A deep dive into a protocol-level vulnerability in the Model Context Protocol (MCP) specification where malicious SVG icons delivered via data: URIs can escalate from XSS to full RCE on Electron clients. Reported to Anthropic VDP, closed as Informative — disclosed here with full technical details.

Building a cross-platform GoldenGMSA tool by reverse engineering Windows cryptographic DLLs and implementing NIST SP800-108 KDF from scratch

Complete exploitation of a Windows Active Directory machine highlighting Kerberos delegation RBCD techniques

The Phreaks 2600 team actively participated in the Hack4Values Grand Live Hacking Solidaire 2025, contributing to the security of NGOs and associations

Comprehensive guide to Active Directory exploitation with NetExec at the LeHack 2025 workshop

The Phreaks 2600 team secured 2nd place at the ‘Unlock Your Brain’ Student Bug Bounty, with notable individual performances, including awards for the most creative bug and the best meme.