Recent content on Himanshu Anand :: Security & Other Notes
The Anti-India Influence Machine: Troll Farms, Fake News, Newsrooms, Algorithms and AI Scope and disclaimer: This is a cybersecurity research article focused on India because I am from India, India is the information environment I notice most and the change became personally obvious to me after Operation Sindoor. It is not an accusation against an entire country, nationality, religion or political…
TLDR I independently found a heap out-of-bounds read/write in KVM’s SEV-SNP Page State Change handler. A malicious guest VM can corrupt host kernel heap memory and leak its layout, across the VM boundary, as many times as it wants. I reported it to security@kernel.org on May 9, 2026 and they told me someone else reported it a few weeks earlier. This post is the story of that bug, why my fix…
Two Parsers, One JSON, and a Flag Intigriti’s July challenge is called “Canonically Yours” and the whole bug is one silly question: what happens when you put the same key in a JSON object twice? Turns out two different bits of code answer that differently and that gap give you the flag. INTIGRITI{019f8700-4613-74fb-923e-781903e4bee9} The app Its a mini package registry called…
TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installations. Public advisory data identifies versions 1.10.0.1 through 1.10.0.4 as affected by CVE-2026-4986: the PayPal Commerce webhook processed incoming events without first verifying that PayPal actually sent them. In my local lab, a forged event could change the state of a matching payment record. A forged…
If your team trains models or fine tunes LLMs on Vertex AI, one training permission is all it takes to take over the whole project. TLDR; A principal with one permission aiplatform.customJobs.create can run code as google’s managed Custom Code Service Agent, which hands out a cloud platform token (the exact scope Google’s docs says it can’t have) and can mint tokens for any…
TLDR; June 2026 was the biggest Patch Tuesday Microsoft has ever shipped 208 CVEs. One of them, CVE-2026-44815 (This is as bad as Etner blue, Wanna cry isse), is a CVSS 9.8 “DHCP Client Service Remote Code Execution.” I pulled the patched dhcpcore.dll, diffed it against last month’s build and the whole bug fits on one screen: a function called GetOriginalSubnetMask does a memcpy…
TLDR; Three posts ago I wrote baout house was on fire the most import question arises was what we should do next? The attackers already point LLMs at your code. This post is just: point the same LLMs at your own code first read the headers if you are busy. So far this series has been caffeinated me, telling everyone that the sky is falling. The 90 day window is dead.
TLDR; I read five security patches and I derived working exploits from all five. The slowest took 30 minutes and the fastest took two. An LLM did most of the heavy lifting while I pushed buttons, this is the working behind my blog the 90 day disclosure policy is dead: the gap between “patch ships” and “exploit exists” is now measured in minutes. In the first post I…
TLDR; Score severity by collision count. Researchers ship patches not just reports. Companies redesign for a world where the exploit lands before the patch. No vendor pitch just a concrete playbook. The last post went further than I expected. NYT’s Hard Fork picked it up. The Lobsters thread had sharp questions. A few people made a fair point. “The model is broken” is a complaint…
TLDR The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow. That world is gone. LLMs have compressed both timelines to near-zero. I have seen it first hand, and so has everyone else paying attention. This post lays out why the old model is broken, with real stories, and makes one ask to the industry: treat every critical…
I was poking around the OpenSSL source code recently. Not really hunting for anything specific (one of the most heavily audited codebases), just curious about how the new post-quantum crypto stuff was wired up in version 4.0.0. I went in expecting to find nothing interesting. Instead I tripped over a single-character logic bug that leaks cryptographic randomness onto the stack on every signing…
TLDR While looking for a way to stream the India vs Pakistan cricket match on 14th September 2025, I stumbled across a suspicious search result on a europa.eu dev subdomain. It was being abused for blackhat SEO and redirecting users to scam streaming sites. I traced similar behavior across other high-profile domains, reported the issue to CERT-EU via email (after some Twitter help) and the problem…
TLDR I have recieved a legit Zoom doc email from HR “while on job hunt” . It redirected to a site with a fake “bot protection” gate and then to a Gmail credential phish. The attackers exfiltrate creds live over WebSocket and even validate them in the backend. Keep reading for detailed analysis. look mom HR application look mom no job Okay, this is kind of funny (in a…
