Kalpak कल्पक

Curious

[Kalpak कल्पक @911rk]

♥️

[KailaashChandra 'राजेश्वर' @Nyayakshetra]

@Arun_Kaku05 @Twitter Give some time
Things will improve

From this chaos itself an order will emerge
From this madness itself, new heroes will emerge.

India is going to be perfect place in the world where there would be no discrimination on the basis of caste, language religion or gender

Lets see

[Gems of Mira Bhayandar @GemsOfMBMC]

Look at the Condition of Ghodbunder Road 🤦🏻‍♂️🤦🏻‍♂️

Corporators & Mayor of BJP-led @My_MBMC has decided not to allocate funds to repair the road. And State Govt. is not giving funds because road was handed over to the Corporation in February 2025.

"Let the people die, We don't care"

[Kalpak कल्पक @911rk]

@Prasanna716G @mohakmangal Those folks would be anti national to few select. But to law and many others they aren't. They are normal citizens who are allowed to protest and participate. If you think they are anti national you should approach courts and get them arrested.

[Mr Sharma @sharma_views]

ABHIJEET TURNS MODI’S “PAPER LEAK SIN” LINE BACK ON PRADHAN 🚨

REPORTER: What did injured students tell you?

ABHIJEET 😢: I met them at RML till 1:30 AM. They told me, “Don’t step back. We are not scared. This movement will go forward.”

REPORTER: PM called NEET paper leak a grave sin.

ABHIJEET 🔥: Then name the sinner. It is Dharmendra Pradhan. Speeches won’t work. Remove him.

REPORTER: What happened with JP Nadda talks?

ABHIJEET 😡: JP Nadda is a fraud. He called our panel for dialogue while students were being lathi-charged. Saurav and Ashutosh were held there, their phones taken. It was a trap.

[Kalpak कल्पक @911rk]

@TMCaTweetAway TMT signage is uprooted and lying flat on ground middle of the road near Nature glory parsik nagar. Kindly take care of it.

[Kalpak कल्पक @911rk]

@AdityaBirlaGrp I did send the message. I am yet to receive a response.

[Kalpak कल्पक @911rk]

@AdityaBirlaGrp @tatacapital getting calls from your agents non stop. More concerning is the way the imitate and try being real, also deny being AI. But it is clear that they are AI. I have recorded my conversation. I think @jagograhakjago would be interested.

[VoiceofHiranandaniEstate @HEstatevoice]

All infra work should be planned with involvement of citizens. #thaneringmetro #hiranandaniresidents

[Kalpak कल्पक @911rk]

@roguebits24 Btw Thane only has 450 buses. We have not been allowed to experience the power of full fledged bus fleet yet.

[Kalpak कल्पक @911rk]

@roguebits24 That is valid claim in a certain way. Buses provide you last mile connectivity which the metro can't. While I regularly use metro 1 and 2, I can't emphasize enough how tedious it is to travel to n from the metro station. Widout feeder buses, even metros will fail.

[Kalpak कल्पक @911rk]

@akshaywcam1 @PradhannJi @AmeyKulkarni_21 @Sahilinfra2 @haldilal The reports or the work they have done on this are mostly concerns and questions. The governement has to address it. There are issues with surveys done, descrepencies in claims in the dpr, allocation of tenders are shady. Somebody has to raise these concerns.

[Kalpak कल्पक @911rk]

@Sahilinfra2 @akshaywcam1 @PradhannJi @AmeyKulkarni_21 @haldilal But does the government wants to work with the people?A project of this scale will go through multiple public duscussions, how many happened for the ring metro? What survey was done? The tree survey that was done has incorrect data. Dpr has data from Nagpur survey copied into it

[Kalpak कल्पक @911rk]

@Sahilinfra2 @akshaywcam1 @PradhannJi @AmeyKulkarni_21 @haldilal The ring metro or rail project is actually 3 decade old proposal that has been rejected multiple times. These experts are not just internet trolls, they have worked alongside government to build Indian cities. They have multiple publications to their names.

[Kalpak कल्पक @911rk]

@Sahilinfra2 @akshaywcam1 @PradhannJi @AmeyKulkarni_21 @haldilal Professor Ashish Verma has actually setup a lab that studies urban infra in Indian cities using AI. He has proactively worked on cities and Thane is one of those. Dr. Mhajan too is a veteran and has actually reviewed ring metro/rail thane project 4 times (yes not the first time

[Kalpak कल्पक @911rk]

@roguebits24 Not to argue but I went to Singapore and found the bus transport lot easier to board and deboard and travel than the metro. Personal experience but I thought it is valid. Problem in India is the number of cars on road, buses can solve that problem.

[Kalpak कल्पक @911rk]

@bodkeitis @PradhannJi @AmeyKulkarni_21 @akshaywcam1 @Sahilinfra2 @haldilal https://t.co/v4fSFFvozH

[Kalpak कल्पक @911rk]

@PradhannJi @AmeyKulkarni_21 @akshaywcam1 @Sahilinfra2 @haldilal BTW, the experts - Dr. Sulakshana Mahajan, a resident of Thane and urban planner for over 50 years. The other is Professor Ashish Verma (IIT Bom) who teaches Transportation systems engineering at, IISc Bangalore.

[Kalpak कल्पक @911rk]

@ThaneNeedsMetro @aslamshaikh12 GB road is getting coastal road, Borivali tunnels, Metro 4, 4a and 5 and the Anand Nagar Saket flyover will decongest the majiwada traffic. Also, metro 4 work on ground is in final stages. Do you want to say all of this will have no effect on gb road traffic?

[Kalpak कल्पक @911rk]

@aslamshaikh12 @ThaneNeedsMetro Another issue with ring metro is that it will block the cidco road during construction. A lot of kalwekars use that road to thane station daily. With no alternatives more people will be forced to board jam packed local trains. Perfect recipee
for more accidents.

[Kalpak कल्पक @911rk]

@aslamshaikh12 @ThaneNeedsMetro @ThaneNeedsMetro boarding a local train during peak hours is almost impossible for most Kalwa and mumbraites. There is a recommendation to build LRT system running between Mumbra and Thane station via old pune hway to ease that load which is sidelined because of Ring metro.

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment