Saint Mail2Shell, Who Opened With an Invisible Space

Patron of email help desks, filename checks, and zero-width spaces.

Life

In March 2026 OX Security researchers published Mail2Shell, CVE-2026-28289 in FreeScout, a help desk written in PHP. It bypassed an earlier fix: prefixing a filename with a zero-width space slipped past the new check and the file was saved as an .htaccess. According to the researchers, by sending a single email to an address FreeScout handled, without authenticating and without anyone clicking anything, an attacker got code execution.

Prayer

O Saint Mail2Shell, who enters through a character no one can see, teach our checks to look at what does not appear. Amen.

How to celebrate

Celebrated by updating FreeScout to 1.8.207, disabling AllowOverride, and normalising every filename before trusting it.

Invisible space, very visible damage.