athul

Building @SecurityInfi ex @Deloitte | 12+ CVEs

[athul @at__hul]

It’s with great honour, that I would like to announce, I’ve been awarded a medal from @NCSC, part of UK government. I believe I made some difference. I had no idea this was coming to me until I got it. Thanks to @Hacker0x01
#cybersecurity #awards @SecurityInfi

[athul @at__hul]

Patching fixes the bug you know about. It doesn't tell you what else is exposed.

At SecurityInfinity we test your apps and infrastructure the way an attacker would, so you find the next PHP2Shell before someone else does.

https://t.co/rwkZPVKoFb

[athul @at__hul]

PHP just got hit with two critical RCE bugs. Unauthenticated. CVSS 9.2 each.

They affect basically every PHP version back to 5.4.

It's called PHP2Shell, and the patches dropped yesterday.

If you run PHP anywhere, read this 🧵

[athul @at__hul]

Do this today:

1. Check your PHP version
2. Upgrade to a fixed release
3. Don't rely on the temporary mitigations, which weren't sufficient
4. Check logs for odd requests since Oct 17
5. Rotate secrets on anything exposed

[Internet Freedom Foundation (IFF) @internetfreedom]

Statement : Shutting down Telegram is a band aid solution and is a disproportionate answer to exam fraud

The Internet Freedom Foundation objects to the directions announced today in the National Testing Agency's press release on action against the Telegram platform. On the NTA's recommendation, the Ministry of Electronics and Information Technology has, under Section 69A of the Information Technology Act, 2000, restricted access to the whole of Telegram in India until 22 June 2026, and has separately ordered the platform to switch off message-editing for every Indian user until 30 June 2026. This is a blunt, nationwide measure aimed at the conduct of rampant fraud rackets, and on the Government's own admission is constitutionally incompatible.

At the outset it is important to note that Section 69A and the Blocking Rules of 2009 framed under it allow the Government to block access to specific “information” on a computer resource. They do not extend to switching off an entire intermediary, still less to ordering a company to redesign its product by removing a feature for a whole country. In Shreya Singhal v Union of India, the Supreme Court upheld Section 69A because it is narrow and hedged with procedural safeguards. Reading it to authorise shutting down a platform that lakhs use is an overbroad restriction by the NTAs own admission. For the message-editing direction the release identifies no source of power at all. If one exists, the order must say so.

The release argues against itself

A restriction on access has to be the least intrusive measure that achieves its aim as per the constitutional test of proportionality laid down in Justice K.S. Puttaswamy v. Union of India (2017) and applied in Anuradha Bhasin v. Union of India (2020). The NTA's own narration shows the block fails its nodal agency, the release says, “has secured the prompt take-down of a substantial number of Telegram channels, groups and bots”, and this targeted work “is the reason the harm caused by these rackets has been contained to the extent it has”. If channel level takedown contained the harm, the case for a blanket block collapses and hence the Government has reached for a heavier tool while conceding that a lighter one was working. The collateral cost sits on the record too as noted in the press release. The block, the NTA accepts, “affects lakhs of citizens who use the Telegram platform for legitimate personal, educational, professional and informational purposes”. The release also says there is "no such paper available outside the secured examination chain" and that “the security of the examination is unaffected by the action taken”. If the exam is secure and no leak exists, what is being suppressed is rumour, and rumour cannot justify closing a platform when specific blocking and criminal prosecution remain available.

Students use of Telegram

The block of telegram is reactive and ineffective and will punish ordinary users instead of addressing the systemic source of exam leaks. This blocking comes in the final days of NEET preparation, when thousands of students depend on Telegram for study groups, doubt-clearing, and shared resources. Also, it is important to consider that the source of exam papers leak will occur from inside the system, among insiders and across the printing and logistics chain, with the platform being the most downstream channel for distribution. Hence, switching off Telegram, is merely a deflection from the repeated failures that will continue while media attention is directed towards this Telegram ban.

Lack of transparency

At present only a press release from the NTA has been provided, which recommended the block but the reasoned order of MeitY, the authority that issued it, has not been released. The Anuradha Bhasin decision requires that orders restricting access be published so they can be tested in court. Here the order, and the reasoning of the committee behind it, stay out of view, and we do not know whether Telegram was heard at all. An announcement of a block is no substitute for an order the affected party can challenge.
Blunt to enforce and very easy to evade
Usually, app-level blocks run through IS-level DNS and IP filtering. They are over inclusive, sweeping in lawful use, yet simple to evade as a determined exam leak racket moves to a VPN or a mirror within minutes while ordinary users lose the service for a week.

We ask the Government to:

1) Publish the MeitY Section 69A order and the NTA recommendation behind it, with reasons;
2) State the legal basis for the message editing direction, or withdraw it;
3) Confirm whether Telegram was given a hearing under the Blocking Rules, and place the committee's record before any court that hears a challenge; and
4) Lift the platform-wide restriction and rely on the targeted takedowns the NTA itself credits with containing the harm.

