Synology has addressed a critical-severity remote code execution (RCE) vulnerability in BeeStation products that was demonstrated at the recent Pwn2Own hacking competition.
Synology fixes BeeStation zero-days demoed at Pwn2Own Ireland
Synology has addressed a critical-severity remote code execution (RCE) vulnerability in BeeStation products that was demonstrated at the recent Pwn2Own hacking competition.
www.bleepingcomputer.com
November 11, 2025 at 10:35 PM
Synology has addressed a critical-severity remote code execution (RCE) vulnerability in BeeStation products that was demonstrated at the recent Pwn2Own hacking competition.
This was pretty fun to exploit! Even though I didn't manage to pwn the version used for Pwn2Own Berlin, I still learned a ton about LLMs. Maybe I can get my revenge in future competitions 🤞
From bit flip to RCE in Ollama! 🦙
Our latest blog post explains how a file parsing bug led to an interesting out-of-bounds write primitive. Learn how it could have been exploited in Ollama, a tool to run LLMs locally:
www.sonarsource.com/blog/ollama-...
#security #vulnerability #llm #ai
Our latest blog post explains how a file parsing bug led to an interesting out-of-bounds write primitive. Learn how it could have been exploited in Ollama, a tool to run LLMs locally:
www.sonarsource.com/blog/ollama-...
#security #vulnerability #llm #ai
www.sonarsource.com
November 4, 2025 at 5:45 PM
This was pretty fun to exploit! Even though I didn't manage to pwn the version used for Pwn2Own Berlin, I still learned a ton about LLMs. Maybe I can get my revenge in future competitions 🤞
A big shout-out to the #Synacktiv team for their strong performance at the latest #Pwn2Own competition in Cork!
They proudly secured third place overall 👏
Next stop: Tokyo for the upcoming edition 🇯🇵 👀
More details on the targets and participants here ℹ️
www.zerodayinitiative.com/blog/2025/20...
They proudly secured third place overall 👏
Next stop: Tokyo for the upcoming edition 🇯🇵 👀
More details on the targets and participants here ℹ️
www.zerodayinitiative.com/blog/2025/20...
October 31, 2025 at 3:54 PM
A big shout-out to the #Synacktiv team for their strong performance at the latest #Pwn2Own competition in Cork!
They proudly secured third place overall 👏
Next stop: Tokyo for the upcoming edition 🇯🇵 👀
More details on the targets and participants here ℹ️
www.zerodayinitiative.com/blog/2025/20...
They proudly secured third place overall 👏
Next stop: Tokyo for the upcoming edition 🇯🇵 👀
More details on the targets and participants here ℹ️
www.zerodayinitiative.com/blog/2025/20...
The Pwn2Own Ireland 2025 hacking competition has ended with security researchers collecting $1,024,750 in cash awards after exploiting 73 zero-day vulnerabilities.
Hackers earn $1,024,750 for 73 zero-days at Pwn2Own Ireland
The Pwn2Own Ireland 2025 hacking competition has ended with security researchers collecting $1,024,750 in cash awards after exploiting 73 zero-day vulnerabilities.
www.bleepingcomputer.com
October 24, 2025 at 6:37 AM
The Pwn2Own Ireland 2025 hacking competition has ended with security researchers collecting $1,024,750 in cash awards after exploiting 73 zero-day vulnerabilities.
