ABOUT THE EVENT An international online Capture The Flag competition from CyberHX and Team CyberXoX. Round 01, the 12-hour Qualifier, runs on 18 September 2026 from 10:00 AM to 10:00 PM IST (04:30 to 16:30 UTC). The top teams return for the 12-hour Grand Finale on 25 to 26 September 2026. Jeopardy format, teams of 1 to 4, free entry, open worldwide, challenges from Easy to Expert. Unstop registration closes on 15 September 2026. EVENT SNAPSHOT • Round 01,
Qualifier: 18 September 2026, 10:00 AM to 10:00 PM IST (04:30 to 16:30 UTC), 12 hours • Round 02,
Grand Finale: 25 to 26 September 2026, 12 hours, start time to be announced •
Winners announced: 26 September 2026 •
Mode: Online, played on ctf.cyberhx.com •
Format: Jeopardy. Two separate 12-hour rounds, 24 hours of competition in total •
Team size: 1 to 4 members. Solo entries welcome •
Entry fee: None •
Challenge domains: Web Exploitation, Cryptography, Reverse Engineering, Digital Forensics, OSINT, Binary Exploitation, Miscellaneous •
Difficulty: Easy, Medium, Hard, Expert •
Eligibility: Open to anyone, anywhere, at any skill level • Registration on
Unstop closes: 17 September 2026, 12:00 AM IST •
Listed on CTFtime: ctftime.org/event/3346 WHAT IS NULL ORIGIN Null Origin is a Jeopardy-style CTF written by active practitioners: hand-crafted scenarios modelled on real vulnerabilities, not contrived puzzles. It runs on CyberHX's own security-hardened competition platform, the same platform that hosted ZeroDay Heist 2026, a CTFtime-rated event with 85 competing teams. CyberHX is a cybersecurity community based in Bhopal, India. Team CyberXoX, the organising team, is a rated CTFtime team that competes internationally. Null Origin is their first two-round international edition. THE MISSION Every challenge hides a flag. Your team finds it, submits it on the platform and earns the points.
Scoring is per team: each challenge counts once, whoever on the team solves it. Ties break on the earliest solve. A live scoreboard tracks every team through the round. Hints exist and cost points, so use them deliberately. CHALLENGE DOMAINS •
Web Exploitation: find and chain the flaws in live web applications, from injection and authentication bypass to logic errors the framework never protected against. •
Cryptography: break what was implemented wrong, from misused primitives and weak randomness to protocol mistakes that leak the key. •
Reverse Engineering: pull binaries apart without source, recover the logic and make them give up what they were built to hide. •
Digital Forensics: reconstruct what happened from disk images, memory dumps, packet captures and logs, then prove it with the flag. •
OSINT: turn public traces into intelligence by pivoting across identities, metadata, infrastructure and time. • Binary
Exploitation (Pwn): take control of vulnerable programs through memory corruption, from classic stack overflows to modern mitigation bypass. •
Miscellaneous: the problems that fit no single category, including steganography, scripting and puzzles that test how you think under a clock. DIFFICULTY LEVELS The board runs from Easy to Expert. Easy challenges are real entry points for first-time players, not filler. Medium and Hard reward depth and speed. Expert is reserved for teams that want to be tested. Points scale with difficulty, and the count per level is revealed when the board opens.
ROUND 01: QUALIFIER •
Date: 18 September 2026 •
Time: 10:00 AM to 10:00 PM IST (04:30 to 16:30 UTC) •
Duration: 12 hours, online, Jeopardy format •
Who plays: every registered team The board opens at 10:00 AM IST and closes at 10:00 PM IST. Teams are ranked by total points, with ties broken by earliest solve. The top-performing teams qualify for the Grand Finale. The qualification cut-off will be announced by the organisers.
ROUND 02: GRAND FINALE •
Date: 25 to 26 September 2026 •
Duration: 12 hours, online. Start time to be announced •
Who plays: qualifying teams only A fresh board for the teams that made the cut. Winners are announced on 26 September 2026. Null Origin is 24 hours of total competition split across two separate 12-hour rounds. Participants do not play continuously for 24 hours. REWARDS & PRIZES Null Origin rewards top-performing teams with a combination of premium cybersecurity training, certifications, hands-on labs, cloud credits and career opportunities from CyberHX and our official partners. 1st Place $500 Render Cloud Credits 1-Year OffSec Proving Grounds Practice Access CRTP Voucher by Altered Security INE Learning Path + Certificate - any one domain CPPT (Certified Practical Penetration Tester) by CyberHX - worth $99 MITRE ATT&CK Lab Access by CyberHX Internship Opportunity with CyberHX 2nd Place $300 Render Cloud Credits 1-Year OffSec Proving Grounds Practice Access INE Learning Path + Certificate - any one domain CPPT (Certified Practical Penetration Tester) by CyberHX - worth $99 MITRE ATT&CK Lab Access by CyberHX Internship Opportunity with CyberHX 3rd Place $