exploit Archives - Sysadmins of the North

Featured Articles

Security

2025-12-19

“How we broke PHP, hacked Pornhub and earned $20,000”

It all started by auditing Pornhub, then PHP and ended in breaking both… We have gained remote code execution on pornhub.com and have earned a $20,000 bug bounty on Hackerone. We have found two use-after-free vulnerabilities in PHP’s garbage collection algorithm. Those vulnerabilities were remotely exploitable over PHP’s unserialize function.

Exploit PHP’s mail() to get remote code execution

Exploit PHP’s mail() function for remote code execution. Apparently, if you are able to control the 5th parameter of the mail() function ($options), you have the opportunity to execute arbitrary commands.