Krishnadath Mishra

Stoa'23 | Product | Fintech | Memes | Mumbai

[Ghar Ke Kalesh @gharkekalesh]

Cameraperson Parth in this Protest💀

[Krishnadath Mishra @Krishnadath10]

@ANI The revolution will not be televised 🌻

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[Tiempo De Tenis @Tiempodetenis1]

Con 39 años.
Luego de 5 horas.
Contra un chico 20 años menor.

Dejó absolutamente todo lo que tenía y no le alcanzó, pero para nosotros eso no importa.

Novak Djokovic DIGNIFICA el tenis.

[Salman Khan @BeingSalmanKhan]

Don't waste your time on these bakwass things . not important, important is that u r so busy that u don't have any time for this rubbish

[Shubh @kadaipaneeeer]

I’m sitting at a shok sabha of a distant relative. Dead silence. White sheets on the floor. Plastic chairs lined up without any order. That familiar mix of hot tea and uneasiness in the air.

A few feet away, five uncles are talking. All above sixty. Men who’ve watched governments change every few years, but whose opinions have somehow stayed exactly where they were decades ago.

One of them adjusts his specs and pulls out his phone & starts playing a video of a Hindu man being burned alive in Bangladesh by a Muslim mob. The volume is low, but the visuals do all the work. They begin discussing his caste. Someone brings up how a neighbour lost his parents during Partition.

And then, almost seamlessly the topic shifts.

Bangladesh becomes Delhi pollution.
Pollution becomes the Aravalli mountains.

Three out of five uncles confidently declare that the Aravalli ranges are going to be removed. The other two look surprised and ask why. The answer comes instantly because the Aravallis “circle” Delhi. Because of them, air can’t pass. “Delhi ek katore ki tarah hai,” one uncle explains proudly, as if he’s just studied climate science.

Mountains are bad.
Cut mountains.
Pollution solved.
& our favourite political party BJP, apparently has cracked the code.

I’m guessing this kind of wisdom came from either a WhatsApp forward or that Rajat Sharma viral clip where the same logic was delivered with dangerous confidence. No one questions it. No one asks how air actually moves. Confidence is enough. Facts are optional.

“But kuch bhi ho bhaisaab,” one uncle says, wrapping it all up neatly, “kaam toh karwa rahi hai sarkaar. 1–1.5 lakh naye highways banwa diye pichle paanch saalon mein.”

Another uncle cuts in, clearly waiting for his turn. Illegal mining used to happen during Congress. When Ashok Gehlot was CM in Rajasthan & Kejriwal in Delhi. Now everything is under BJP, so it’s organised. That’s why they’re removing mountains and forests. Kyunki khodne wale toh waise bhi khod jayenge aane wale 10 saalon mein.

Important for development and infrastructure, apparently.

My father and I sit quietly. Not because we agree but because arguing facts with people who think mountains trap air like a closed pressure cooker is exhausting. You don’t debate science with belief.

For them, air pollution isn’t a health emergency. It’s just another topic.

The Aravallis aren’t ecosystems.
They’re obstacles.

Then someone casually adds, “But the parents of that Hindu in Bangladesh were originally from India only. Yaha hota toh zinda rehta.”

The sentence lands & just stays there. No discomfort. No silence. As if violence becomes easier to digest once you attach migration history to it.

That’s when it really hits me.

These aren’t extremists.
They’re not Twitter trolls.
They’re not screaming under news posts.
They’re uncles at a condolence meet.

People who vote religiously. People whose opinions travel across dinner tables, living rooms, and family WhatsApp groups. Religion and caste are matters of pride. Nation comes first. Doesn’t matter if they belong to a dominant caste or not but the pride is intact.

The air you breathe.
The forests that cool your cities.
The mountains that store water and life.
The country they claim they love the most
All reduced to chai-time opinions.

Sometimes I feel India won’t fix itself anytime soon cause it is damaged beyond repair & we can’t blame one government or political party for its present condition. Maybe it’ll take a few more decades for us to become civilised.

The real problem isn’t a lack of solutions. It’s that being loudly ignorant has been normalised and even celebrated. When misinformation becomes identity and critical thinking is treated as elitism, progress stops.

And the scariest part? They genuinely believe they’re right & doing their duty by protecting the nation by forwarding one WhatsApp message to ten more people.

[Mads @europemaxxed]

Me after completing exactly one task on my to do list

[Krishnadath Mishra @Krishnadath10]

Season in reflection
https://t.co/cLSls8WTla

[Dilip Kumar @kmr_dilip]

Sports is for everybody and every body. Never tell yourself you can’t do it. You are never too late. That’s Shilpa, my friend and training partner. You can see the pain on her face. That’s because she’s racing the clock to get to the finish line of a marathon. She is not a professional athlete but a senior exec in her mid 40s working in a tech company. For the past 15 years of running, she had one goal. To qualify for the Boston Marathon. And in this race she had to run under 3hr 45mins to qualify for her age category.

