CTF Cyber&Spice 2026

With more than 80 participants and around fifty challenges, the Cyber&Spice CTF delivered a comprehensive experience combining technical depth, immersion and collaboration.

A day immersed in the SPICY Intelligence Agency

The Cyber&Spice CTF took place as a full-day immersion in the “SPICY Intelligence Agency”, offering over 50 technical challenges spanning multiple areas of cybersecurity.

The event was designed for participants ranging from beginner to intermediate level, with also some more advanced challenges, allowing everyone to progress and test their skills in a competitive yet accessible environment.

The challenges covered a broad range of disciplines:

• Cryptography: decrypting messages and analysing cryptographic systems
• Web: exploitation of application vulnerabilities
• Forensics: analysis of files, images, networks or systems
• Reverse: analysis of binaries, executables or applications
• System / Pwn: vulnerability exploitation, privilege escalation and bypassing protections
• OSINT: investigation using open-source information
• Misc: varied challenges requiring logic and creativity

The external team of challenge makers RXTRY! (composed of former students from the Master’s Cybersecurity with CISO specialisation at ISTIC) spiced up the event by designing an OSINT challenge track. The scenario featured a range of typical OSINT CTF formats: social media research, GEOINT, document analysis and interpretation, and the use of specialised websites to correlate information. To further immerse players in the investigation, members of RXTRY! took on the role of the Open Source Intelligence Service of the SPICY AGENCY. Their mission was to coordinate search operations, systematically receive players needing assistance, and test the skills of those who became stuck after three unsuccessful attempts.

An edition marked by diversity of profiles and strong participant engagement

Organised by the Épicé Students’ Union of CyberSchool and designed by students from the cybersecurity master’s programmes at ISTIC, this educational project was supported by committed partners: CyberSchool, EIT Digital (Spectro project), and the Pôle d’Excellence Cyber (PEC).

The Cyber&Spice CTF brought together students from the IUT of Saint-Malo, CentraleSupélec, ISTIC (University of Rennes), and INSA Rennes. This diversity enabled participants from a wide range of academic backgrounds to come together in an environment that was both competitive and educational.

After a full day of intense challenges, the top-performing teams were awarded prizes at the end of the event:

• 1st: rm -rf Lannion
• 2nd: qu35t10n0xd1ff1c1L
• 3rd: Mal’Win

Congratulations to the teams on the podium, and more broadly to all participants. A big well done also to the entire organising team for their commitment and for the success of this edition, which proved to be a true learning ground.