Akshata

Building with AI 🛠️ | Debugging with hope🌱

[Akshata @Maaksh97]

Cybersecurity is having a rough week.

And these aren’t hypothetical attack scenarios.

Railway warned that attackers may have accessed customer environment variables, including decrypted secrets and API keys.

SBI disclosed that 3,897 customer records containing personally identifiable information were identified among records found on the dark web.

eMudhra’s TLS certificate infrastructure was affected by weak cryptographic key generation. The domestic Indian digital-signature and eSign infrastructure was reported unaffected.

LiteLLM’s v1.107.0 release was compromised with malware designed to steal credentials and enable remote code execution.

Plex Media Server vulnerabilities are being actively exploited to gain access and execute code on vulnerable systems.

GitLab has faced a critical, actively exploited vulnerability rated CVSS 10.0.

#Cybersecurity #InfoSec

[Akshata @Maaksh97]

A useful breakdown of an incident that shows how much of internet security depends on the systems we trust behind the scenes.

[Malay Krishna @Malay4Product]

Every Indian needs to know about this because it is a massive deal for how we trust anything on the internet.

Let me explain.

When you open your bank's website, there's a small padlock next to the web address. That padlock means two things.

First, that you're talking to your real bank.

And second that nobody can read what you type, like your password.

So how does your browser know the website is real?

It checks the website's certificate. Think of it like an ID card for a website.

Your Aadhaar is trusted because the government issued it. A website's ID card is trusted because a certificate authority issued it.

A certificate authority, or CA, is a company that browsers like Chrome, Firefox and Safari already trust. If a CA says "yes, this really is this bank's website," your browser believes it and shows the padlock.

eMudhra is an Indian CA. It's a big one, with more than 60 million certificates issued over the years.

So how does a CA sign these ID cards?

Every CA has a secret number called a private key. It uses that number to put a stamp on each certificate.

Your browser checks the stamp to confirm it really came from that CA.

The whole system only works if that number is impossible to guess.

For the type of key in this story, it's supposed to be around 116 digits long.

Every computer on Earth working together for billions of years wouldn't be able to guess a number like that, just because of the sheer combinations that exist.

But here's what happened.

On October 17, Mozilla got a report that the private keys behind eight eMudhra certificates had been compromised.

The report came through a person called Wayne on Google's Chrome team.

The keys weren't 116 digits long.

All eight keys were smaller than 256. Security researcher Scott Helme found that one of them was just the number 4. Others were 66, 155, 156, 230 and 237.

So anyone could break them by trying 256 numbers. A basic laptop does that in less than a second.

Mozilla didn't need to know how Wayne did it. Its own team recovered the keys within two hours. Since then, several other people have found them on their own too.

To understand the gravity of the problem, a bad actor could make fake ID cards for any website they want.

Your bank, your email, a government portal.

Browsers that trusted eMudhra would have checked the fake stamp and shown the padlock like everything was fine.

If someone could get between you and the internet, say on public Wi-Fi, they could show you a fake site with a real-looking padlock and read or change what you send.

eMudhra says a script used during its key creation process back in April 2025 had a flaw. It made a second, much weaker set of keys, and those were used by mistake to create the certificates.

That means these weak keys were there for about a year and a half before anyone caught it. eMudhra says the person who found it may have used AI-assisted techniques.

The good news is that the response was fast.

Mozilla received the report at 8:06 pm UTC on October 17 and had pushed a block to Firefox users by 10:59 pm.

Google, Apple and Microsoft have also blocked these certificates for their users.

eMudhra revoked all eight the next morning and stopped issuing new certificates from the affected root.

Mozilla is now removing that root certificate from Firefox's trusted list altogether.

But there's still a lot of clean-up to do.

Browsers are mostly covered. But plenty of apps, servers and backend systems don't check these block lists. They need software updates to stop trusting the bad certificates, and some of those updates are still pending.

Real websites that used eMudhra are also affected. Yash Kadakia, founder of Security Brigade, estimates around 30,000 legitimate certificates will need to be moved over. A lot of those are likely Indian businesses and services.

See, we're moving our whole lives online, UPI, banking, tax filing, DigiLocker, government services.

All of it rests on this invisible layer of trust.

So, when an Indian company that's trusted by every major browser makes a mistake this basic, it hurts how the world sees Indian digital infrastructure.

This has happened before, and it went very badly.

In 2011, a Dutch CA called DigiNotar was hacked, and fake Google certificates were used to spy on people in Iran.

Browsers stopped trusting it completely, and the company shut down soon after.

For now, here's what you can do. Keep your browser and apps updated on your phone and laptop.

Be careful on public Wi-Fi. Type your bank's website address yourself instead of clicking links.

eMudhra still owes India a clear, public explanation of how a key that protects millions of people ended up being the number 4.

[Akshata @Maaksh97]

Three cybersecurity incidents. Three different vulnerabilities.

1. SBI data exposure
Reports on October 21, 2026, highlighted 3,897 SBI customer records found on the dark web, raising concerns about the exposure of sensitive personal information.

2. Critical PHP vulnerabilities
Critical vulnerabilities in PHP prompted emergency security measures, with some websites taken offline while operators worked to protect their systems.

3. AI agents and excessive permissions
Security concerns around AI agents accessing live systems and sensitive data highlight the risks of excessive permissions and exposed credentials.

