Autonomous Ethical Hacking
Portugal
Joined February 2022
- Tweets806
- Following93
- Followers2.2K
- Likes232
Attackers don’t wait for the CVE. Neither does Ethiack Zero, now live for 3 days.
Here’s why we built it 👇
ethiack.com/info-hub/researc…
If you haven't checked out zerodayclock.com lately, go take a look. It tracks zero-day exploitation pressure, showing CVEs exploited (KEV) upon public release surging to about 154% compared to the same quarter last year.
Attackers often exploit new vulnerabilities before defenders can react, sometimes before the vulnerability even gets a public CVE ID.
The Zero Day Clock documents the problem. Ethiack Zero is the live tracker built to keep you ahead of it.
Explore it live ↓
zero.ethiack.com/
Attackers often exploit new vulnerabilities before defenders can react. The clock runs out before the CVE even drops.
In the first half of 2026, 487 vulnerabilities were listed as exploited. For 137 of them (>25%), the exploitation record existed on or before the day the CVE was published.
We built Ethiack Zero to track emerging vulnerabilities from the first public signal (a patch commit, a GitHub advisory, a researcher's post) and validate actual exploitability before the CVE is even minted.
Explore Ethiack Zero ↓
zero.ethiack.com/
Two critical RCE flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Every PHP stack is in scope. Fixes ship today at 14:00 UTC.
Early signal flagged by Ethiack Zero. Ethiack now identifies the PHP runtimes you expose and flags EOL ones.
ethiack.com/info-hub/researc…
Ethiack Zero public page for:
- CVE-2026-109619: zero.ethiack.com/e/CVE-2026-…
- CVE-2026-109618: zero.ethiack.com/e/CVE-2026-…
Yesterday we asked: what if you could turn back the clock?
We can’t, but we can see it sooner.
Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing.
zero.ethiack.com
Manual retesting of every AI-generated code change is not a scalable security strategy in 2026.
It creates gaps between the speed of releases, and attackers don’t wait for your next pentest.
Our AI-powered continuous testing helps teams reassess their exposure as systems change at the same speed. Human experts remain essential for interpreting risk and deciding what to do next.
Continuous AI-powered security testing, with human expertise guiding what happens next.
Testing an AI pentesting agent only once means you're only seeing half the picture of how it actually performs. 👀
Because LLMs are probabilistic, outputs change from run to run. In agentic pentesting, small shifts in early exploration multiply, leading to entirely different results by the end of an engagement.
A single run tells you almost nothing. But running dozens of end-to-end tests is expensive, so most teams test only 2 or 3 times. In this low-replication zone, standard p-value testing stops being reliable: with so few runs, a non-significant result often just means your sample size is too small to detect a real difference, not that the upgrade failed.
We built Ethibench to test AI pentesting agents properly, with the replication these systems actually need.
Find out more in the repo👇
Think you are the fastest hacker?
Prove your skills in the CTF at @BsidesLisbon 2026 run by Ethiack
For this edition, we are bringing: Speed Pwning CTF
Two players go head to head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Losers are eliminated.
- 8 participants
- Single-elimination bracket
- 30-minute matches
- No qualifiers
- Brackets are drawn at random
Find all the details and register below↓
Ethiack is running the CTF for the second year at @BSidesLisbon 2026.
For this edition we have created two experimental competitions split between the two days of the conference (Oct 29-30).
First up a Speed Pwning bracket-based CTF, fast, head-to-head, human-only. Following we will host the first Ethiack SOHO Smashup, a home office hardware exploitation event in the spirit of Pwn2Own's SOHO category, where AI-assisted exploitation is explicitly encouraged.
One competition measures raw individual skill under time pressure; the other measures what hackers can achieve against real consumer hardware with AI-assisted tooling.
Read all the details below ↓
Ethiack is running the CTF for the second year in a row at @BSidesLisbon 2026.
This October 29, we're bringing a new format: Speed Pwning CTF.
Two players go head to head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Losers are eliminated.
- Single-elimination bracket
- 30-minute matches
- 8 participants
- No qualifiers — entry is by registration, first come first served
- Brackets are drawn at random
Rules? Simple: No AI. At all.
There are three categories in play: pwn, misc and web.
Players decide which category they'll play before each match through a veto process, each player can veto one category. The remaining category will dictate the challenge played by both players during the match
Want to participate?
Register below ↓
Participants must have a BSides Lisbon 2026 ticket to be eligible.
Your team prevents disasters every day, but when you report to the board, their response is always the same:
“Great job keeping us safe. Now show us the numbers: how much did we spend, and how can we spend less?”
They hear terms like “critical” and “CVE,” but what they see is a line item. You’re speaking in risks; they’re thinking in returns.
The fix is Annualized Loss Expectancy (ALE): the realistic damage a vulnerability could cause if exploited. It turns security from a black box into a business decision:
"This risk costs us €4,875/year to ignore."
"Fixing it now saves €24K over five years."
"Here’s how it compares to other risks we’re tracking."
Turn the conversation from avoiding disasters to optimizing spend and protecting revenue. That’s a language every board understands.
How much did we protect? Over €93 million for our customers in 2025 alone and in 2026, that number is accelerating fast.
Contact us to help you calculate this!
Hackian, our agentic AI pentester, operates continuously, self-learns, and is built to think, act, and adapt like a human ethical hacker.
In tests against PortSwigger labs, Hackian solved them autonomously with a >75% success rate. Traditional DAST scanners tested on the same labs scored just 1-5%.
Static tools report what might be vulnerable. Hackian proves what is exploitable.
