Checked on 7 September 2026 (Asia/Makassar). Filter: strictly fewer than 20 solves, across all 29 challenges. Three challenges qualify; all are WEB.
This is a research-status note. No matching solution was found in the checked messages, so the root cause and solve method remain unverified.
Search coverage: server-wide exact-name searches for MCCRAB3 (6 results), MESHGATE (4 results), and LARPIN2 (6 results), plus the visible 2026 discussion in #web and #writeups. This does not prove that no solution exists in unindexed attachments, differently named messages, private threads, or elsewhere. Counts are a snapshot.
MESHGATE
| Event Name | TFC CTF 2026 |
| GitHub URL | • (no matching solution repository identified) |
| Challenge Name | MESHGATE |
| Category / Difficulty | WEB / GRANDPA |
| Author | skyv3il |
| Solves / Points | 0 / 500 |
| Solution status | Not found in checked Discord messages |
Attachments
No downloadable challenge attachment was shown on the dashboard.
References
Enterprise file-sync gateway with corporate SSO, local/federated sign-in, and an administrative update center. The challenge says startup takes 2–3 minutes.
tl;dr
- No solution found. The search results contain an announcement, a general mention, a writeup request, and arachne's exclusion list.
- The dashboard shows 0 solves. Do not infer a specific SSO or update-center vulnerability from the description alone.
MCCRAB3
| Event Name | TFC CTF 2026 |
| GitHub URL | • (no matching solution repository identified) |
| Challenge Name | MCCRAB3 |
| Category / Difficulty | WEB / GRANDPA |
| Author | mcsky23 |
| Solves / Points | 5 / 466 |
| Solution status | Not found in checked Discord messages |
Attachments
References
The challenge description adds “also rev”, indicating a reverse-engineering component.
tl;dr
- No posted solution found. Dudcom asks for a solve; milrn tags c-bass in the reply. That is a lead, not a writeup.
- Mcsky23 reported on 5 September that the remote solve worked; the first-blood announcement names Cosmic Bit Flip. Neither message provides the method.
LARPIN2
| Event Name | TFC CTF 2026 |
| GitHub URL | • (no matching solution repository identified) |
| Challenge Name | LARPIN2 |
| Category / Difficulty | WEB / GRANDPA |
| Author | mcsky23 |
| Solves / Points | 7 / 450 |
| Solution status | Not found in checked Discord messages |
Attachments
No downloadable challenge attachment was shown on the dashboard.
References
Challenge description: “we can stay here or we can go larp”.
tl;dr
- No posted LARPIN2 solution found. Several participants ask for one, and W4llz is listed as first blood.
- Phil's WRITEUP.md explicitly identifies the challenge as LarpIn. It should not be used as a LARPIN2 solution.
- ARIADNE'S TAB has a posted solution discussion but 23 solves, so it does not meet this note's threshold.