-Lanscope zero-day gets a patch
-More AI browser prompt injection bugs
-AI sidebar spoofing
-New Shadow Escape attack
-Smithery bug exposes 3k MCP serves
-Cloudflare CIRCL vulnerability
-Netty vulnerability
-FIA portal exposes F1 driver data
-Pwn2Own Ireland results
-DevSecCon and EkoParty videos
-More AI browser prompt injection bugs
-AI sidebar spoofing
-New Shadow Escape attack
-Smithery bug exposes 3k MCP serves
-Cloudflare CIRCL vulnerability
-Netty vulnerability
-FIA portal exposes F1 driver data
-Pwn2Own Ireland results
-DevSecCon and EkoParty videos
October 24, 2025 at 7:33 AM
-Lanscope zero-day gets a patch
-More AI browser prompt injection bugs
-AI sidebar spoofing
-New Shadow Escape attack
-Smithery bug exposes 3k MCP serves
-Cloudflare CIRCL vulnerability
-Netty vulnerability
-FIA portal exposes F1 driver data
-Pwn2Own Ireland results
-DevSecCon and EkoParty videos
-More AI browser prompt injection bugs
-AI sidebar spoofing
-New Shadow Escape attack
-Smithery bug exposes 3k MCP serves
-Cloudflare CIRCL vulnerability
-Netty vulnerability
-FIA portal exposes F1 driver data
-Pwn2Own Ireland results
-DevSecCon and EkoParty videos
Latest on @darkreading.bsky.social
The Edge: Pwn2Own Underscores Secure Development Concerns https://zpr.io/kLkLNX3H2i3g #DRTheEdge #darkreading #cybersecurity
The Edge: Pwn2Own Underscores Secure Development Concerns https://zpr.io/kLkLNX3H2i3g #DRTheEdge #darkreading #cybersecurity
Pwn2Own Underscores Secure Development Concerns
Pwn2Own Ireland kicked off on Oct. 21 and what researchers found continued to highlight how secure development practices are lacking across the industry.
zpr.io
October 23, 2025 at 12:36 PM
Latest on @darkreading.bsky.social
The Edge: Pwn2Own Underscores Secure Development Concerns https://zpr.io/kLkLNX3H2i3g #DRTheEdge #darkreading #cybersecurity
The Edge: Pwn2Own Underscores Secure Development Concerns https://zpr.io/kLkLNX3H2i3g #DRTheEdge #darkreading #cybersecurity
Confirmed (with style!) - Interrupt Labs combined a path traversal and an untrusted search path bug to exploit the Lexmark CX532adwe. They got a reverse shell and loaded Doom on the LCD. We couldn't play it though :-[ Still awesome to see. #Pwn2Own
October 23, 2025 at 2:07 PM
Confirmed (with style!) - Interrupt Labs combined a path traversal and an untrusted search path bug to exploit the Lexmark CX532adwe. They got a reverse shell and loaded Doom on the LCD. We couldn't play it though :-[ Still awesome to see. #Pwn2Own
Impressive work from our team today at #Pwn2Own!
@mtalbi.bsky.social and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device!
Great demonstration of Synacktiv’s offensive expertise 👏
Come on 🔥
@mtalbi.bsky.social and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device!
Great demonstration of Synacktiv’s offensive expertise 👏
Come on 🔥
October 22, 2025 at 3:36 PM
Impressive work from our team today at #Pwn2Own!
@mtalbi.bsky.social and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device!
Great demonstration of Synacktiv’s offensive expertise 👏
Come on 🔥
@mtalbi.bsky.social and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device!
