2026.09.19sea of theft — Flag of YoreAn unused sprite renders to a screenshot of the game in dev mode, and the version string in those pixels names a release the bucket never cleaned up.Misc2026.09.19ratatouilleA 70-byte .recipe section holds the flag, and the nine anti-analysis environment checks are not a defence — they are the key material.Reversing2026.09.19hollowdexJNI_OnLoad rewrites verifyFlag's bytecode through /proc/self/mem at load time; the shipped dex is a decoy hiding a 3-round Feistel.250ptReversing2026.09.19bitdebit2One bit flip into IO_list_all, a seccomp filter that never checks the arch, and a flag read out through connection-drop timing.Pwn2026.09.19arbitrary-funds-sweepThe vault trusts an un-aliased L1 address that was never deployed on L2, and the same permissionless CREATE2 factory exists on both chains.180ptBlockchain2026.09.19legacyPython 2 parses a 2 MB integer literal in quadratic time, so the backup overruns its timeout and the SIGQUIT trap gcores the root password into /tmp.Misc2026.09.19aethergateEndpoints are validated per list element but stored space-joined and split again into argv, so one space injects curl options and file:// reads /dev/vdb as root.460ptWeb2026.09.19solstice-9Three bench captures each hide the real component next to a more attractive decoy; assembling the 96-byte fixture and inverting boarddiag's lane routing yields the Ed25519 private key.450ptMisc