Ritam Dey

[Enclave @EnclaveAI]

We got Microsoft Authenticator to hand over account tokens to a fake Teams app.

The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking.

The result: full delegated access to mailbox, files, and calendar through Microsoft Graph.

Full write-up by @ofekdavidlevin with code and PoC: https://t.co/P5KL7wB021

[Manoranjan Pegu @manoranjanpegu]

Increased brutality and the selective use of repressive laws in Arunachal Pradesh and other parts of NE India to curb dissent (laws and measures not applied in same manner elsewhere), constitute a form of structural racism,entrenched in the legal and institutional framework.

[Callan @callanxai]

Anthropic engineer:

"You're not supposed to prompt Opus 5.5

You're supposed to build a system that prompts itself. At Anthropic, 90% of our engineers have already built such systems"

In 30 minutes she shows exactly how Anthropic builds agents that remember, fix their own mistakes and get sharper with every run.

This beats any $1000-$2000 course on agents I've seen.

Watch it, then read the article below ↓

[JFrog Security @JFrogSecurity]

🚨 Brotli2Shell goes beyond HTTP2Shell.

CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.

JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.

We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.

Full research and technical details in our blog 👇

[Geo Blocked in India 𝕎 @geoblockedindia]

On 21 October, Reddit submitted information concerning an Indian government takedown order covering 26 URLs. Reddit has compiled with the order and all 26 URLs have been geo-blocked in India.

The URLs link to posts across multiple subreddits, covering a range of subjects.

🧵

[Surya Yadav @suryaupse]

Why is no one talking about Arunachal Pradesh?

[Prashant Bhushan @pbhushan1]

What is happening in Andhra Pradesh is extraordinary. Opposition candidates are being brazenly prevented by the ruling TDP goons from filing nomination papers. All in full view & connivance of the police & poll officers!
TDP making a mockery of Democracy

[bruh @moregechhi]

goenka babu doxxing his employee post pujo is peak kolkata corp behaviour

[Ritam Dey @confusedcoder18]

@adam_cypher @HQuarterma43504 That's clearly not true. NIC was compromised, they still are an intermediate CA although they only manage cert for Indian government and it's agencies only.

[Rajashree Agrawal @rajashree]

Making sure I state it clearly:

We can literally patch and prove bug-freeness of the entire software stack running in production. With AI that exists right now for ~$100m.

This means no more software-level hacks. I know it sounds too good to be true, but it isn't. AMA.

[Frank @jedisct1]

php2shell - CVE-2026-109618 / CVE-2026-109619 https://t.co/h6ReEYKknQ

[Mike Dodds @miike]

Absolutely wild results in the details:

- Claude built and formally verified a Python interpreter
- Claude wrote ~1Bn lines of Rocq
- Claude built an x86 semantics that can boot Ubuntu

[Ritam Dey @confusedcoder18]

@NarinderMudii Can you upload that file to https://t.co/GnycThob7s? @malwrhunterteam

[starlabs @starlabs_sg]

We built a full-chain QEMU/KVM escape on RHEL for Pwn2Own Berlin 2026.

Guest to host root to cross-tenant code exec. ~100% reliable in 10s.

Then came the toughest mitigation of all: the registration queue. 🤡

Our HITCON 2026 talk: “Pwn2OwNothing” 🧵

[Paulos Yibelo @PaulosYibelo]

Context about how I got CVE-2026-99999: it wasn't assigned by incrimental luck. There were nearly 2k unassigned CVEs before it. The Linux maintainers felt it deserved the special number because of impact+new attack surface for KVM escapes and offered it. It was a prize! I was just telling someone it feels like graduation from cybersecurity. So yeah it's intentionally assigned, and I'll be eternally grateful for it.

[Ritam Dey @confusedcoder18]

@AnukramWrites That guy is angry at a AI generated porn soft porn account

[Arindam Majumder @ari_maj]

It's not only the pandals. Delhi police and paramilitary forces suddenly came out in full force with sirens blaring & cleared entire CR Park at 11 PM

On being asked it multiple officials of @DelhiPolice said permission has been granted only till 11 PM

Quite surreal to see such scenes in Durga Puja

[All India Trinamool Congress @AITCofficial]

No police, no civic volunteers, no ambulances, no crowd management! This is what local residents are stating in the wake of the tragic stampede at Chorebagan Puja Pandal.

@KolkataPolice and the @BJP4Bengal administration must answer for these grave lapses. Public safety cannot be treated so casually.

As the death toll rises, who will take responsibility? Will @SuvenduWB accept accountability and resign?

On the very day @AmitShah arrives, Bengal is confronted with this heartbreaking tragedy.

Shameful state of affairs!

[Niemand @niemand_sec]

Congrats to the whole team involved in this effort!!

Take a look at the blogspot here!

https://t.co/jl8AdK0xNu