Pada writeup kali ini saya akan membahas room CVEPHP2Shell di TryHackMe. Room ini membahas dua vulnerability kritis pada runtime PHP, yaitu…

Reverse vs Bind Shells

Hello.

Scenario

Task 1: Deploying the machine

How partial failures, misleading success responses, asynchronous processing, and distributed-system inconsistencies turn a green status…

PHP disclosed a second RCE path on October 23, two days after the emergency PHP2Shell fixes.

Dubai, UAE, 26th October 2026, CyberNewswire

eMudhra will leave the global SSL/TLS certificate market after eight intermediate CA private keys were found easily guessable, prompting browser distrust actions.

Every password reset flow makes the same implicit promise: the link in your inbox is the only way in, because the token inside it could not…

How to spot, confirm, and fix SSRF, SSTI, SSI, and XSLT injection.

Your online store may look completely normal while malicious code operates behind the scenes.

When security teams discuss web vulnerabilities, attention usually gravitates toward application-level flaws in third-party Composer…

I started building Master Nmap Recon with a simple idea: Cybersecurity tools become easier to understand when we break them down into…

A security scanner can tell you that something looks suspicious.

SQL injection UNION attack, determining the number of columns returned by the query

From a malicious Word document to a fully owned machine, using Sysmon logs, Timeline Explorer, Wireshark and Brim.

Anthropic has officially submitted its registration documents to the Securities and Exchange Commission. Specifically, the frontier laboratory behind Claude plans to list under ticker ANT on the N…

Business logic vulnerabilities are among my favorite bugs to investigate. They don’t always require complex payloads, advanced tools, or…