⬇ Download holy card: ·
Saint Mail2Shell, Who Opened With an Invisible Space
Patron of email help desks, filename checks, and zero-width spaces.
Life
In March 2026 OX Security researchers published Mail2Shell, CVE-2026-28289 in FreeScout, a help desk written in PHP. It bypassed an earlier fix: prefixing a filename with a zero-width space slipped past the new check and the file was saved as an .htaccess. According to the researchers, by sending a single email to an address FreeScout handled, without authenticating and without anyone clicking anything, an attacker got code execution.
Prayer
O Saint Mail2Shell, who enters through a character no one can see, teach our checks to look at what does not appear. Amen.
How to celebrate
Celebrated by updating FreeScout to 1.8.207, disabling AllowOverride, and normalising every filename before trusting it.
Invisible space, very visible damage.