#SecurityResearch
LightNews LightNews
news.karthihegde.dev
Windows Search RCE Vulnerability
Discussion | hackernews | Author: svl7

#SecurityResearch
Windows Search RCE Vulnerability
msrc.microsoft.com
November 10, 2026 at 9:52 PM
news.karthihegde.dev
Taking another shot at the cheap IP camera, part 2
Discussion | hackernews | Author: ericswpark

#SecurityResearch
Taking another shot at the cheap IP camera, part 2
Eric Park's website
ericswpark.com
November 10, 2026 at 2:53 PM
news.karthihegde.dev
Finding a vulnerability in Star Wars Episode I: Racer
Discussion | lobsters | Author: hugoarnal

#SecurityResearch
Finding a vulnerability in Star Wars Episode I: Racer
Star Wars Episode I: Racer
synacktiv.com
November 10, 2026 at 10:23 PM
news.karthihegde.dev
Changing one letter bypassed an admin API in HuggingFace
Discussion | hackernews | Author: robindooh

#SecurityResearch
Changing one letter bypassed an admin API in HuggingFace
twitter.com
November 8, 2026 at 1:07 AM
news.karthihegde.dev
Firecracker VM Escape: PwnEscape Part 2
Discussion | hackernews | Author: SerCe

#SecurityResearch
Firecracker VM Escape: PwnEscape Part 2
pwn.ai
November 6, 2026 at 7:44 PM
news.karthihegde.dev
PHP2Shell — Deep Dive
Discussion | lobsters | Author: hoistbypetard

#SecurityResearch
PHP2Shell — Deep Dive
From memory visualization to PHP source internals to exploit code. How two CVEs chain an OOM crash into RCE.
djad04.github.io
November 8, 2026 at 6:07 AM
news.karthihegde.dev
Alpine Linux and OpenSSH patch flaw that's as bad as it can get
Discussion | hackernews | Author: ohjeez

#SecurityResearch
Alpine Linux and OpenSSH patch flaw that's as bad as it can get
This dangerous Linux security hole must be patched as soon as possible.
www.zdnet.com
November 10, 2026 at 9:22 PM
news.karthihegde.dev
Never Gonna Print You Up
Discussion | hackernews | Author: ta988

#SecurityResearch
Never Gonna Print You Up
I spent a week breaking my own Prusa MK4S on signed upstream firmware and ended up with Remote Code Execution, which is how I learned that vulnerability research is not a tedious process anymore.
dixken.de
November 10, 2026 at 1:37 AM
news.karthihegde.dev
sshhole
Discussion | lobsters | Author: serce

#SecurityResearch
sshhole
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 5, 2026 at 12:54 PM
news.karthihegde.dev
SourceHut disabled registration bypass | CVE-2026-121728
Discussion | lobsters | Author: mhm

#SecurityResearch
SourceHut disabled registration bypass | CVE-2026-121728
You could register accounts on SourceHut instances who disabled registration
blog.arusekk.pl
November 5, 2026 at 6:54 PM
news.karthihegde.dev
Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware
Discussion | hackernews | Author: p4p1

#SecurityResearch
Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware
Leo Smith's website, specialized in cyber security research, programming and audit. This website also contains my personal cyber security write ups and tools.
leosmith.wtf
November 9, 2026 at 1:08 PM
news.karthihegde.dev
Fake security tools on GitHub push backdoors and infostealers
Discussion | hackernews | Author: sshah03

#SecurityResearch
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.
www.bleepingcomputer.com
November 6, 2026 at 7:44 PM
news.karthihegde.dev
After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings
Discussion | hackernews | Author: panic

#SecurityResearch
After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings
Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been m
www.vulncheck.com
November 10, 2026 at 10:52 PM
news.karthihegde.dev
Show HN: FuckCaptcha – a field guide to 39 CAPTCHA types and how they break
Discussion | hackernews | Author: vasylsmutok

#SecurityResearch
Show HN: FuckCaptcha – a field guide to 39 CAPTCHA types and how they break
Open field guide to 39 CAPTCHA types: identification signals, free and open-source bypass methods, and paid alternatives. Includes a searchable web version. - vsmutok/FuckCaptcha
github.com
November 8, 2026 at 6:07 PM
news.karthihegde.dev
GhostMap: The Android flaw that crashes your phone before you open the app
Discussion | lobsters | Author: strugee

