calliphornia

he/him

[Zadig @piebyfour]

Actor Sobhita Dhulipala: "I have a feeling communism is going to win someday."

[nisarga @ni5arga]

they can kill the internet but they can’t kill the truth.

censorship is what governments reach for when they know the footage speaks for itself.

[Pratyusha @BalijaBahujans]

Brahmins exploited women in the name of so-called Sanatanam Dharma. Manuwaad designed it. Golwalkar praised it.

In Kerala, Namboodiri Brahmin men practised "Sambandham" - temporary sexual alliances with Nair women. No marriage, no rights for the woman or her children. The children stayed in the mother's matrilineal Nair tharavad while Brahmin men walked away.

This was systematic exploitation in the name of religion and custom.

And who defended it? Former RSS chief Golwalkar himself praised Sambandham, claiming it "improved the Nair breed".

[Telegram Messenger @telegram]

@KartiPC @NTA_Exams You should also shut down all the shopping malls since there might be a theft in one of them. And close the roads because I heard someone was speeding.

[calliphornia @calliphornia]

we've reached the stage of fascism where it's okay for america to bomb indians so that anant ambani can show tigers to trump's sons

[Kushan Mitra @kushanmitra]

Problem is that these aren't Indian flagged vessels. We don't know who they are operating for - are they carrying sanctioned Iranian crude?

[alex lei @alexL_E_I]

in accordance with Pride month, Iran will shut down all straits

[The Hindu @the_hindu]

18-year-old Sarthak Sidhant, who uncovered CBSE tender irregularities through coding and research, says he was “just ordinary” and only followed his curiosity, a discovery that has unexpectedly pushed him into the national spotlight

✍️Mantasha Ahmed
https://t.co/xRXX14ryAh

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[AIN @Tejusurya_]

A fire breaks out at the Ministry of Education office just days after NEET, CUET and CBSE exam irregularities sparked nationwide outrage and a detailed probe was most likely on the cards.

[calliphornia @calliphornia]

cbse been facing a lot of heat recently

[वरुण 🇮🇳 @varungrover]

A 17-year old having more courage, skills, and love for the nation than many big news corporations and their multiple award winning journos combined.

[C2H6 @friedchickenop1]

The Indian Anime Community has come a long way

[nisarga @ni5arga]

when you argue with someone online but you have their answerBooklet.pdf

[Rahul Gandhi @RahulGandhi]

CBSE’s May 2025 tender required answer sheets to be scanned with automatic robotic scanners, spines preserved, at a minimum of 300 DPI.

The tender re-issued in August quietly removed all of it. “Scanners” became generic. Resolution dropped to 200 DPI.

Now we know what that meant in practice. It has been exposed that COEMPT scanned the answer sheets using mobile phones.

The blurred copies, the missing pages, the unscanned books - they are not “errors.” They are the predictable outcome of a contract written to fit a vendor.

This is fraud. And every child whose marks were wrongly evaluated is a victim of it.

This morning, the Prime Minister had time to speak about mangoes. He has not had time to speak about 18.5 lakh children whose answer sheets were scanned with phones.

Dharmendra Pradhan ji still sits in office.

Modi ji’s silence is no longer indifference. It is complicity.

[nisarga @ni5arga]

how me and the boys be moving after cbse admitted that there indeed was a security breach:

[Pallavi @PallaviSAnand]

people are suffering, bridges are collapsing, women getting raped has become normalised, deadass education system and paper leaks, hunger index on the rise, lgbtq people are being oppressed but let me get a fckin packet of chocolate to entertain the internet world wow im so cool

[Dr. Ayesha Ray @DrAyeshaRay]

Dear lord. Who is this man? Is he representing MEA India? For a moment I thought this was a Saturday Night Live skit.

[Nilesh Trivedi @nileshtrivedi]

Discover Indian fiction books by the place it is set in! 👏
https://t.co/cpTzaEEge0