We emphasise that the NEET (UG) 2026 re-examination is worth protecting and it concerns the future of lakhs of aspirants. It requires securing the entire process of examination rather than reaching for purported band aid solutions that instead cause more harm. The State cannot switch off a service used by lakhs to answer the wrongdoing of a few, and cannot do it through an order no one affected is allowed to read. On its own facts, the Government has done both.

New Delhi, 16 June 2026.

[Pavel Durov @durov]

Indian telecom Reliance is sabotaging access to Telegram for millions of users OUTSIDE India (including the UAE) via a rogue method called BGP hijacking.

The sabotage seems intentional, as Reliance has ignored multiple reports.

This may be part of a competitive war, as Reliance is partially owned by Meta — the company behind WhatsApp.

Network operators are advised to reject unauthorized BGP announcements from Reliance (AS18101) to prevent route hijacks and ensure stable Internet access for their users.

Such abuse of global Internet routing is alarming. I wouldn’t be surprised if Reliance/WhatsApp were also behind the recent lobbying effort to ban Telegram in India.

[Kapil @kapsology]

We don't care whether the government wants to push E27, E85, or even E100.

What we do care about is getting the right fuel for the vehicles we own.

Stop forcing E0 and E10-compatible vehicles to run on fuels their engines were never designed to handle.

Consumers are not a testing ground for policy experiments, nor should they be forced to bear the cost of reduced compatibility, performance issues, or long-term engine damage.

Fuel choice should be based on vehicle compatibility, not government mandates.

[Suraj G Naik @yoursurajnaik]

Modi-Gadkari's Ethanol Scam?
Petrol prices soaring, mileage falling, engines suffering.
The public is being sold a "clean fuel" dream while paying the price.

#BasantKhedia

[V D Satheesan @vdsatheesan]

Wrote to Hon'ble Prime Minister Shri @narendramodi seeking urgent intervention on behalf of Indian healthcare professionals, predominantly from Keralam, affected by visa-related issues following the closure of Iranian Hospital, Dubai. Requested the Government of India to engage with the #UAE authorities and help secure a fair and compassionate resolution for the affected families.

[Saravanaprasad Balasubramanian (Modi ka Pariwar) @BS_Prasad]

What is the case of Penarayi Vijayan 's daughter Veena.
There is little substance in party leaders claiming that the ED raid happened immediately after Satheesan met Modi. One could have believed that argument if only Chennithala’s name, apart from Veena’s, had appeared in the “monthly payment diary.” But that is not the case. Kunhalikutty’s name is there, and so is someone identified as “PV.”
The raid came after the High Court dismissed a petition filed by CMRL owner Sasidharan Kartha and others seeking to stop the ED investigation.
The case is that Veena Thaikkandy received ₹1.72 crore as monthly payments from the company CMRL between 2017 and 2020. The allegation is that Veena received ₹5 lakh per month and her company Exalogic received ₹3 lakh per month for services that were never actually provided. These findings came out in the Income Tax Interim Settlement Board’s order.
The board also stated that the bribe was paid because of her connection to a prominent individual. Agreements were made claiming that IT, marketing consultancy, and software services would be provided, but no such services were delivered. However, CMRL owner Sasidharan Kartha testified that payments were made every month.
The order was issued by a board comprising Amrapalli Das, Rameshwar Singh, and M. Jagadeesh Babu. The board accepted the Income Tax Department’s contention that the money transferred through banks was part of an illegal transaction. The department had conducted raids at CMRL offices on January 25, 2019. The company was accused of inflating expenses and evading taxes. The ruling came as part of the settlement application submitted by Kartha.
Evidence of payments made to political leaders, trade union leaders, officials, police personnel, and media figures was recovered from the company’s Chief Finance Officer K. S. Suresh Kumar. Kartha had also allegedly paid ₹10 lakh each on two occasions to a YouTuber.
The agreements with Veena were signed in December 2016 and March 2017. Veena received ₹55 lakh, while Exalogic received ₹1.17 crore. K. S. Suresh Kumar and Chief General Manager P. Suresh Kumar testified that no services were actually received in return.
Credit : Ram Chandran

[Moksh Yadav @MokshYadav007]

I am a CBSE Class 12th Student

When i saw my copy i only got 33/80 so I applied for my scanned copy.

Yesterday I received my scanned copy from CBSE and when I opened it , it wasn’t even my handwriting , black pen was used when i didn’t even use it .

[Dr Ranjan @DocRGM_]

Cockroaches HONK at the VIP Convoy

[Giorgia Meloni @GiorgiaMeloni]

Thank you for the gift

[Helle Lyng @HelleLyngSvends]

Primeminister of India, Narendra Modi, would not take my question, I was not expecting him to.

Norway has the number one spot on the World Press Freedom Index, India is at 157th, competing with Palestine, Emirates & Cuba.

It is our job to question the powers we cooperate with.

[🚨Indian Gems @IndianGems_]

This is getting hilarious

PM Modi at 5:00 PM: “Please use the metro and save fuel.”

Exactly 16 hours later: Absolute cinema on the streets of Rajasthan 😭