A default-installed Windows 11 endpoint in 2026 has eight major attack surfaces enabled out of the box that should not be: NTLM authentication, LM/NTLMv1 fallback in many cases, unsigned-driver execution, LSASS access from non-protected processes, BitLocker without PIN, Office macros from internet sources, SmartScreen passable via mark-of-the-web bypass, and PowerShell without script-block logging. This Windows 11 enterprise hardening guide for 2026 is the consolidated 10-phase rollout that closes every one of those gaps — aligned with the CIS Microsoft Windows 11 Enterprise Benchmark, Microsoft’s Security Baselines, and the operational realities of running a multi-thousand-endpoint fleet under Intune, Group Policy, or both. ...

NTLM has been on borrowed time for two decades, and Microsoft made it official: as of late 2023 Microsoft formally announced that NTLM is deprecated, with Kerberos and the new Negotiate-based authentication taking over. Windows 11 24H2 and Windows Server 2025 ship with NTLMv1 fully removed, and Microsoft strongly recommends auditing and disabling NTLMv2 wherever Kerberos can take over. This guide walks through how to disable NTLM in Windows safely — auditing first, staging the rollout, and rolling back cleanly if something breaks. ...

Platform TJCTF 2026 (Thomas Jefferson CTF) Difficulty Easy → Hard OS Mixed: Linux, macOS ARM64, WebAssembly, Network captures Tags JWT crafting, SSRF via URL normalization, Zip Slip, RSA parity oracle, ECDSA timing/Minerva, invalid-curve attacks, Chebyshev matrix exponentiation, ReDoS as side channel, pickle exploitation, PCK parsing, polyglot files, RTP LSB steganography TJCTF 2026 was the kind of multi-day event that rewards breadth — twenty-one challenges spread across web, reverse engineering, cryptography, forensics, and misc, with no single technique cracking more than two boxes. This writeup is the consolidated solve log: one paragraph of prompt + trick + solution per challenge, the actual flag, and the moments worth quoting verbatim. ...

Platform Midnight Sun CTF 2026 Quals Difficulty Trivial OS RISC-V 64-bit Linux Tags strings(1), reading the rules riscal is the kind of challenge that gets harder the more you respect the category label. “Reverse engineering” + “RISC-V” primes you to spin up a cross-disassembler, set up a qemu-user static binary, learn the RV64 calling convention, and start manually annotating decompilation. The intended solve is strings. ...

Platform Midnight Sun CTF 2026 Quals Difficulty Hard OS Linux x86-64 Tags Templated binary RE, radare2 scripting, automated static analysis empols is the kind of challenge that punishes you for trying to solve binaries by hand. The server hands you twenty fresh, randomly-generated x86-64 ELFs in one session and demands the validating input string for each — and you almost certainly cannot reverse-engineer twenty unique binaries fast enough to fit inside the session timeout. The intended path is to recognise that the binaries are generated from a small set of templates, then write a static-analysis engine that detects the template and extracts the answer from disassembly. ...

Platform THCON 2026 (Toulouse Hacking Convention) Difficulty Medium OS Steganography Tags Frequency analysis, binary encoding, PNG carving, LSB steganography PNG3D is the steganography challenge that rewards the simplest possible recon move — frequency analysis — and punishes anyone who tries fancy stego tools first. The challenge file is ~40 MB of UTF-8 text that looks like noise; the trick is to notice that two specific characters make up nearly all of it, in roughly equal numbers, and that’s a binary encoding screaming to be decoded. ...

Platform THCON 2026 (Toulouse Hacking Convention) Difficulty Easy OS OSINT Tags Reading prompts literally, CTF platform recon Most “find the hidden flag on a webpage” challenges teach you to look harder. This one teaches the opposite — that the most-obvious destination in the prompt is a decoy, and the answer is whatever a literal reading of the wording actually points at. The trick is recognising the misdirection before sinking thirty minutes into the wrong target. ...

Platform THCON 2026 (Toulouse Hacking Convention) Difficulty Easy OS OSINT Tags Social media OSINT, leetspeak THCON’s Socials is the kind of warm-up OSINT challenge that’s not about tooling — it’s about reading the prompt twice and noticing the CTF authors have done something cute with their social media presence. The flag is split between two posts on two platforms, with each post hiding the other half behind an ellipsis. Visit both, stitch the halves, done. ...

Platform BKISC CTF 2026 Difficulty Hard OS Android (arm64-v8a) Points 250 Tags APK extraction, AES-GCM, ELF patching, qemu-aarch64, NDK basic_string, meet-in-the-middle Boring APK was the 250-point reverse engineering challenge of BKISC CTF 2026. The hook is the title’s bait — Android is “boring” until you realise the flag check has been moved out of the Java/Kotlin layer into a native library, the assets it depends on are AES-GCM-encrypted, and the check itself is a 27-step graph walk with three running state words whose final values are all that the verifier compares. None of those stages is hard in isolation; stacking them is what makes the challenge. ...

Platform BKISC CTF 2026 Difficulty Easy OS Encoding Points 50 Tags JDK source reading, custom Base64 alphabet, UTF-16 BE Cryptografie is a 50-point crypto challenge from BKISC CTF 2026 that hangs off a single, very specific hint: FileSystemPreferences.dirName(). If you’ve never had to look at the OpenJDK source before, this challenge is a tour of an internal Base64-like helper that almost nobody outside the JDK uses — and the decoder only takes about ten lines once you know where to look. ...