#SecurityResearch
LightNews LightNews
news.karthihegde.dev
Taking another shot at the cheap IP camera, part 2
Discussion | hackernews | Author: ericswpark

#SecurityResearch
Taking another shot at the cheap IP camera, part 2
Eric Park's website
ericswpark.com
November 10, 2026 at 2:53 PM
news.karthihegde.dev
Changing one letter bypassed an admin API in HuggingFace
Discussion | hackernews | Author: robindooh

#SecurityResearch
Changing one letter bypassed an admin API in HuggingFace
twitter.com
November 8, 2026 at 1:07 AM
news.karthihegde.dev
Firecracker VM Escape: PwnEscape Part 2
Discussion | hackernews | Author: SerCe

#SecurityResearch
Firecracker VM Escape: PwnEscape Part 2
pwn.ai
November 6, 2026 at 7:44 PM
news.karthihegde.dev
PHP2Shell — Deep Dive
Discussion | lobsters | Author: hoistbypetard

#SecurityResearch
PHP2Shell — Deep Dive
From memory visualization to PHP source internals to exploit code. How two CVEs chain an OOM crash into RCE.
djad04.github.io
November 8, 2026 at 6:07 AM
news.karthihegde.dev
Never Gonna Print You Up
Discussion | hackernews | Author: ta988

#SecurityResearch
Never Gonna Print You Up
I spent a week breaking my own Prusa MK4S on signed upstream firmware and ended up with Remote Code Execution, which is how I learned that vulnerability research is not a tedious process anymore.
dixken.de
November 10, 2026 at 1:37 AM
news.karthihegde.dev
sshhole
Discussion | lobsters | Author: serce

#SecurityResearch
sshhole
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 5, 2026 at 12:54 PM
news.karthihegde.dev
SourceHut disabled registration bypass | CVE-2026-121728
Discussion | lobsters | Author: mhm

#SecurityResearch
SourceHut disabled registration bypass | CVE-2026-121728
You could register accounts on SourceHut instances who disabled registration
blog.arusekk.pl
November 5, 2026 at 6:54 PM
news.karthihegde.dev
Fake security tools on GitHub push backdoors and infostealers
Discussion | hackernews | Author: sshah03

#SecurityResearch
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.
www.bleepingcomputer.com
November 6, 2026 at 7:44 PM
news.karthihegde.dev
Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware
Discussion | hackernews | Author: p4p1

#SecurityResearch
Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware
Leo Smith's website, specialized in cyber security research, programming and audit. This website also contains my personal cyber security write ups and tools.
leosmith.wtf
November 9, 2026 at 1:08 PM
bsidespyongyang.bsky.social
𝗧𝗛𝗘 𝗖𝗔𝗟𝗟 𝗛𝗔𝗦 𝗕𝗘𝗘𝗡 𝗜𝗦𝗦𝗨𝗘𝗗.
BSides Pyongyang 2026 approaches.
On November 18, researchers from across the information-security community will gather online to share knowledge and hard-won experience.
#BSidesPyongyang #BSides #InfoSec #CyberSecurity #SecurityResearch
November 2, 2026 at 10:20 PM
news.karthihegde.dev
Show HN: FuckCaptcha – a field guide to 39 CAPTCHA types and how they break
Discussion | hackernews | Author: vasylsmutok

#SecurityResearch
Show HN: FuckCaptcha – a field guide to 39 CAPTCHA types and how they break
Open field guide to 39 CAPTCHA types: identification signals, free and open-source bypass methods, and paid alternatives. Includes a searchable web version. - vsmutok/FuckCaptcha
github.com
November 8, 2026 at 6:07 PM
news.karthihegde.dev
GhostMap: The Android flaw that crashes your phone before you open the app
Discussion | lobsters | Author: strugee

#SecurityResearch
GhostMap: The Android flaw that crashes your phone before you open the app
Bitdefender Labs researchers found that installing a specially crafted app can leave an Android phone stuck in a crash loop
www.bitdefender.com
November 7, 2026 at 6:38 PM
news.karthihegde.dev
Swipeblocked: The phrases your iPhone won't suggest
Discussion | hackernews | Author: lladnar

#SecurityResearch
Swipeblocked: The phrases your iPhone won't suggest
The iPhone keyboard carries a hidden list of thousands of phrases it will never suggest or let you swipe, from slurs to Tibetan independence. Here is the list.
swipeblocked.com
November 6, 2026 at 6:42 PM
yogsec.bsky.social
Google Dork to Find Exposed Laravel Env Files

