Fastcgi on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/fastcgi/Recent content in Fastcgi on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000Pollutionhttps://lukaszpastuszak.dev/writeups/pollution/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/A leaked Burp export gives an admin token and XXE, Redis session tampering reaches a developers portal, an LFI PHP filter chain lands RCE, FastCGI pivots to victor, and prototype pollution in a Node.js API run as root gives a root shell.