Shanmugham Sundaram

Wannabe Lawyer. Into S/W Architecture . Middleware aka Backend. Views are personal only. RTs are NOT endorsements.

[C E T Moorthy @CETMoorthy1]

For lot of people who were 🔥🔥🔥🔥 for him .
This is just the beginning 🤷🏻‍♂️

[Abhimanyu | @AbhimanyuX_]

Biggest achievement of 2026.

Found a Hindu AC repair and service guy. with all Hindus in his team.

[Sona🐾🇮🇳 @sona_sebin]

K T ராகவன் எல்லாம் உங்களுக்கு hero வா தெரியும்போது அண்ணாமலை அண்ணா உங்களுக்கு youtuber ஆ தெரிவது ஆச்சர்யம் இல்ல..

உங்க அப்பா அம்மா வளர்ப்பு அப்டி ன்னு கடந்து போறதே சரி

[Gabbar @GabbbarSingh]

Vaibhav Suryavanshi reached his home. That polyester curtain with holes, threaded by a rod, is a key middle class aesthetic. ♥️

[S. Ranganathan @rangats]

@annamalai_k should file criminal defamation case against @RAJAGOPALAN1951 for his repeated bad mouthing , lies

[Vector Mind (ཧེམ་) @thevectormind]

@thekaipullai Sometimes, corrupt officials are deliberately placed in key positions because they are useful to the people in power.

[Shanmugham Sundaram @shansandroid]

@vijayshan @man_madras my family tooo :)

[The Greatest Pappu fan @girishs2]

Gadkari,Jana Krishnamurthy and Bangaru Laxman became BJP presidents without winning election
Vajpayee himself lost 5 Loksabha election
Advani came thru Rajya Sabha for 4 times
Passing such sly remarks only exposes your ignorance about the party you claimed to support

[Vijaykumar Shanmugam kaadaiyon @vijayshan]

Munnal porn star kt raghavan fan club.

[@GopalanVs- a proud Hindu-(MODI KA PARIVAR) @GopalanVs2]

@rishibagree you mean @mkstalin . Be specific Rishi.

[ghatak @Neetivaan]

Gen Zs are exposing each and every government website brick by brick, absolute cinema and belting b00mer should be the norm.

The country is suffering a lot of these b00mer macrohards

[Mohan Sinha 🇮🇳 @Mohansinha]

When hundreds of men were forced to watch their women being gangraped in Bengal and butchered, then this pile of faeces wasn’t feeling ashamed of India.

[Mahesh 🇮🇳 @Mahesh10816]

We sell 100% pure handloom silk dothis with silver jari border from Salem, straight from the weavers.

Those interested kindly DM

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[Ondippulee | ஒண்டிப்புலி @Ondippulee]

எங்கள் ஆன்மீக குரு அண்ணன் @CETMoorthy1 அவர்களுக்கு இனிய பிறந்தநாள் வாழ்த்துக்கள் 🙏🏿🥳

[Ganesh S🇮🇳🚩 @ariyalooran]

@prapaarr Not knowing anything on a subject if a dickhead wants to participate and yet run away from debate , he uses a 19th century American term 'Period'! Easiest way to end the debate that connotes Authoratirianism and fascism - "I am right"!
But in bio, say Ambedkar, Soriyaar🤦

[J Gopikrishnan @jgopikrishnan70]

@MaaDiwakaram @narendramodi @EduMinOfIndia Don't bring Voting preferences in this CBSE chaos ... Govt must answer

[Aditya U @AdityaU82378240]

@YMehta_ @Olacabs @Uber Rebook a cab if rating less than 4.85. Drivers above this rating 90% chance they are better. Rest 90% chance they are horrible

[Ganesh S🇮🇳🚩 @ariyalooran]

@KasthuriShankar @arunraajkg At the end of the day all are off shoots of Dravidiya politics.. Don't expect anything different..

[வந்தியத்தேவர் @Vanthi_Off]

இனிமேல் எல்லாம் இப்படி தான்..

#DMK_GenZ