Php

Letter Dispair: find the command execution path, trigger it cleanly, and read the flag.

Console: abuse php to cross the web trust boundary and recover the flag.

Toxic: abuse unsafe deserialization to cross the trust boundary and reach the flag.

Feedback Flux: use the client-side injection path to steal the needed proof and recover the flag.