Great demonstration of Synacktiv’s offensive expertise 👏
Come on 🔥
Confirmed! Chris Anastasio of Team Cluck used a single type confusion bug to exploit the Lexmark CX532adwe printer. He earns himself $20,000 and 2 Master of Pwn points. #Pwn2Own
October 23, 2025 at 10:51 AM
Confirmed! Chris Anastasio of Team Cluck used a single type confusion bug to exploit the Lexmark CX532adwe printer. He earns himself $20,000 and 2 Master of Pwn points. #Pwn2Own
We have another collision. Team Viettel used two bugs to exploit the Lexmark CX532adwe. While their heap based buffer over was unique, the other bug has been seen earlier in the contest. They still earn $7,500 and 1.5 Master of Pwn points. #Pwn2Own
October 23, 2025 at 1:52 PM
We have another collision. Team Viettel used two bugs to exploit the Lexmark CX532adwe. While their heap based buffer over was unique, the other bug has been seen earlier in the contest. They still earn $7,500 and 1.5 Master of Pwn points. #Pwn2Own
📦 Another storage breach! Sina Kheirkhah of Summoning Team just unlocked the QNAP TS-453E at #Pwn2Own. It's his final attempt of the contest, and he ends on a high note. He's off to the disclosure room once more to provide the details. #P2OIreland
October 23, 2025 at 11:13 AM
📦 Another storage breach! Sina Kheirkhah of Summoning Team just unlocked the QNAP TS-453E at #Pwn2Own. It's his final attempt of the contest, and he ends on a high note. He's off to the disclosure room once more to provide the details. #P2OIreland
Confirmed (w/ a dupe)! Yannik Marchand (kinnay) used 3 bugs -incl. an Incorrect Implementation of Authentication Algorithm- to exploit the Phillips Hue Bridge but 2 bugs collided w/ bugs seen previously in the contest. He still earns $13,333 & 2.67 Master of Pwn points. Not bad for his 1st #Pwn2Own
October 23, 2025 at 11:44 AM
Confirmed (w/ a dupe)! Yannik Marchand (kinnay) used 3 bugs -incl. an Incorrect Implementation of Authentication Algorithm- to exploit the Phillips Hue Bridge but 2 bugs collided w/ bugs seen previously in the contest. He still earns $13,333 & 2.67 Master of Pwn points. Not bad for his 1st #Pwn2Own
Confirmed! ChatGPT helped Team ANHTUD as they used 3 bugs - 1 collision, 1 unique SSRF and 1 cleartext storage of sensitive information - to exploit Home Automation Green. They finished with just 45 seconds remaining. Their work earns them $16,750 and 3.75 Master of Pwn points. #Pwn2Own
October 22, 2025 at 5:33 PM
Confirmed! ChatGPT helped Team ANHTUD as they used 3 bugs - 1 collision, 1 unique SSRF and 1 cleartext storage of sensitive information - to exploit Home Automation Green. They finished with just 45 seconds remaining. Their work earns them $16,750 and 3.75 Master of Pwn points. #Pwn2Own
🎉Success. Our #Pwn2own team combined #zeroday bugs to #exploit @home-assistant.io green which earned them $20'000 and 4 pts. Congratz to @bcyrill.bsky.social Emanuele, Lukasz @muukong.bsky.social and @yvesbieri.bsky.social.
Respect to @stephenfewer.bsky.social and the Summoning Team for the wins.
Respect to @stephenfewer.bsky.social and the Summoning Team for the wins.
October 22, 2025 at 7:57 AM
🎉Success. Our #Pwn2own team combined #zeroday bugs to #exploit @home-assistant.io green which earned them $20'000 and 4 pts. Congratz to @bcyrill.bsky.social Emanuele, Lukasz @muukong.bsky.social and @yvesbieri.bsky.social.
Respect to @stephenfewer.bsky.social and the Summoning Team for the wins.
Respect to @stephenfewer.bsky.social and the Summoning Team for the wins.
