Infinity Pool — TryHackMe Hacker Holidays 2026 Day 11 Writeup

Day 11 walkthrough: command injection on a Flask netcheck, hard-coded FreePBX 16 UCP creds (CVE-2026-46376), a key in a voicemail, then root. Flags redacted.