anyfun retweeted
[ZDI-25-1039|CVE-2025-12686] (Pwn2Own) Synology BeeStation Plus auth_info Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8; Credit: @Tek_7987 and @_Anyfun (both working @Synacktiv)) zerodayinitiative.com/adviso…
anyfun retweeted
At #Pwn2Own2025, our experts @Tek_7987 & @_Anyfun remotely compromised a Synology Beestation Plus via a pre-auth exploit, leading to full system takeover.
The vuln is now tracked as CVE-2025-12686 🔍
🔗 Full write-up: synacktiv.com/en/publication…
anyfun retweeted
A big shout-out to the @Synacktiv team for their strong performance at the latest #Pwn2Own competition in Cork!
They proudly secured third place overall 👏
Next stop: Tokyo for the upcoming edition 🇯🇵 👀
More details on the targets and participants here ℹ️
zerodayinitiative.com/blog/2…
anyfun retweeted
Congrats to @Tek_7987 and @_Anyfun for landing the first successful entry at #Pwn2OwnCork - exploiting a stack overflow on @Synology BeeStation Plus for $40,000 and 4 Master of Pwn points in the process 💥
Let’s keep pushing 💪
#P2OIreland #Synacktiv
Awesome!
🐝 Third time’s the charm for @Tek_7987 & @_Anyfun from @Synacktiv, who just stung the BeeStation Plus with a successful exploit. They're off to the disclosure room to explain how it happened. #Pwn2Own #P2OIreland
Let’s go!
The schedule for #Pwn2Own Ireland is now live! 53 entries from 25 teams over three days of excitement and pwnage. We'll be updating the schedule with live streaming information as we get them set up. zerodayinitiative.com/blog/2… #P2OIreland
anyfun retweeted
Userland iOS aficionados, I released a simple IDA plugin that should improve your Objective-C experience.
For now it removes ARC function calls in decompiled code (eg objc_retain) and helps listing candidate callers to a method. Check it out at github.com/synacktiv/objc-he…
The "Objective-C helper" IDA plugin presented during the @sth4ck talk "Demystifying Objective-C internals" given by @v1csec is now publicly available on GitHub at github.com/synacktiv/objc-he…
The slides are also available on our website: synacktiv.com/sites/default/…