new
Labs
Enterprise
Offensive
Explore CVE-2026-109618 / CVE-2026-109619 in Dark Embargo, a new HTB Challenge
Following the disclosure of
two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell,
you can now explore how they can be chained to achieve unauthenticated remote code execution in Dark Embargo, a new HTB Challenge.In Dark Embargo, you’ll investigate Embargo Freight Solutions, whose website has been reduced to a single maintenance page. With no forms or obvious entry points, your only lead is the server’s X-Powered-By header. The challenge focuses on exploiting PHP 8.4 session.upload_progress memory-corruption vulnerabilities to gain initial access to the server.
