PHP2Shell, and why taking the internet offline is not an acceptable mitigation

This is the first entry in a series where I document hands on offensive security work, real commands, real targets, real screenshots. This…

You were pivoting before it was a prompt. Here’s what the machines actually add to the craft — and what they still can’t do for you.

HackTheBox es una plataforma online en la que practicar y enfrentarse a diferentes retos de hacking. Desde servidores vulnerables…

Disclaimer: This write-up is for educational purposes only. All attacks are done on PortSwigger’s Web Security Academy labs, which are made…

By An Nguyen — October 23, 2026

PHP2Shell: Web’in %69'unu Etkileyen Kritik PHP Açıkları (CVE-2026–109618 & 109619) Evet arkadaşlar yaklaşık 2 gün önce karşımıza PHP2Shell adında çok geniş kapsamlı ve çok …

Hi all, this is my second writeup. Orion is a retired Easy-rated Linux machine, and the second one I’ve solved so far.

# El Bandito — TryHackMe Writeup

When I started learning cybersecurity, most of my learning involved understanding concepts, watching lessons, and making notes. But I…

(PLEASE NOTE — I did this walkthrough in multiple takes so the target ip changed throughout it. I used [TARGET_IP] to keep it simple…

I recently finished a security assessment of a multi-tenant SaaS platform with an integrated LLM assistant. Final rating: Critical. 17…

PHP2Shell: CVE-2026–109618 and CVE-2026–109619

WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access campaign targeting users in Portugal.

An expert PortSwigger lab, and the five walls I hit before it cracked.

PHP2Shell shows how AI is changing the economics of exploitation, and why application defense must learn, reason, and adapt at machine…

I went looking for a use-after-free that survived PHP’s October 2026 patches. I found one. Then a control test revealed something more…