hacker, security researcher; alum @cis_india, @hasgeek; blog at https://xitter.cf/t.co/pXy5yRt8Jw
Delhi/Bangalore
Joined June 2008
- Tweets896
- Following999
- Followers4.4K
- Likes41.4K
Karan Saini retweeted
Meta seems to be proactively taking down satire citing the IT Rules? So many of civil society’s concerns about the IT Rules are playing out just as we feared (in this case, platforms essentially kowtowing + willingly taking down criticism of the government). Despicable from Meta.
Made a reel about some guy using AI to summon dead people. Instagram restricted it in minutes. It's on YT in case you wanna check it out: youtube.com/shorts/IOXMieG1O…
Karan Saini retweeted
CJI Chandrachud Used To Seek Government's Pre-Approval Before Collegium Discussed Names For Judicial Appointments : Justice Kaul
Justice Kaul said CJI Chandrachud was too deferential to the Government in appointment matters.
livelaw.in/top-stories/cji-c…
Karan Saini retweeted
Goodbye @haricm 😔
mediatinker.com/2026/10/21/h…
Karan Saini retweeted
“Tum mujhe problem do, mai tumhe form doga” - Indian babus. The most useless form ever made and the Tamasha just goes on.
Karan Saini retweeted
threadlocked has a very high density of hackers (security researchers) & reverse engineers, some of their work:
1. hacking a multi-billion-dollar company by @0x1622: blogs.pwnedby.me/blog/hackin…
2. hacking cafe coffee day over coffee by @ni5arga: ni5arga.com/blog/posts/hacki…
3. dynamic analysis of veh dispatch and stuff by @mooofinnn: mooofin.github.io/portfolio/…
4. hacking india's largest exam system by @ni5arga: ni5arga.com/blog/posts/hacki…
5. 1-click mmi execution on android by @squeal: karansaini.com/mmi-android/
6. attacking a weak 3d secure implementation by @squeal: karansaini.com/3d-secure-fla…
7. a deep dive into processes, threads, fibers and jobs on windows by @rcx86: de-engineer.github.io/Proces…
we are always looking out for new cracked invidiuals to grow together with :)
Karan Saini retweeted
Election Commission’s software has made a massive blunder. It’s translating Hindi/Urdu names by treating them as if they were English.
For example, the name was Muhammad Iqbal Beg, but the software turned it into “Mohammad Iqbal Bheek Mangte Hain”.
Another example: A woman’s name was Phool Kali Devi, and the software changed it to “Murkh Kali Devi” .
Absolute chaos, what’s going on?
Karan Saini retweeted
Correction: thousands of government sites were impacted from eMudhra cert revocations.
1337+ from India
200+ from Kenya
50+ from USA
and a few from Philippines, Qatar, Ethiopia, Chile, and Dominica.
Updated the list in the blog: captnemo.in/blog/2026/10/23/…
156 Indian government websites are currently inaccessible because of a cert revocation by @eMudhra, including 4 that come under @GoI_MeitY. One of them is @ccaindiapki - which regulates eMudhra.
cc @internetfreedom
I made a list: captnemo.in/blog/2026/10/23/…
Karan Saini retweeted
Cybersec update: Breachpocalypse is already here & how to handle it.
Welcome Cypherpunk Congress cybersecurity experts:
☑️ @ni5arga - young hacker, software engineer & security researcher
☑️ @squeal - experienced security researcher; alum @cis_india, @hasgeek; @OpenTechFund collaborator
☑️ @digitaldutta - civic hacker, independent researcher and digital rights advocate working at the intersection of technology, democracy and society.
4000 people will celebrate digital rights here: congress.web3privacy.info
Karan Saini retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
Karan Saini retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Karan Saini retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
Karan Saini retweeted
More private keys by the Indian certificate authority have been discovered. These are all small numbers.
People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
Karan Saini retweeted
Once all the CA cert store updates (and cert-pinning) is done, it will be great for people reverse engineering software on their own devices.
In a way, eMudhra has taken one for the team and contributed towards open source research:
xitter.cf/meowkoteeq/status/2112…
Karan Saini retweeted
The eMudhra mess-up is inexplicable. It's got a massive attack surface. And it is hard to patch all the software that can be compromised given how CA certs are treated by some devices as permanent.
bugzilla.mozilla.org/show_bu… for full shit-show
emudhra.we-have-a-problem.co… for summary.