hacker, security researcher; alum @cis_india, @hasgeek; blog at karansaini.com

New Delhi, India
Karan Saini retweeted
Dutch Authorities have arrested 23-year-old Pepijn van der Stap A/K/A "Umbreon", on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters
31
80
804
52,515
₹2 buys a stranger's home address. We tested a Play Store app with 10M+ downloads selling VAHAN/eChallan data, one number plate gave us the owner's full name, father's name, permanent address, insurance policy, chassis and engine numbers, all of which Parivahan masks behind an OTP. This isn't a hack. Researchers at Cyderes traced it to licensed API keys given to KYC companies, now resold on Telegram. IFF has written to MoRTH, NIC & CERT-In demanding a forensic audit, and filed RTIs on 22 Sept. Found your own data on these apps or similar website? Write to policy@internetfreedom.in
47
736
1,263
90,769
Karan Saini retweeted
AI HACKERS HAVE PUT SKATEBOARDING IN CALL OF DUTY MODERN WARFARE 2! 🚨 THIS HAS GONE TOO FAR. ITS TIME TO PACE THE FRONTIER. @DarioAmodei @sama @elonmusk @theo
363
2,269
28,063
6,638,154
Karan Saini retweeted
call of duty 4 multiplayer in the browser showcase, thank you @NotRexed for testing mp with me 😊 discord.slqnt.dev
12
58
655
29,234
Karan Saini retweeted
The impossible has been done reverse engineering Halo CE 128 players in Blood Gulch Decompiled repo is here github.com/bnunu/halo-1
i think the toughest thing to understand is that it literally doesn't matter if your software is open source, closed source anymore - if it's closed source, people can and will RE: its internals, if it's a part of a broader suite, ppl will make it a plugin in their suite, if it's a model that people can blackbox fuzz and the model isnt huge and didn't have incredibly proprietary data, you are going to get copied on the tech so every core product launch probably needs to be treated as an extreme countdown race, before the incumbent with the distribution eats you brutal times to be playing, and extremely valuable/rare to find a corner of the stack that may be defensible and will stay defensible
78
523
6,000
305,986
Karan Saini retweeted
the cybersecurity guys solved ai-risk and are now moving onto solving consciousness. is there anything they can't do?
1
1
15
1,557
Karan Saini retweeted
Private researcher reported a security vulnerability to Chromium on August 4. The fix went into the public source code but Chrome users never got it due to patching timelines. Two Chinese groups, apparently read that public fix, built an exploit chain from it and started phishing NGOs on September 1 using identical code. Technically an N-day but for anyone actually running Chrome, a zero-day. Here the public patch knowledge worked as an instruction manual. Open source means everyone can read the fix. With AI, some people just operationalise the knowledge faster. volexity.com/blog/2026/09/09…
15
61
297
27,901
Karan Saini retweeted
There is no provision or mention of the word VIP (Very Important Person) in the Constitution of India. Article 14 (Right to Equality) guarantees equality before the law and equal protection of the laws to all citizens. @ECISVEEP better explain this arrived on the app in mid-Sep.
16
382
1,003
23,412
Karan Saini retweeted
Two officers of US-based digital forensics firm Oxygen Forensics have been arrested for allegedly lying to US gov customers. They claimed Oxygen was American and the software was developed in US, though company is owned by Russians and developed in Russia zetter-zeroday.com/us-based-…
6
244
423
58,699
Karan Saini retweeted
Message from ECI official to his juniors across the district. Says it all about SIR and the ECI
Delhi #SIR: While common citizens suffer, ECI runs a hidden and off-record drive to guarantee that 'VIPs' get on final voter list, by hook or crook. By @ayushikar1998, @ShubhangiJourno, @TweetSumedha & @DikshyaKoirala7. Ed.: @furquansid 1/2. reporters-collective.in/trc/…
28
730
1,851
207,233
Karan Saini retweeted
The Election Commission is three people, not ONE: a Chief and two Election Commissioners, equal in rank. By law they decide together. Unanimously if they can, by majority if they can't. Two of three is a majority. (2/10)
226
2,211
8,186
284,259
Karan Saini retweeted
Too much negativity about UPI charges. I for one cannot wait to pay 1% surcharge on my 50% ethanol fuel on my way to buy 90% rubber paneer
48
2,337
19,745
198,778
Karan Saini retweeted
This was the most depressing news in a long time. Fake and poor quality medicines and relabelled drugs are not new to India. It has led to death of children and adults in large numbers across decades and is a pressing concern. But this was another kind of monster. Calculated, premeditated and utterly vile - to do this to patients, especially cancer patients, most of whom take loans to pay for their treatments. The investigating team MUST be transparent about: the timeline, drugs and their (labelled) brand names, type of formulation (injectable and non-injectable) batch number and manufacturing details and clinic/hospital these were allotted to and the patients who received them (including duration). I think the public deserves to know how this has affected them/ family members. Many people would have died because they were on the fake drug - people who should have survived and lived long with proper care. India is a place of disgust. Septic tank of the world. People do inhuman things for money.
123
874
2,982
72,076
Karan Saini retweeted
Big Breaking: NPCI sets MDR on UPI transactions above Rs 2,000 at 0.4%. The NPCI framework also proposes a flat Rs 5 MDR on UPI transactions above Rs 2,000 for specified merchant categories. theheadandtale.com/explainer…
2
9
14
22,102
Karan Saini retweeted
> sandbox > no sand in it 🤨
4
3
36
1,560
Karan Saini retweeted
Labs > We need METR to validate we are using AI safely METR> We were hacked for 3 weeks and didn't notice :) oopsy poopsy
🚨 Attackers stole a METR API key and used it for three weeks, consuming credits worth about $600,000. A fail-open bug disabled Google authentication on a public agent dashboard. The attacker prompted an agent to reveal the key and added SSH persistence. How the exposed app was abused: thehackernews.com/2026/09/at…
81
347
4,079
196,178
submitted two security bugs in Android in the last week, and just noticed i had a low severity Google Pay bug that has been open (accepted for fix) for 4 years
2
3
86
5,691
Karan Saini retweeted
1/n How to steal a democracy? Election Commision of India Edition 🧵👇 Go to voters.eci.gov.in/ View Source and then download the main app bundle.
40
268
1,067
138,177