CHALLENGE & LEADERBOARD CVE-2026-109618 / CVE-2026-109619

Server Exploit Hall of Fame

This Hall of Fame is exclusively reserved for hackers and security researchers who successfully exploit this server. If you achieve Remote Code Execution (RCE) or read the protected proof token, you can permanently add your handle to the registry. Co-created by Suraj Tiwari & CP Dhaundiyal.

Verified Exploiters

Hackers who proved compromise of this container

Target Architecture

PHP 8.4-FPM

Unpatched Zend Engine (CVE-2026-109618)

Target Creators

Suraj & CP

@surajtiwari020 • @dhaundiyalcp

Verified Conquerors Leaderboard

Official registry of researchers who cracked this environment

#	Hacker Handle	Role / Status	Exploit Technique / Notes	Verified Date	Contact / Profile
#02	CP Dhaundiyal @dhaundiyalcp	Verified Host	Tool Co-Creator & Research Collaborator	2026-10-22	View Profile →
#01	Suraj Tiwari @surajtiwari020	Verified Host	Target Author & Solutions Architect	2026-10-22	View Profile →

Method 1: Claim via Web Form

Enter the secret token discovered from /proof.txt

Method 2: CLI Command (From RCE Shell)

Run directly inside your popped reverse shell

If you achieve shell execution on the container, run the standardized claim script:

php /var/www/html/claim.php \
  --handle "YourHandle" \
  --twitter "@yourhandle" \
  --url "https://github.com/yourname" \
  --writeup "RCE via CVE-2026-109618"

Method 3: Automated Script API (HTTP POST)

Programmatic submission for exploit scripts

curl -X POST http://localhost:8080/hall-of-fame?action=claim \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "YourHandle",
    "proof": "PROOF{...}",
    "url": "https://...",
    "method": "Exploit Description"
  }'