3d ago

SmartHire from HackTheBox features an MLflow instance with creds from the docs, pickle deserialization in a PyFunc model for RCE, and a Python path configuration file dropped into a writable plugin di

SmartHire from HackTheBox features an MLflow instance with creds from the docs, pickle deserialization in a PyFunc model for RCE, and a Python path configuration file dropped into a writable plugin directory for root. https:// 0xdf.gitlab.io/2026/09/26/htb- smarthire.html

1 social postother

Claim audit

No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.

All coverage

SmartHire from HackTheBox features an MLflow instance with creds from the docs, pickle deserialization in a PyFunc model for RCE, and a Python path configuration file dropped into a writable plugin di

mastodon:infosec-exchangeother3d ago kagi ↗

SmartHire from HackTheBox features an MLflow instance with creds from the docs, pickle deserialization in a PyFunc model for RCE, and a Python path configuration file dropped into a writable plugin directory for root. https:// 0xdf.gitlab.io/2026/09/26/htb- smarthire.html