Technical

Pi-hole's pihole user is low-privileged. It's configured with nologin. It looks contained. It isn't. Here's how a writable file and a trusting root process combine into a clean privilege escalation path.