Hack The Box confirms that every customer-facing service that uses PHP runs a fixed PHP release, and that we verified the running version on each service. We hardened our PHP configuration and applied interim mitigation to all customer-facing services as part of the response.

We reviewed our logs and systems for signs of exploitation and found no evidence that either vulnerability was used against our services or that customer data was accessed.

No customer action is required. Integrations, LTI configuration, keys and settings do not need to change.

We are also tracking separate researcher claims about other issues in the fixed releases and continue to review our applications for exposure.

HTB Team

Get ready to learn hands-on KQL fundamentals in Microsoft Sentinel.

Build threat hunting and incident response skills for Microsoft Sentinel with GuestofHonor, an Easy Sherlock focused on investigating a cloud identity compromise.

New to Kusto Query Language (KQL)? This beginner-friendly HTB Enterprise scenario teaches you the language through an investigation of a Microsoft Entra ID compromise, helping you build foundational query skills for investigations in Microsoft Sentinel.

Ready to put agents to work in web engagements? AI-Augmented Web Pentesting has been added to the AI-Augmented Penetration Tester path on HTB Enterprise

Faster testing still requires careful judgment. Building on AI-Augmented Pentesting Foundations, this Module explores how to use AI across web application enumeration, exploitation, and scripting.

Learn to delegate tasks responsibly, bypass mitigations, and create payloads that demonstrate impact while keeping the engagement under your control.

Completing this Module will give you the confidence to:

Practice each technique through hands-on exercises, then bring your skills together in a practical skills assessment.

Start AI-Augmented Web Pentesting →

Following the disclosure of you can now explore how they can be chained to achieve unauthenticated remote code execution in Dark Embargo, a new HTB Challenge.

In Dark Embargo, you’ll investigate Embargo Freight Solutions, whose website has been reduced to a single maintenance page. With no forms or obvious entry points, your only lead is the server’s X-Powered-By header. The challenge focuses on exploiting PHP 8.4 session.upload_progress memory-corruption vulnerabilities to gain initial access to the server.

We’ve added 150 Sherlocks from LetsDefend to HTB Labs to expand our defensive cybersecurity content. This release brings additional real-world Blue Team scenarios directly to HTB platform, offering hands-on practice across multiple specializations and difficulty levels.

Here is what’s waiting for you:

Which investigation are you jumping into first? 🔍

👉 Explore the new Sherlocks

Remember we said CTF events can earn you XP? Now you can see the XP available from CTF challenges and your team’s total XP earned when an event ends!

With XP visibility available, you can choose what to tackle next and see your team’s progress after each event.

Heading on to your next event?:

We updated the HTB Profile dashboard to give you intelligent, personalized content recommendations. You'll be able to find your next Modules, Machines or Sherlocks based on your past completions and preferences!

👉 Check your personalized recommendations

Ready to take your cloud offensive skills further? Meet Ymir and Atlas, two advanced cloud labs designed to challenge experienced security professionals with realistic environments, complex misconfigurations, and multi-stage attack paths.

I step into Omni Multinational’s Google Cloud environment and work your way from its publicly reachable presence toward its most valuable asset: proprietary trading algorithms and intellectual property.

take on the company’s AWS environment, uncover exposed assets, exploit weaknesses, and chain attack paths to gain deeper access across its cloud infrastructure.

Each lab puts your enumeration, identity and access management, and exploitation skills to the test, with challenges spanning modern cloud services, applications, containers, and more.

Expect to tackle:

Two cloud environments. Two distinct attack surfaces. Plenty of opportunities to put your skills to the test.

Hack The Box introduces , an advanced certification designed to help organizations develop and validate detection engineering expertise in their security teams.

Effective detection engineering requires more than writing SIEM queries. Teams need to understand how adversaries operate at the process, memory, API, and operating system kernel levels, identify the telemetry that reveals their behavior, and build detection logic that can be tested and defended.

HTB CDEP combines a 13-module Detection Engineer Job Role Path with a 10-day hands-on enterprise engagement to assess these skills in realistic scenarios. Key capabilities include:

The Detection Engineer Job Role Path is mapped to MITRE ATT&CK, D3FEND, and the DoW Cyber Workforce Framework (DCWF).