https://bokkapig.pages.dev/tags/php-injection/Recent content in PHP-Injection on bokkapigHugoen-gbSat, 21 Mar 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/kobold/Sat, 21 Mar 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/kobold/MCP Inspector STDIO RCE for foothold, PHP code injection in PrivateBin container to leak credentials, Docker escape via Arcane container management.https://bokkapig.pages.dev/writeups/variatype/Sat, 14 Mar 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/variatype/Exploited fonttools CVE-2025-66034 designspace path traversal to write a PHP webshell, escalated to user via FontForge archive command injection, then root via setuptools PackageIndex arbitrary file write to cron.d.