Posts and notes

CTF posts and shorter research notes, posted as I finish them and ordered newest first. The tags below cut the list down to a single topic.

writeups / Aug 2026

Archonyx: A CSS Side Channel to Root

A writeup for Archonyx, a source-available web challenge from Cyber Apocalypse CTF 2026. A CSS-only side channel leaks a bot's session key past a strict CSP, a symlink race in a zip extractor exposes the app's JWT secret, and a mismatch between two zip parsers plants code that Less loads and runs as root.