Different incidents. Different attack surfaces. The same lesson: security gaps can have real consequences.

#CyberSecurity #InfoSec #AIsecurity

[Akshata @Maaksh97]

Your data can be encrypted and still be vulnerable.

Because encryption is only as strong as the way it’s implemented.

A weak password, an exposed encryption key, or outdated algorithms can undermine the protection.

That’s why security teams don’t just ask:

“Is the data encrypted?”

They also ask:

->Who can access the keys?
->Where are the keys stored?
->How often are they rotated?

Protecting the data matters. Protecting the keys matters just as much.

#Encryption #Cybersecurity #GRC

[Akshata @Maaksh97]

If we can’t explain something simply, do we truly understand it?

We can memorize terminology, repeat definitions, and sound knowledgeable.

But explaining a complex idea in plain language, without losing its meaning, requires a deeper level of understanding.

Clarity is a better test of knowledge than complexity.

[Akshata @Maaksh97]

@dennis_creates Exactly. It’s easy to end the day with a lot of effort and very little to show for it.

[Akshata @Maaksh97]

We talk a lot about productivity, but rarely about the cost of constantly switching between things.

A little coding. A little reading. A little content creation. A little business research.

At the end of the day, you’ve been busy for 10 hours, but nothing feels finished.

Being occupied with many things and making meaningful progress are not the same thing.

[Akshata @Maaksh97]

The most underrated part of building something is how much it exposes what you don't know.

You start with an idea. Then you run into a problem you didn't anticipate, learn a skill you didn't plan to learn, and rethink an assumption you were sure about.

Building is basically a continuous cycle of discovering how much you still have to figure out.

And that's probably the point.

[Akshata @Maaksh97]

Why does every other post on X start with:

“I’m sorry, but Claude can WHAT?”

Same dramatic hook.

[Akshata @Maaksh97]

US startup Tavus claims its AI avatar, Griffin, fooled 48% of participants into thinking they were talking to a real human during a simulated interview.

Imagine AI avatars being used in hiring, education, and customer service.

The bigger question isn't whether AI can look human anymore.

It's whether we'll always know when we're talking to AI.

Would you be comfortable interviewing with an AI that looks and behaves like a real person?

#AI #FutureOfWork #ArtificialIntelligence

[Akshata @Maaksh97]

Entry-level jobs aren't just jobs. They're where people learn how work actually gets done.

If AI takes over those tasks, where will the next generation gain experience?

Companies may save time today but could face a talent gap tomorrow.

The question isn't just which jobs AI can automate.

It's how people will gain the experience needed for the jobs that remain.

#AI #FutureOfWork #Careers

[Akshata @Maaksh97]

As AI agents gain the ability to take actions, not just generate answers, a new question emerges:

How do you prove an AI agent is safe before giving it access to real systems?

This is where AI governance moves beyond policies and into testing, monitoring, and controls.

Can we scale AI autonomy without scaling risk?

#AI #AIGovernance #GRC

[Akshata @Maaksh97]

“Microsoft president says milk faces more regulation than AI.”

Brad Smith is calling for global AI safety rules, including:
-> Independent evaluations of AI systems
-> Incident reporting when things go wrong
-> Emergency shutoffs for rogue AI agents
-> Notifying people affected by AI-related breaches

AI governance needs to catch up with AI capabilities.

#AI #AIGovernance #GRC

[Akshata @Maaksh97]

One thing I’ve realized about learning:

You don’t need to understand everything before you start.
You start confused.
You make mistakes.
You ask questions.
You connect the dots.

And one day, something that once felt impossible becomes second nature.

Don’t let being a beginner stop you from becoming good at something.

[Akshata @Maaksh97]

If you want to become more confident, stop waiting for confidence to arrive first.

Give your brain evidence.

Speak even when your voice shakes.
Share the idea before it feels perfect.
Take the opportunity before you feel ready.
Do the thing you keep telling yourself you can’t do.

Every small act of courage becomes proof

[Reads with Ravi @readswithravi]

I’m in love with this sentence:

“One of the most underrated skills you can learn is the ability to ignore your mood and stick with the plan.”

[Navalism @NavalismHQ]

Instead of treating events as wins or losses, ask “Did I learn something I can apply in the future?”

If not, you must treat it as a loss.

@naval

[Akshata @Maaksh97]

I always mixed up Burn Rate and Churn Rate

Burn Rate-> How fast a startup is spending money.

Churn Rate-> How fast a startup is losing customers.

Burn = money out.
Churn = customers out.

[Akshata @Maaksh97]

I’ve been learning some startup terminology recently

Here are a few basics:

MVP - Minimum Viable Product
The simplest version of a product you can launch and learn from.

PMF - Product-Market Fit
When your product solves a problem people genuinely want solved.

CAC - Customer Acquisition Cost
How much it costs to acquire one customer.

LTV - Lifetime Value
The total revenue a customer is expected to generate over their relationship with your business.

Burn Rate- How quickly a startup is spending its cash.

[Akshata @Maaksh97]

What is a control actually doing?

A control isn't just a document or a checkbox.

It should reduce a specific risk.

For example:

Risk: Unauthorized access to sensitive data
Control: MFA for privileged accounts
Evidence: MFA configuration/report
Result: Lower likelihood of unauthorized access

Risk -> Control -> Evidence -> Assurance

It’s not just about having controls.
It’s about being able to show that they actually work.