writeups / Aug 2026
Archonyx: A CSS Side Channel to Root
A writeup for Archonyx, a source-available web challenge from Cyber Apocalypse CTF 2026. A CSS-only side channel leaks a bot's session key past a strict CSP, a symlink race in a zip extractor exposes the app's JWT secret, and a mismatch between two zip parsers plants code that Less loads and runs as root.
Read the post
