Pramit Kumar Datta

[neural nets. @cneuralnetwork]

While consider Hitler to be the villain of WW2, let's not forget the evil Churchill was. The Bengal Famine wasn't simply a natural disaster. While millions were starving, Churchill's government rejected repeated requests to import Australian wheat into India, continued diverting grain to military stockpiles, and prioritized food reserves elsewhere in the empire. The British "Boat Denial Policy" destroyed thousands of boats and the "Rice Denial Policy" removed rice from coastal districts, crippling Bengal's ability to transport and distribute food. London was receiving reports of mass starvation months before the famine reached its peak, yet relief remained limited. Food prices exploded, speculation went largely unchecked, and millions who could no longer afford food were left to die. The most damning part is that people were not dying because there was literally no food left in the world. They were dying because a colonial government with access to global shipping, resources, and repeated warnings chose not to make Bengal a priority. Around 2-3 million people paid the price for those decisions.

[Pramit Kumar Datta @Pramit17o]

Nisagra didn't get into IIT Kanpur, IIT Kanpur got Nisagra.

[IndiaToday @IndiaToday]

𝐈𝐈𝐓 𝐊𝐚𝐧𝐩𝐮𝐫 𝐡𝐢𝐫𝐞𝐬 𝐍𝐢𝐬𝐚𝐫𝐠𝐚, 𝐭𝐡𝐞 𝐭𝐞𝐞𝐧 𝐡𝐚𝐜𝐤𝐞𝐫 𝐰𝐡𝐨 𝐞𝐱𝐩𝐨𝐬𝐞𝐝 𝐟𝐥𝐚𝐰𝐬 𝐢𝐧 𝐂𝐁𝐒𝐄'𝐬 𝐎𝐒𝐌 𝐩𝐨𝐫𝐭𝐚𝐥

After flagging vulnerabilities in #CBSE's OSM portal, teenager #NisargaAdhikary has joined IIT Kanpur's C3iHub as an OSINT and Threat Intelligence Engineer. The move highlights how responsible disclosure and practical cybersecurity skills are gaining recognition in India's cyber ecosystem.

Read more: https://t.co/OMa3X36twF

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[neural nets. @cneuralnetwork]

😭😭😭😭😭😭😭😭

[Deedy @deedydas]

@cbseindia29 @EduMinOfIndia @dpradhanbjp @sanjayjavin @airnewsalerts @AkashvaniAIR @DDNewslive @PIB_India @PTI_News @PIB_Edu This is painfully embarrassing.

You just asked ChatGPT to “generate an image to show we’re secure?” Do you think everyone is stupid?

[Pramit Kumar Datta @Pramit17o]

@cneuralnetwork https://t.co/I5wswJOuw9

[Narendra Modi @narendramodi]

This is totally false.

Not an iota of truth in this.

There is no question of putting such restrictions on foreign travel.

We remain committed to improving ‘Ease of Doing Business’ and ‘Ease of Living’ for our people.

[Pramit Kumar Datta @Pramit17o]

@AmitShah @MukulAgarwal66 You can fix NTA first

[कुशल मेहरा @kushal_mehra]

Bengal is one of the worst states in India for policing. The first thing the BJP government should do is ramp up police recruitment and stabilise law and order there. Bengal is now a national security issue. So both internal security (police) and external security (borders) need to be ramped up.

[Abhijit Iyer-Mitra @Iyervval]

For those who bought the “cultured civilised” Bengal narrative propagated by the left, read this thread. This was the reality of Bengal the last 50 years - nasty, brutish, violent, full of stagnation & decay. 👇🏾

[Pramit Kumar Datta @Pramit17o]

@IndianTechGuide Also:
Fencing the Indo-Bangladesh Border within 45 days
Clearing DA arrears
Implementation of UCC
Atal Tinkering Labs
Proper implementation of NEP
Provide Citizenship to Hindu Refugees and ensure proper rehab
White paper accounting corruption done by AITMC

[Sanjeev Sanyal @sanjeevsanyal]

The Economist magazine is disappointed that India did not celebrate the 500th anniversary of the Mughal conquest of India. Oh, those ungrateful natives who do not celebrate the gift of civilisation. Who knows, they may even refuse to celebrate the Battle of Plassey. Dangerous trend.....

[NASA's Kennedy Space Center @NASAKennedy]

The planet can spell your name – literally. 🔤🌍

This Earth Day, see your name written in landscapes captured by Landsat: https://t.co/kcP12dhsI2

[Abhijit Chavda @AbhijitChavda]

This is a landmark moment. India has officially begun its transition into Stage 2 of Dr. Bhabha's 3-Stage Nuclear Program.

Stage 1: Pressurised Heavy Water Reactors (PHWRs). This stage is complete and operational. India runs ~22 PHWRs which generate power and accumulate plutonium (Pu-239) fuel needed to feed Stage 2.

Stage 2: Fast Breeder Reactors (FBRs). They use Stage 1 plutonium as fuel and are loaded with uranium-238 and thorium-232 around the core. FBRs convert U-238 and Th-232 into more fissile fuel - more Pu-239 and U-233 (from Th-232). The reactor BREEDS more fuel than it burns. The Kalpakkam FBR is now sustaining a controlled fission chain reaction.

Stage 3: Advanced Heavy Water Reactors (AHWRs) on Thorium. This is the end-goal. AHWRs will use the U-233 bred in Stage 2 as their main fuel, along with Th-232. India's massive Thorium reserves will give India virtually inexhaustible, indigenous, clean nuclear energy for centuries.

India is transitioning into Stage 2 (long way to go) - and demonstrating indigenous mastery of one of the most complex reactor technologies, without foreign assistance.

Congratulations India, and kudos to all involved.

[CSIR-CCMB @ccmb_csir]

With @IndiaBioscience, we are trying to understand the common barriers that young Indian researchers when moving out of India. If you have been one of them, please fill in your responses:
https://t.co/NNNNlNOqZT
@CSIRIndia

[Pramit Kumar Datta @Pramit17o]

@DutchSpace 5.89 mb? Seriously?

[Pramit Kumar Datta @Pramit17o]

@deedydas Also doing a great job!

[Pramit Kumar Datta @Pramit17o]

@deedydas Additional suggestions for Bengali detective : Kataye Kataye( Barrister P K Basu) and Eken Babu

[Karthik Balachandran @karthik2k2]

Suppose 10,000 monkeys take NEET-PG exam (or one persistent monkey takes it 10,000 times). There are 200 questions. The reward for correct answer is 4 and the penalty for wrong answer is -1. If the monkeys don't attempt, they get 0 marks.

Let's assume the monkeys haven't qualified MBBS and randomly mark all 200 questions.

Expected value of a random guess = (probability correct × reward) + (probability wrong × penalty)
= (1/4)(+4) + (3/4)(-1)
= 1 + -0.75
= +0.25

So what will be the group average of this monkey group ?
If we simulate that, we get an average mark of +50. (see pic for distribution, done with R)

Sure, many monkeys will score negative marks, but the group average is still positive.

Now let's turn to human NEET -PG doctor with -40 marks. Government says he/she's competent.

If a doctor can't even beat the average score of a bunch of monkeys, does it matter if they are "competent" because government says so?

Forget MD/ MS, why shouldn't their MBBS be declared null and void ?

[Dr. Dominic Ng @DrDominicNg]

A separate brain imaging study also found coffee drinkers had less amyloid plaque buildup in their brains.

2 cups of coffee a day is looking like a pretty good idea.