hacker, security researcher; alum @cis_india, @hasgeek; blog at https://xitter.cf/t.co/pXy5yRt8Jw
Delhi/Bangalore
Joined June 2008
- Tweets901
- Following999
- Followers4.4K
- Likes41.4K
Karan Saini retweeted
You just know the economy is firing on all cylinders spectacularly when citizens can’t move their money abroad
Masterstroke indeed
This Zee Business Report says
1) RBI has asked govt to completely end capital account outflows under automatic route (will need RBI permission henceforth)
2) Current account flows capped at 50 lakh
If true, it effectively ends US investing for Indians
zeebiz.com/economy-infra/new…
Karan Saini retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
Karan Saini retweeted
So Pronto was about collecting Indian data for sale to US and Western frontier labs. Provision Labs—its newly launched SF venture aims to sell real-world human behavioural footage to train physical AI & robotics :)
entrackr.com/news/pronto-fou…
Karan Saini retweeted
Cohere is misrepresenting a lot of information in their post.
1. They say CoT said it wasn't going to use tools but used them.
That "no tools" in CoT is clearly for ack of the hallucinated prompt and the model mentioned so too!
2. They said model "inventoried" the machine.
What model did was look for tools for upload and process http response output and whether there is a resolver configured. Anyone who looks at coding models cot ever would know every model often does this before trying an http call to push/pull data
3. They say it uploaded data, and implied the machine data by leaving out what in text.
But in command it clearly shows a dummy probe data and too to a non existent bucket (hallucinated signature)
4. Then they say if the test was done by model after writing the rule they would have no concern.
Why? Doesnt TDD say that tests have to be written before?
Karan Saini retweeted
Meta seems to be proactively taking down satire citing the IT Rules? So many of civil society’s concerns about the IT Rules are playing out just as we feared (in this case, platforms essentially kowtowing + willingly taking down criticism of the government). Despicable from Meta.
Made a reel about some guy using AI to summon dead people. Instagram restricted it in minutes. It's on YT in case you wanna check it out: youtube.com/shorts/IOXMieG1O…
Karan Saini retweeted
CJI Chandrachud Used To Seek Government's Pre-Approval Before Collegium Discussed Names For Judicial Appointments : Justice Kaul
Justice Kaul said CJI Chandrachud was too deferential to the Government in appointment matters.
livelaw.in/top-stories/cji-c…
Karan Saini retweeted
Goodbye @haricm 😔
mediatinker.com/2026/10/21/h…
Karan Saini retweeted
“Tum mujhe problem do, mai tumhe form doga” - Indian babus. The most useless form ever made and the Tamasha just goes on.
Karan Saini retweeted
threadlocked has a very high density of hackers (security researchers) & reverse engineers, some of their work:
1. hacking a multi-billion-dollar company by @0x1622: blogs.pwnedby.me/blog/hackin…
2. hacking cafe coffee day over coffee by @ni5arga: ni5arga.com/blog/posts/hacki…
3. dynamic analysis of veh dispatch and stuff by @mooofinnn: mooofin.github.io/portfolio/…
4. hacking india's largest exam system by @ni5arga: ni5arga.com/blog/posts/hacki…
5. 1-click mmi execution on android by @squeal: karansaini.com/mmi-android/
6. attacking a weak 3d secure implementation by @squeal: karansaini.com/3d-secure-fla…
7. a deep dive into processes, threads, fibers and jobs on windows by @rcx86: de-engineer.github.io/Proces…
we are always looking out for new cracked invidiuals to grow together with :)
Karan Saini retweeted
Election Commission’s software has made a massive blunder. It’s translating Hindi/Urdu names by treating them as if they were English.
For example, the name was Muhammad Iqbal Beg, but the software turned it into “Mohammad Iqbal Bheek Mangte Hain”.
Another example: A woman’s name was Phool Kali Devi, and the software changed it to “Murkh Kali Devi” .
Absolute chaos, what’s going on?
Karan Saini retweeted
Correction: thousands of government sites were impacted from eMudhra cert revocations.
1337+ from India
200+ from Kenya
50+ from USA
and a few from Philippines, Qatar, Ethiopia, Chile, and Dominica.
Updated the list in the blog: captnemo.in/blog/2026/10/23/…
156 Indian government websites are currently inaccessible because of a cert revocation by @eMudhra, including 4 that come under @GoI_MeitY. One of them is @ccaindiapki - which regulates eMudhra.
cc @internetfreedom
I made a list: captnemo.in/blog/2026/10/23/…
Karan Saini retweeted
Cybersec update: Breachpocalypse is already here & how to handle it.
Welcome Cypherpunk Congress cybersecurity experts:
☑️ @ni5arga - young hacker, software engineer & security researcher
☑️ @squeal - experienced security researcher; alum @cis_india, @hasgeek; @OpenTechFund collaborator
☑️ @digitaldutta - civic hacker, independent researcher and digital rights advocate working at the intersection of technology, democracy and society.
4000 people will celebrate digital rights here: congress.web3privacy.info
Karan Saini retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
Karan Saini retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Karan Saini retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
