fr — stay tuned @LexfoSecurite @ambionics 👀
50,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Ninja Forms - File Upload WordPress Plugin
This critical vulnerability (CVE-2026-0740, CVSS 9.8) allows unauthenticated attackers to upload arbitrary files, potentially achieving remote code execution. Update to version 3.3.27.
Thank you to researcher Sélim Lanouar (@whattheslime ), who earned a $2,145.00 bounty via the Wordfence Bug Bounty Program.
wordfence.com/blog/2026/04/5…
Charles Fol retweeted
publishing my sidequest on apache fuzzing:
* git: github.com/0xbigshaq/apatchy
* full docs (apache internals series): pwner.gg/apatchy/
Charles Fol retweeted
🏴 Encore une semaine noire pour les données françaises... Nous venons de publier notre Hebdo Cybercrime du 2 février ! Vous y trouverez les événements liés au cybercrime ayant impacté la France ces sept derniers jours.
noxhunt.me/lhebdo-cybercrime…
#darkweb #stealer #leak #ransomware
Charles Fol retweeted
Dure semaine ! Découvrez un condensé des attaques et fuites de données contre des entités 🇫🇷 ces sept derniers jours :
#DarkWeb #leaks
🏴 Encore une semaine noire pour les données françaises... Nous venons de publier notre Hebdo Cybercrime du 2 février ! Vous y trouverez les événements liés au cybercrime ayant impacté la France ces sept derniers jours.
noxhunt.me/lhebdo-cybercrime…
#darkweb #stealer #leak #ransomware
Charles Fol retweeted
Proud to finally share the write-up of our VMware Workstation escape from P2O Berlin 2025, featuring a generic bypass for Windows LFH mitigations using side-channels.
I hope it will be as fun to read as it was to exploit!
xitter.cf/Synacktiv/status/20157…
At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.
🔍 Full technical write-up 👇
synacktiv.com/en/publication…
Charles Fol retweeted
🚨 RCE in #Livewire (CVE-2025-54068)!
Our specialists uncovered a critical flaw allowing remote code execution without the APP_KEY, exploiting Livewire’s hydration mechanism + PHP’s loose typing.
🔗 Patch now! (v3.6.4+)
synacktiv.com/en/publication…
Charles Fol retweeted
🔔 New research from Lexfo on pre- & post-authentication vulnerabilities in WSO2 products — uncovering bypasses, RCE, SSRF, CSRF, and account-takeover risks. See our detail article → blog.lexfo.fr/wso2.html
#cybersecurity #infosec #offensivesecurity #pentest #WSO2
Charles Fol retweeted
This article by Nicolas Stefanski at Synacktiv provides a high quality technical overview of our hardened_malloc project used in GrapheneOS:
synacktiv.com/en/publication…
It has great coverage of the memory layout, memory tagging integration, slab quarantines and allocation approach.
lightyear just got 6 times faster!
Although I now work at @Synacktiv, I proposed a PR for the tool to support threading and compression, greatly reducing the time required to dump a file.
Dumping the demo /etc/passwd now takes 48s instead of 5m30.
github.com/ambionics/lightye…