#SecurityResearch
GhostMap: The Android flaw that crashes your phone before you open the app
Bitdefender Labs researchers found that installing a specially crafted app can leave an Android phone stuck in a crash loop
www.bitdefender.com
November 7, 2026 at 6:38 PM
bsidespyongyang.bsky.social
𝗧𝗛𝗘 𝗖𝗔𝗟𝗟 𝗛𝗔𝗦 𝗕𝗘𝗘𝗡 𝗜𝗦𝗦𝗨𝗘𝗗.
BSides Pyongyang 2026 approaches.
On November 18, researchers from across the information-security community will gather online to share knowledge and hard-won experience.
#BSidesPyongyang #BSides #InfoSec #CyberSecurity #SecurityResearch
November 2, 2026 at 10:20 PM
news.karthihegde.dev
Swipeblocked: The phrases your iPhone won't suggest
Discussion | hackernews | Author: lladnar

#SecurityResearch
Swipeblocked: The phrases your iPhone won't suggest
The iPhone keyboard carries a hidden list of thousands of phrases it will never suggest or let you swipe, from slurs to Tibetan independence. Here is the list.
swipeblocked.com
November 6, 2026 at 6:42 PM
news.karthihegde.dev
Hacking the meta ray-ban smartglasses
Discussion | lobsters | Author: ni5arga

#SecurityResearch
Hacking the meta ray-ban smartglasses
Back in July I wanted to check out the pwn2own targets for 2026. Since the rules hadn’t been released yet, I decided I would check last year’s targets in the hope that it would be simil…
p0pcycle.com
November 6, 2026 at 9:14 PM
news.karthihegde.dev
Hundreds of Artex AI hacking tools found publicly exposed to the web
techcrunch | Author: Zack Whittaker

#SecurityResearch
Hundreds of Artex AI hacking tools found publicly exposed to the web
Security researchers found hundreds of servers hosting the penetration testing tool Artex exposed to the internet, allowing anyone access to the hacking tool.
techcrunch.com
November 6, 2026 at 7:12 PM
news.karthihegde.dev
Unlocking any car from X brand in most of the world
Discussion | hackernews | Author: infosecau

#SecurityResearch
Unlocking any car from X brand in most of the world
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
shubs.io
November 9, 2026 at 1:07 AM
yogsec.bsky.social
Google Dork to Find Exposed Laravel Env Files

Example: site:url inurl:.env ext:env

For more tips join Telegram channel t.me/bugbountyusa

#bugbounty #googledork #recon #infosec #ethicalhacking #pentesting #cybersecurity #bugbountytips #googlehacking #securityresearch
November 4, 2026 at 3:24 PM
news.karthihegde.dev
Local privilege escalation vulnerabilities in Linux
Discussion | hackernews | Author: dangelosaurus

#SecurityResearch
Local privilege escalation vulnerabilities in Linux
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
openai.com
November 4, 2026 at 11:54 PM
news.karthihegde.dev
Pushing the Limits with getaddrinfo
Discussion | lobsters | Author: freddyb

#SecurityResearch
Pushing the Limits with getaddrinfo
An IPv4 address is just a 32-bit number, and glibc will accept it in forms you would never recognize. ⁰𝑋⁴5．🯰３₆。⁵₂₈𝟲🯶 is one of them. Anything that judges an address by how it looks can be walked around.
acid.vegas
November 6, 2026 at 3:11 PM
news.karthihegde.dev
My gym forced a social media down my throat. So I reverse-engineered its app
Discussion | hackernews | Author: yewenjie

#SecurityResearch
My gym forced a social media down my throat. So I reverse-engineered its app
Extracting my gym’s QR check-in from its Flutter app, with a rooted phone and a lot of ripgrep.
shayon.work
November 5, 2026 at 5:54 PM
news.karthihegde.dev
Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements
Discussion | hackernews | Author: muricula

#SecurityResearch
Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements
Improving the Xbox 360 Bad Update exploit to trigger nearly instantaneously with near 100% success rate.
icode4.coffee
November 4, 2026 at 10:24 PM