Confirmed! The team from @synacktiv.com used a buffer overflow to exploit the Phillips Hue Bridge. Their unique bug earns them $20,000 and 4 Master of Pwn points. #Pwn2Own
October 22, 2025 at 5:11 PM
Confirmed! The team from @synacktiv.com used a buffer overflow to exploit the Phillips Hue Bridge. Their unique bug earns them $20,000 and 4 Master of Pwn points. #Pwn2Own
Confirmed! The PHP Hooligans used an OOB Write bug to exploit the Canon imageCLASS MF654Cdw printer. Their fifth round win earns them $10,000 and 2 Master of Pwn points. #Pwn2Own
October 22, 2025 at 10:15 AM
Confirmed! The PHP Hooligans used an OOB Write bug to exploit the Canon imageCLASS MF654Cdw printer. Their fifth round win earns them $10,000 and 2 Master of Pwn points. #Pwn2Own
📢 Confirmed! Sina Kheirkhah used a pair of bugs to get code execution on the @Synology DS925+ NAS. He earns himself $40,000 and 4 Master of Pwn points. #Pwn2Own #P2OIreland
October 21, 2025 at 12:21 PM
📢 Confirmed! Sina Kheirkhah used a pair of bugs to get code execution on the @Synology DS925+ NAS. He earns himself $40,000 and 4 Master of Pwn points. #Pwn2Own #P2OIreland
✨Confirmed! Hank Chen of InnoEdge Labs used an auth bypass and an OOB write to exploit the Phillips Hue Bridge. Their second round win nets them $20,000 and 4 Master of Pwn points. #Pwn2Own
October 21, 2025 at 3:59 PM
✨Confirmed! Hank Chen of InnoEdge Labs used an auth bypass and an OOB write to exploit the Phillips Hue Bridge. Their second round win nets them $20,000 and 4 Master of Pwn points. #Pwn2Own
Confirmed! Team DDOS (@kiddo_pwn & @freddo_1337) used an octo-symphony of 8(!) different bugs to complete their SOHO Smashup of the QNAP Qhora-322 + TS-453E. They earn themselves $100,000 and 10 Master of Pwn points. #Pwn2Own #P2OIreland
October 21, 2025 at 10:09 AM
Confirmed! Team DDOS (@kiddo_pwn & @freddo_1337) used an octo-symphony of 8(!) different bugs to complete their SOHO Smashup of the QNAP Qhora-322 + TS-453E. They earn themselves $100,000 and 10 Master of Pwn points. #Pwn2Own #P2OIreland
📢 Confirmed! Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security combined an arbitrary file write & cleartext transmission of sensitive data to exploit the @home_assistant Green. Their third round win earns them $20,000 and 4 Master of Pwn points. #Pwn2Own
October 21, 2025 at 4:27 PM
📢 Confirmed! Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security combined an arbitrary file write & cleartext transmission of sensitive data to exploit the @home_assistant Green. Their third round win earns them $20,000 and 4 Master of Pwn points. #Pwn2Own
@thezdi.bsky.social #Pwn2own schedule is out. Compass folks have been drawn 3rd to exploit the @home-assistant.io Green for $40,000. 🤞for a #bounty today Tuesday Oct 21st, 5pm (Swiss time). #ethicalhacking
Schedule www.zerodayinitiative.com/blog/2025/20...
Schedule www.zerodayinitiative.com/blog/2025/20...
Zero Day Initiative — Pwn2Own Ireland 2025: The Full Schedule
Welcome to Pwn2Own Ireland 2025! We have some amazing spooky entries for this year’s contest, and a potential of up to $2,000,000 - including our largest ever single prize for a 0-click in WhatsApp fo...
www.zerodayinitiative.com
October 21, 2025 at 6:13 AM
@thezdi.bsky.social #Pwn2own schedule is out. Compass folks have been drawn 3rd to exploit the @home-assistant.io Green for $40,000. 🤞for a #bounty today Tuesday Oct 21st, 5pm (Swiss time). #ethicalhacking
Schedule www.zerodayinitiative.com/blog/2025/20...
Schedule www.zerodayinitiative.com/blog/2025/20...
📢 Confirmed - @Tek_7987 & @_Anyfun (@Synacktiv) used a stack overflow to achieve rootlevel code execution on the @Synology BeeStation Plus. They earn $40,000 and 4 Master of Pwn points in the process. #Pwn2Own #P2OIreland
October 21, 2025 at 9:51 AM
📢 Confirmed - @Tek_7987 & @_Anyfun (@Synacktiv) used a stack overflow to achieve rootlevel code execution on the @Synology BeeStation Plus. They earn $40,000 and 4 Master of Pwn points in the process. #Pwn2Own #P2OIreland
The Master of Pwn trophy for #Pwn2Own Ireland has arrived. Quoth this raven - hack some more. #P2OIreland
October 16, 2025 at 4:46 PM
The Master of Pwn trophy for #Pwn2Own Ireland has arrived. Quoth this raven - hack some more. #P2OIreland