Welcome back, hackers. We just closed out Holmes CTF 2026, HackTheBox’s all blue defensive event, and it was our strongest showing yet. Here is where we landed and what is next.

From ECHO Club

This month it is OSINT. No decoder ring, just a browser and a careful eye. One account is holding a flag in plain sight.

Clue: the handle above is real. Visit it and read what it points you to — the link in its bio opens a picture that carries more than it shows. What you want sits past the end of the file, written in base‑16. Pull the image apart, not just look at it.

Found it? The flag looks like ECHO{…}. Don’t bring it to a meeting, enter it into your membership dashboard. Sign in, open the CTF tab, and drop the flag into Challenge of the month. The console checks it, records your solve, and lights a square on your wall. One recorded solve per member per month; a wrong guess costs nothing.

This year, and last

Holmes result

167th of 5,637, and 110 of 111 flags. The certificate is archived on the site.

roster · Holmes 2026: 3 competed · next team: 1 seat open

Holmes hands you the wreck of an incident, a disk image or a memory capture or a pile of logs, and asks you to say exactly what happened using only what the evidence supports. Three moments from this run are worth writing down:

[dfir]  Silent Passenger · a car head unit turned into a relay. The data channel only spoke while the command channel was held open, hold the first door and the second one talks.

[ad]   Last Light · a golden ticket and delegation abuse, on top of an event log whose header hid half of its own records until we repaired it.

[team]  The plateau · four flags stuck for fifteen hours, broken when Jazmin quietly cracked two of the hardest on the back end and opened a third.

The Holmes CTF 2026 Write Up

Nine scenarios, scenario by scenario, technique only. How each incident was reconstructed from the evidence it left behind.

Browser Cookie Value Manipulation

When a client side cookie value becomes the attack surface, and the signed server side fix.

Campus Food Access Survey, 4 minutes, anonymous

Run by SGA. We’re collecting real student experience with food on campus, the Peak Cafe and the summer semester. Results go to the college and get posted publicly, whatever they show. No name, no student ID, no email required.

scan or tap →

> run survey > view live results echoclub.org/cafe-survey.html · echoclub.org/cafe-results.html

Member Console v2 is live

The members area got a rebuild: tabbed sections, your CTF & certs achievements tracked automatically, and a Perks tab. Sign in with your club email, the code is the whole login.

Tavily research credits for members

Provided by our sponsors and partners so students can build in AI infrastructure and agent tool development: 4,000 free research API credits every month to develop AI tools. Learn the ropes with the guided builds at echoclub.org/projects. Claim your code from the Perks tab, and if you need a fresh API key, reach out to an ECHO officer.

ECHO · Ethical Cybersecurity Hackers Ops

Digital caffeine before the digital things.

legacy@echoclub.org  ·  echoclub.org  ·  LinkedIn

· end of transmission ·

Published to the ECHO newsletter archive, read every issue. Members get the live edition first, in their inbox.