One WebSocket, one Shell: CVE-2026-39987 Explained

This deep dive is based off obtaining foothold on a Season 11 Hack-the-Box machine using CVE-2026-39987. Point a WebSocket client at wss://target/terminal/ws, it connects, and you are staring at a s