Example: site:url inurl:.env ext:env

For more tips join Telegram channel t.me/bugbountyusa

#bugbounty #googledork #recon #infosec #ethicalhacking #pentesting #cybersecurity #bugbountytips #googlehacking #securityresearch
November 4, 2026 at 3:24 PM
news.karthihegde.dev
Hacking the meta ray-ban smartglasses
Discussion | lobsters | Author: ni5arga

#SecurityResearch
Hacking the meta ray-ban smartglasses
Back in July I wanted to check out the pwn2own targets for 2026. Since the rules hadn’t been released yet, I decided I would check last year’s targets in the hope that it would be simil…
p0pcycle.com
November 6, 2026 at 9:14 PM
news.karthihegde.dev
Local privilege escalation vulnerabilities in Linux
Discussion | hackernews | Author: dangelosaurus

#SecurityResearch
Local privilege escalation vulnerabilities in Linux
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
openai.com
November 4, 2026 at 11:54 PM
news.karthihegde.dev
Hundreds of Artex AI hacking tools found publicly exposed to the web
techcrunch | Author: Zack Whittaker

#SecurityResearch
Hundreds of Artex AI hacking tools found publicly exposed to the web
Security researchers found hundreds of servers hosting the penetration testing tool Artex exposed to the internet, allowing anyone access to the hacking tool.
techcrunch.com
November 6, 2026 at 7:12 PM
news.karthihegde.dev
Unlocking any car from X brand in most of the world
Discussion | hackernews | Author: infosecau

#SecurityResearch
Unlocking any car from X brand in most of the world
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
shubs.io
November 9, 2026 at 1:07 AM
news.karthihegde.dev
Pushing the Limits with getaddrinfo
Discussion | lobsters | Author: freddyb

#SecurityResearch
Pushing the Limits with getaddrinfo
An IPv4 address is just a 32-bit number, and glibc will accept it in forms you would never recognize. ⁰𝑋⁴5．🯰３₆。⁵₂₈𝟲🯶 is one of them. Anything that judges an address by how it looks can be walked around.
acid.vegas
November 6, 2026 at 3:11 PM
news.karthihegde.dev
My gym forced a social media down my throat. So I reverse-engineered its app
Discussion | hackernews | Author: yewenjie

#SecurityResearch
My gym forced a social media down my throat. So I reverse-engineered its app
Extracting my gym’s QR check-in from its Flutter app, with a rooted phone and a lot of ripgrep.
shayon.work
November 5, 2026 at 5:54 PM
news.karthihegde.dev
Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements
Discussion | hackernews | Author: muricula

#SecurityResearch
Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements
Improving the Xbox 360 Bad Update exploit to trigger nearly instantaneously with near 100% success rate.
icode4.coffee
November 4, 2026 at 10:24 PM
news.karthihegde.dev
Hacking the T-Mobile Sidekick, 20 Years Too Late
Discussion | hackernews | Author: microcode

#SecurityResearch
Hacking the T-Mobile Sidekick, 20 Years Too Late
Danger stopped handing out Sidekick developer keys in 2010. I cracked its signing key and started making my own.
x86.cx
November 4, 2026 at 11:54 PM
news.karthihegde.dev
OpenAI Just Found Nearly 1k Ways to Gain Root Access in Linux
Discussion | hackernews | Author: axelfontaine

#SecurityResearch
OpenAI Just Found Nearly 1k Ways to Gain Root Access in Linux
OpenAI just dropped the details on a massive, automated cyber experiment that ran a specialized AI model against the Linux kernel and in the process, found and fixed nearly 1,000 vulnerability loopholes.
hothardware.com
November 6, 2026 at 9:24 AM
news.karthihegde.dev
AI is forcing us to pay off 40 years of technical debt
Discussion | hackernews | Author: pseudolus

#SecurityResearch
AI is forcing us to pay off 40 years of technical debt
AI is forcing us to pay off 40 years of technical debt
spectrum.ieee.org
November 4, 2026 at 12:16 PM
news.karthihegde.dev
From 25M instructions to one faulty skip: fault analysis of a secure boot
Discussion | hackernews | Author: fortran77

#SecurityResearch
From 25M instructions to one faulty skip: fault analysis of a secure boot
How an AI agent found a single 2-byte instruction skip that flips a secure boot verdict, from a raw boot ROM dump to reproducible Epoch traces.
www.eshard.com
November 5, 2026 at 2:54 PM