S
secret_solder
New Member
- Joined
- October 27, 2026
- Messages
- 1
- Reaction score
- 0
- Points
- 1
- Thread Author
- #1
Sri Lanka's "largest café chain" - brewed to perfection, secured by nobody. And they lost your data.
Barista. "Brewing Happiness." 100+ outlets. "A trusted destination for café lovers." Sounds lovely. Then we logged in.
Target: barista.lk
Vuln: PHP2Shell - CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2, unauth RCE)
Tool: GitHub - murrez/php2shell: php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.
BREWING HAPPINESS? MORE LIKE BREWING EXPLOITS.
expose_php is ON, so they advertise their own PHP version in every header: PHP 8.1.34. End of life since 31 Dec 2025. It's October 2026. Their coffee might be fresh. Their PHP is expired.
The open phpinfo() was funnier: kernel 3.10 / el7 (a branch from 2014), LiteSpeed, and the punchline - a national brand not even on a real server, just shared CloudLinux hosting, leaking its own hostname and home directory.
That PHP runs PHP2Shell - two use-after-free bugs in the PHP core. 109618 leaks raw server memory, 109619 goes straight to RCE. The bug dates back to PHP 5.4, 2012. Fourteen years.
Cloned the tool, pointed it at the box, got a shell. No login, no creds, one command. Order up: one shell, extra hot.
THEIR SYSTEM IS SWISS CHEESE
100+ outlets. 0 patches.
- PHP 8.1.34 - EOL, no official fix, a 14-year-old bug in its core.
- Kernel 3.10 / el7 - from 2014, still live in 2026.
- Shared CloudLinux budget hosting for a "national leader".
- expose_php ON - advertising the vulnerable version to every scanner.
They paid for a shiny CMS and left the foundation rotting. Swiss cheese pretending to be infrastructure.
YOUR DATA IS GONE
We didn't just get a shell. The memory-leak half of PHP2Shell dumps raw worker memory:
- Customer accounts - names, emails, phone numbers
- Delivery addresses
Every person who gave Barista their email, number and order history handed it to a company that can't update PHP. They lost your data. The loyalty card has a better patch cycle than their servers.
Even a kid could hack this box. One repo, one command, done. They brew happiness. We brewed a shell. A 14-year-old bug sat in their stack the whole time and nobody noticed.
Trusted destination? Not anymore.
GG.
→ 
Sample of leaked user data from their kiosk:
Asun Perera : 0774826193
Nimal Fernando : 0716392845
Tharindu Silva : 0762948175
Dilshan Jayawardena : 0758314629
Chamod Wijesinghe : 0705927384
Isuru Bandara : 0783469152
Lahiru Gunasekara : 0726851934
Dinesh Madushanka : 0749285613
Need more data? DM.
Barista. "Brewing Happiness." 100+ outlets. "A trusted destination for café lovers." Sounds lovely. Then we logged in.
Target: barista.lk
Vuln: PHP2Shell - CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2, unauth RCE)
Tool: GitHub - murrez/php2shell: php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.
BREWING HAPPINESS? MORE LIKE BREWING EXPLOITS.
expose_php is ON, so they advertise their own PHP version in every header: PHP 8.1.34. End of life since 31 Dec 2025. It's October 2026. Their coffee might be fresh. Their PHP is expired.
The open phpinfo() was funnier: kernel 3.10 / el7 (a branch from 2014), LiteSpeed, and the punchline - a national brand not even on a real server, just shared CloudLinux hosting, leaking its own hostname and home directory.
That PHP runs PHP2Shell - two use-after-free bugs in the PHP core. 109618 leaks raw server memory, 109619 goes straight to RCE. The bug dates back to PHP 5.4, 2012. Fourteen years.
Cloned the tool, pointed it at the box, got a shell. No login, no creds, one command. Order up: one shell, extra hot.
THEIR SYSTEM IS SWISS CHEESE
100+ outlets. 0 patches.
- PHP 8.1.34 - EOL, no official fix, a 14-year-old bug in its core.
- Kernel 3.10 / el7 - from 2014, still live in 2026.
- Shared CloudLinux budget hosting for a "national leader".
- expose_php ON - advertising the vulnerable version to every scanner.
They paid for a shiny CMS and left the foundation rotting. Swiss cheese pretending to be infrastructure.
YOUR DATA IS GONE
We didn't just get a shell. The memory-leak half of PHP2Shell dumps raw worker memory:
- Customer accounts - names, emails, phone numbers
- Delivery addresses
Every person who gave Barista their email, number and order history handed it to a company that can't update PHP. They lost your data. The loyalty card has a better patch cycle than their servers.
Even a kid could hack this box. One repo, one command, done. They brew happiness. We brewed a shell. A 14-year-old bug sat in their stack the whole time and nobody noticed.
Trusted destination? Not anymore.
GG.
→ Sample of leaked user data from their kiosk:
Asun Perera : 0774826193
Nimal Fernando : 0716392845
Tharindu Silva : 0762948175
Dilshan Jayawardena : 0758314629
Chamod Wijesinghe : 0705927384
Isuru Bandara : 0783469152
Lahiru Gunasekara : 0726851934
Dinesh Madushanka : 0749285613
Need more data? DM.
