The Hollow Shell — TryHackMe Hacker Holidays 2026 Day 10 Writeup

Day 10 walkthrough: zip-slip beats an allowlist that only reads the manifest, then a poisoned Jinja template fires on a fresh gunicorn worker. Flags redacted.