A new Sherlock, dOOMs Day, is now live, giving you hands-on experience in investigating the recent PHP2Shell exploit (CVE-2026-109618 / CVE-2026-109619).

In this Sherlock, you must investigate a compromised server targeted through the PHP2Shell attack chain. By analyzing web logs, you can uncover patterns of malicious activity, identify evidence of exploitation, and better understand how this emerging threat appears from a defender's perspective.

Following the offensive Challenge Dark Embargo, dOOMs Day explores the defensive side of the same vulnerability, linking exploitation techniques to observable evidence to strengthen detection capabilities and support purple-team collaboration.

Play dOOMs Day on HTB Labs

Play dOOMs Day on HTB Enterprise

We've expanded Tier 0 Learning Modules on HTB Academy from 47 to 58, and made them all free to unlock. With this change, completing Tier 0 questions and Modules no longer awards Cubes.

Build your cybersecurity foundations through guided lessons and hands-on exercises on HTB Academy, without spending Cubes.

_________________________________________________________________________

Operation Gilt Doctrine is a three-month HTB Enterprise campaign bringing Red & Blue Team practitioners together to investigate the breach through exclusive, hands-on scenarios.

Reverse engineer a legacy authentication service to uncover how access to Wrenford Bank's admin portal is granted.

Escape a restricted Linux kiosk, exploit an application weakness, and escalate privileges through a vulnerable system service.

Investigate Windows artifacts and AnyDesk activity to reconstruct an attack and determine its scope.

A centralized release feed is now available directly on Hack The Box Profile dashboard. This update gives you a unified view of recently published content across the platform without navigating between separate tabs.

The feed displays Machines, Modules, Sherlocks, and Challenges released over the past 14 days, organized in a carousel sorted newest-first.

Hack The Box confirms that every customer-facing service that uses PHP runs a fixed PHP release, and that we verified the running version on each service. We hardened our PHP configuration and applied interim mitigation to all customer-facing services as part of the response.

We reviewed our logs and systems for signs of exploitation and found no evidence that either vulnerability was used against our services or that customer data was accessed.

No customer action is required. Integrations, LTI configuration, keys and settings do not need to change.

We are also tracking separate researcher claims about other issues in the fixed releases and continue to review our applications for exposure.

HTB Team

Get ready to learn hands-on KQL fundamentals in Microsoft Sentinel.

Build threat hunting and incident response skills for Microsoft Sentinel with GuestofHonor, an Easy Sherlock focused on investigating a cloud identity compromise.

New to Kusto Query Language (KQL)? This beginner-friendly HTB Enterprise scenario teaches you the language through an investigation of a Microsoft Entra ID compromise, helping you build foundational query skills for investigations in Microsoft Sentinel.

Ready to put agents to work in web engagements? AI-Augmented Web Pentesting has been added to the AI-Augmented Penetration Tester path on HTB Enterprise

Faster testing still requires careful judgment. Building on AI-Augmented Pentesting Foundations, this Module explores how to use AI across web application enumeration, exploitation, and scripting.

Learn to delegate tasks responsibly, bypass mitigations, and create payloads that demonstrate impact while keeping the engagement under your control.

Completing this Module will give you the confidence to:

Practice each technique through hands-on exercises, then bring your skills together in a practical skills assessment.

Start AI-Augmented Web Pentesting →

Following the disclosure of you can now explore how they can be chained to achieve unauthenticated remote code execution in Dark Embargo, a new HTB Challenge.

In Dark Embargo, you’ll investigate Embargo Freight Solutions, whose website has been reduced to a single maintenance page. With no forms or obvious entry points, your only lead is the server’s X-Powered-By header. The challenge focuses on exploiting PHP 8.4 session.upload_progress memory-corruption vulnerabilities to gain initial access to the server.

We’ve added 150 Sherlocks from LetsDefend to HTB Labs to expand our defensive cybersecurity content. This release brings additional real-world Blue Team scenarios directly to HTB platform, offering hands-on practice across multiple specializations and difficulty levels.

Here is what’s waiting for you:

Which investigation are you jumping into first? 🔍

👉 Explore the new Sherlocks

Remember we said CTF events can earn you XP? Now you can see the XP available from CTF challenges and your team’s total XP earned when an event ends!

With XP visibility available, you can choose what to tackle next and see your team’s progress after each event.

Heading on to your next event?: