Autonomous Ethical Hacking
Portugal
Joined February 2022
- Tweets816
- Following93
- Followers2.2K
- Likes234
On July 7, Claudia Buch, Chair of the ECB's Supervisory Board, signed a letter ordering every significant eurozone bank to produce an action plan against AI-class cyberattacks by October 31.
To meet the ECB's mandate, banks could incorporate Ethiack Zero:
🟢 Tracking emerging vulnerabilities from the first public signal and testing exploitability against isolated deployments before a CVE is even minted.
🟢 Cuts Time to Validate (TTV) down to minutes, replacing theoretical vulnerability lists with proof of what attackers can actually exploit right now.
Explore it now ↓
Get ready for the Ethiack SOHO Smashup at @BSidesLisbon on Friday, October 30!
Modelled on the SOHO Smashup category at Pwn2Own, two pieces of real, aging office equipment will be placed on the floor:
- One office router
- One printer
Participants attack them live in the lounge area in front of an audience.
Get creative on the best ways to exploit these devices (AI is allowed!). We accept submissions for any kind of vulnerability, just visit us in the lounge area to schedule your attempt.
Goodies will be awarded for successful exploitation attempts.
More details below ↓
When the PHP vulnerability (CVE-2026-109618 / CVE-2026-109619) surfaced, Ethiack Zero flagged it early, and our team reached out to customers to check their exposure and apply precautions right away.
A security team told us what that made possible: quick triage, clear findings, continuous support.
Explore Ethiack Zero↓
Arbitrary file write is often treated as an "almost critical" bug class: interesting and dangerous, but hard to prove impact when you can't drop a web shell in an obvious location.
On Oct 29 at @BsidesLisbon, our researchers Bruno Mendes and Rafael Castilho present a new methodology for popping shells across popular languages and frameworks, with minimal information about the target. Built for bug bounty engagements.
Who's heading to Bsides Lisbon?
🚨CVE-2026-111497 (Node2Shell): a critical flaw in Google's Brotli decoder may let remote attackers execute code on servers that decompress untrusted Brotli data.
Affects Node.js and Bun. Patch now: Node.js 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4.
ethiack.com/info-hub/researc…
🟢 Last call to join the Speed Pwning bracket-based CTF at @BsidesLisbon on Thursday, October 29!
Two players go head-to-head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances.
Check out all the details below ↓
Attackers don’t wait for the CVE. Neither does Ethiack Zero, now live for 3 days.
Here’s why we built it 👇
ethiack.com/info-hub/researc…
If you haven't checked out zerodayclock.com lately, go take a look. It tracks zero-day exploitation pressure, showing CVEs exploited (KEV) upon public release surging to about 154% compared to the same quarter last year.
Attackers often exploit new vulnerabilities before defenders can react, sometimes before the vulnerability even gets a public CVE ID.
The Zero Day Clock documents the problem. Ethiack Zero is the live tracker built to keep you ahead of it.
Explore it live ↓
zero.ethiack.com/
Attackers often exploit new vulnerabilities before defenders can react. The clock runs out before the CVE even drops.
In the first half of 2026, 487 vulnerabilities were listed as exploited. For 137 of them (>25%), the exploitation record existed on or before the day the CVE was published.
We built Ethiack Zero to track emerging vulnerabilities from the first public signal (a patch commit, a GitHub advisory, a researcher's post) and validate actual exploitability before the CVE is even minted.
Explore Ethiack Zero ↓
zero.ethiack.com/
Two critical RCE flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Every PHP stack is in scope. Fixes ship today at 14:00 UTC.
Early signal flagged by Ethiack Zero. Ethiack now identifies the PHP runtimes you expose and flags EOL ones.
ethiack.com/info-hub/researc…
Ethiack Zero public page for:
- CVE-2026-109619: zero.ethiack.com/e/CVE-2026-…
- CVE-2026-109618: zero.ethiack.com/e/CVE-2026-…
Yesterday we asked: what if you could turn back the clock?
We can’t, but we can see it sooner.
Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing.
zero.ethiack.com
Manual retesting of every AI-generated code change is not a scalable security strategy in 2026.
It creates gaps between the speed of releases, and attackers don’t wait for your next pentest.
Our AI-powered continuous testing helps teams reassess their exposure as systems change at the same speed. Human experts remain essential for interpreting risk and deciding what to do next.
Continuous AI-powered security testing, with human expertise guiding what happens next.
