HTB Medium Linux machine — unauthenticated RCE in MCPJam Inspector (CVE-2026-23744), a hand-rolled WebSocket to hijack a Jupyter kernel, and root through a hidden admin tool in a root-owned MCP server
Youssef Kessentini
Security researcher & CTF player. Escalating privileges one machine at a time.