Why am i sharing this? We’ve a narrative in our society that people working 9 to 6 are always busy. And they can’t pursue goals which are outside their life at work or home. I’ve seen Shilpa train through pain, bad weather, and fatigue with consistency and no drama. For 16 weeks of the training we did together, there were good and bad days and days of self doubt & confidence.

What’s invisible in this frame is also the tough times she had to endure mentally. Loss in family, work stress and injuries. Shilpa always had a purpose towards running. And we’d made a promise to each other- both will try to qualify for Boston. I made another promise to come back after finishing my race to cheer & run with her for the last few miles. That’s me in the picture behind her.

We all have a hidden identity in our life. Sometimes it’s an aspiration to be something we always wanted to be or the pursuit of discovering the unknown. Playing sports is life’s way of asking, how bad do you want it? And why? You can see it in her face. That’s what giving everything looks like to find the “why”.

Play sports to find your why. You’re never too late.

[Kunal Shah @kunalb11]

Inefficiency is the largest employer of the world.

Remove inefficiency too quickly with tech and you are setup for a major civil unrest.

[gaurav @gaxrav]

people will always attack you if you choose your own values, beliefs, and live on your own terms. it’s not out of hatred tho, but envy. it’s as if your authenticity reminds them of their cowardice. makes them feel degraded, like ordinary beings.

it shows them what they could've been, but chose not to: free.

[Aviral Bhatnagar @aviralbhat]

A small cart from Ahmedabad created the 1,000 Cr Havmor brand, with the family now audaciously re-attempting ice cream glory with Hocco:

- Satish Chona made ice cream creatively on a cart in Karachi in 1944
- Post-Partition, lost everything struggled in Dehra Dun and Indore trying to sell ice cream
- Moved to Ahmedabad, sold from pushcart outside the railway station
- Ice cream finally worked with customer wanting to “Have more”, becoming Havmor
- Sales allowed to opened first shop on Relief Road with basement factory in 1953
- Quality, taste and feeling was paramount, which Satish Chona perfected
- Son Pradeep took over, modernised manufacturing and added speed through the 1980s
- Built Havmor to 35% Gujarat share, 12.5% nationally by 2010s
- Turned down acquisition offers, finally sold to South Korea's Lotte for ₹1,020 Cr in 2017
- Grandson Ankit studied at Purdue, worked at Panera Bread in the US, came back
- Launched premium brand Huber & Holly in 2016, kept it post-sale
- Non-compete of 5 years started in 2017 with the 70-year legacy of ice cream gone
- Could have retired with the acquisition, yet kept the fire burning to create Hocco
- Went live in October 2023, just as quick commerce was taking off
- Put 70% of money into GPS-tracked cold chain, not marketing
- Went from 40,000 litres to 1.3 lakh litres a day in 2 years
- Launched 150+ products while Amul, HUL, Vadilal watched
- Did ₹32 Cr in FY24, ₹220 Cr in FY25, targeting 600 Cr in FY26, 20x in 3 years
- Targeting 1,000 Cr of revenue in 2028, goal to be bigger than Havmor
- Raised money at ₹600 Cr in June 2024, then ₹2,000 Cr in September 2025
- Became the fastest growing ice cream brand in the country
- Got to 15,000 touchpoints, put 1,400 pushcarts just in Delhi NCR
- Sits at # 4 now with 33 others competing
- Plans 3 lakh litres a day by next summer, targeting ₹700 Cr for the year

With the epic 80 year story of resilience here (https://t.co/IbVwWCJCh8), Hocco could be sweet victory in the Chona family’s second ice cream innings

[Dr.She @drshe227]

10days ago at 8.48 am I got a call from my sister while I was sitting in OT and patient was being shifted to OT table. 1st call and I could here only she in calling my name and disconnected. Normally I don't pick calls in morning when inside OT but that day I picked.

[Vir Das @thevirdas]

Madam, with respect. I will take any number of lectures about India's potential from people who live with me, here. It's our job to call out the shortcomings of where we live, relative to where we live. I don't need someone in America to tell me we need cleaner air as if a billion people don't already know that. The notion of 'they just don't know any better', and need to be shown is an archaic entitled NRI notion and reflects an air of superiority. We know, and fight for it, BECAUSE we know.

[Blake Burge @blakeaburge]

A major cheat code in life: The ability to reset fast. You're allowed to start over at 10am, 2pm, or 6:30 at night. Zero reason to let one bad hour carry into the rest of your day. You can’t control what hits you. But you can control how long you sit in it.

[Neil Borate @ActusDei]

Sharing this from a Reddit post. I couldn't stop laughing! This is the sad reality though.

[Aditya Kondawar @aditya_kondawar]

The World of Semiconductors is as unbelievable as it is complex

11 Semiconductor Facts that will surprise you!

A thread, do retweet :)

[Kunal Shah @kunalb11]

@akothari Short videos are human kryptonite.

[Krishnadath Mishra @Krishnadath10]

@akshat96jain Congratulations @akshat96jain 🎉

[Krishnadath Mishra @Krishnadath10]

@_anjalimanu This is just incredible. Thank you for sharing Anjali.