A step by step guide how to hack webhooks kinda this is a crossover post between threat hunters and bug hunters. at the end of the day it is all about hunting. this post will talk about hunting and threat hunting using webhooks for those who don’t know what webhooks are: webhooks are an easy way to send messages from one service to another. they are simple HTTP callbacks that notify…
Starting Point It all began with a tweet: sdcyberresearch on X This tweet hinted at a Magecart-style campaign involving malicious JavaScript injection to skim payment data. Initial Sample The script was hosted at: https://www.cc-analytics[.]com/app.js The original code was heavily obfuscated: (function() { function _0x1B3A1(_0x1B563, _0x1B3FB, _0x1B455, _0x1B509, _0x1B4AF, _0x1B5BD) { _0x1B4AF =…
In light of recent npm/Node.js supply-chain news, I am resurfacing a small game I built: Typosquat Detective. It’s a quick way to practice spotting look alike domains that phishers love. Play it here → https://typo.himanshuanand.com/ What you will practice (in ~2 minutes) Numbers-for-letters like 1 ↔ l, 0 ↔ o, 5 ↔ s Unicode homoglyphs (Cyrillic/Greek letters that look Latin) Punycode tricks…
I wanted to quickly highlight something I have noticed in multiple cases but this time let me explain with a real example. When code is written purely using LLMs (vibe coded) security often takes a back seat. LLMs work on data and most of what is available at training time (essentially scraping the internet) is NOT “secure by default” A lot of examples floating around online are meant…
If you or your company have been building with large language models (LLMs) you have probably come across the term prompt injection. In plain words, this is when a user tries to trick the LLM into ignoring your instructions and doing something it should not, like revealing its hidden system prompt, disabling safeguards or changing its role. For example: forget everything above and follow my…
Disclaimer: This is NOT a zero-day. This is a learning experience from my journey into secure code review, where I accidentally rediscovered a vulnerability that was patched back in 2014 (CVE-2014-9495). I’m sharing this to help others who are also learning and want to understand how vulnerabilities work in real-world code. Special thanks to Taym The Backstory I’m currently learning…
We are excited to announce the launch of our new API for Cloud Intel Atomic Indicators, a tool designed to provide essential data on malicious IP addresses. This API is a step forward in our commitment to enhancing cybersecurity and is available free of charge. Behind the Scenes: Cloudflare Infrastructure Our API leverages the robust Cloudflare infrastructure, utilizing Cloudflare Workers for…
Greetings Cybersecurity Enthusiasts! I am thrilled to unveil a new project aimed at fortifying the security landscape of Amazon Web Services (AWS) - introducing AWSAttacks on GitHub! This repository is a space dedicated to gathering, sharing, and analyzing threat intelligence related to AWS. AWSAttacks is a meticulously curated collection of Indicators of Compromise (IoCs) that can aid in the…
Hello everyone! I am excited to announce the upcoming launch of our new Slack application - FriendlyIR. This innovative tool, dedicated to the cybersecurity world, is designed to be your trustworthy sidekick for staying updated with the latest cybersecurity news, blog posts, and social media updates. Our website, https://friendlyir.himanshuanand.com/, hosts all the information you need to…
Hello, readers! We’re thrilled to announce a new feature on LegallyBlocked: Blocked Books. This addition goes beyond our initial offering of blocked websites and applications, allowing you to discover which books are banned or restricted by governments worldwide. In an era where information is power, censorship can act as a significant barrier to knowledge and understanding. Our aim with the…
Hello everyone! 🎉 We are extremely excited to announce the launch of our new project, Legally Blocked. It’s a unique platform providing an invaluable resource for internet users worldwide. 🌐 You can access our new website at: https://legallyblocked.website/. What is Legally Blocked? Legally Blocked offers comprehensive, up-to-date information about websites, mobile apps, and online…
Hello, and welcome to my page! I am a Cyber Security Researcher with over 10 years of experience in the field. My passion for cybersecurity extends to both sides of the spectrum - the Red Team’s offensive strategies, where we ‘break’ things to discover vulnerabilities, and the Blue Team’s defensive methods, which involve protecting and securing infrastructures. Over the…
Search