Web & Windows on Hackpuntes

PHP2Shell, the critical PHP RCE (CVE-2026-109618 and CVE-2026-109619)

Wed, 21 Oct 2026 00:00:00 +0000

Today, October 21st 2026, PHP shipped emergency patches for a pair of flaws that had been sitting in the code for fourteen years and that a lot of people are going to remember for a while. They are called PHP2Shell, they are CVE-2026-109618 and CVE-2026-109619, and they allow remote code execution without authentication against a huge number of PHP servers. This is not a plugin or a framework bug, it lives in the PHP core itself, so the surface is massive.

Eloquia WriteUp

Sat, 17 Oct 2026 00:00:00 +0000

Eloquia is an ⬛ Insane Hack The Box machine that, unlike other Insane boxes heavy on Active Directory, is almost pure web + Windows. The entry point is an AngularJS 1.8.2 CSTI in a Django blog, which lets us run JavaScript in the administrator’s browser and steal their session. From there we abuse django-sql-explorer to get remote execution through load_extension(), decrypt Microsoft Edge credentials via DPAPI, and finish with an AppDomainManager injection into a .NET service running as SYSTEM.