Part 2 of the PHP2Shell series. We stand up our own vulnerable WordPress box on PHP 8.4.26 with Docker, then walk the exploit chain stage by stage: the trigger, the dangling pointer, the memory leak, and the RCE. Lab-only, built to understand.
Part 1 of a 2-part series breaking down PHP2Shell (CVE-2026-109618 & CVE-2026-109619), the pair of critical PHP core RCE bugs patched on 21 Oct 2026. This part is all theory. Part 2 we pop it in a lab.
TL;DR A friend forwarded me a “Notis Tuntutan Cukai & Penalti” that claims to be from LHDN. It threatens a 200% penalty and 3 years in jail unless you submit documents within 72 hours. The “Do...
Intro Joined HackDev: Intro to CTF and walked away as runner up . This one was a solid beginner-friendly mix category which is crypto, web exploitation, forensics, reverse engineering, OSINT, and ...
Description The Artisan’s Ledger is a 205-point OSINT challenge from Liga CTF 2026 Week 3. We’re given a single photograph of a monument and need to extract hidden historical information encoded i...
Week 3 of Liga CTF 2026 brought us deep into the forensics and OSINT rabbit hole. Six 100-point challenges across image metadata analysis, geolocation, video inspection, and Malaysian landmark rese...
Description The Ghost in the Logs is a Forensics challenge from Liga CTF 2026 Week 3. We were given a Windows Event Log file and tasked to find a rogue account created by an attacker who tried to ...
Description This is GGEZAF challenge, its a Boot2Root machine from Liga CTF 2026 Week 2. A dockerized Linux environment where we need to find our way in and escalate to root. Enumeration Nmap Sc...
Description Packing is a technique used by malware to obfuscate its functionalities. Malware packers ‘pack’ the main malicious binary to make static analysis much harder. The malware ‘unpacks’ ...
Description I made this little program that locks a secret message inside a binary. I used THREE layers of protection — there’s literally no way to get the message out without the proper unlock...