Daily Writeups
@Daily_Writeups
3.56K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.56K subscribers
Daily Writeups
⤷ Title: CVE-2025-68637: Critical Apache Uniffle Flaw Exposes Clusters to Eavesdropping
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 12 Jan 2026 00:32:41 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Apache Spark #Apache Uniffle #Big Data Security #CVE_2025_68637 #Hadoop MapReduce #mitm attack #network_security #SSL Verification
Daily CyberSecurity
CVE-2025-68637: Critical Apache Uniffle Flaw Exposes Clusters to Eavesdropping
A high-severity vulnerability has been unearthed in Apache Uniffle, the remote shuffle service that powers data movement for massive distributed computing engines. Tracked as CVE-2025-68637, the f…
28 views
Daily Writeups
⤷ Title: The “Async” Surge: January 2026 Telemetry Reveals a Global Explosion in AsyncRAT Command Nodes
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 04 Feb 2026 03:22:10 +0000
════════════════════════
⌗ Tags: #Malware #.NET malware #AsyncClient.exe #AsyncRAT #C2 Infrastructure #Censys #Remote Access Trojan #SSL/TLS certificates #Tech News 2026 #Threat Hunting #VenomRAT
Penetration Testing Tools
The "Async" Surge: January 2026 Telemetry Reveals a Global Explosion in AsyncRAT Command Nodes
A pronounced escalation in the activity of infrastructure tethered to the AsyncRAT remote access trojan has been meticulously
26 views
Daily Writeups
⤷ Title: The Forensic Backfire: How Hackers Weaponized a Legacy EnCase Driver to Decapitate Modern EDR
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 06 Feb 2026 02:41:00 +0000
════════════════════════
⌗ Tags: #Cybercriminals #BYOVD #Cyberattack 2026 #driver blocklist #EDR killer #EnCase driver #Huntress #HVCI #kernel_mode #MFA Bypass #process termination #SonicWall #SSL VPN
Penetration Testing Tools
The Forensic Backfire: How Hackers Weaponized a Legacy EnCase Driver to Decapitate Modern EDR
Adversaries are increasingly inaugurating their offensives not with conventional malware, but by subverting legitimate remote access credentials. A
15 views
Daily Writeups
⤷ Title: SSL/TLS Made Simple: What That Lock Icon Really Means
════════════════════════
𐀪 Author: Muhammed Asfan | Cybersecurity Researcher
════════════════════════
ⴵ Time: Mon, 09 Feb 2026 13:56:47 GMT
════════════════════════
⌗ Tags: #tls #cybersecurity #bug_bounty_writeup #ssl #bug_bounty_tips
Medium
SSL/TLS Made Simple: What That Lock Icon Really Means
“Why does every secure site start with https?”
51 views
Daily Writeups
⤷ Title: Handshake Halt: GnuTLS 3.8.12 Fixes TLS 1.3 Crash & CPU Exhaustion
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:06:40 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Certificate Verification #CVE_2025_14831 #CVE_2026_1584 #Denial of Service #GnuTLS #network_security #Patch Alert #PSK Binder #SSL/TLS #TLS 1.3
Daily CyberSecurity
Handshake Halt: GnuTLS 3.8.12 Fixes TLS 1.3 Crash & CPU Exhaustion
GnuTLS v3.8.12 fixes high-severity DoS flaws (CVE-2026-1584). Malicious TLS 1.3 handshakes can crash servers. Update now to prevent outages.
11 views
Daily Writeups
⤷ Title: Securing Spring Boot APIs with Cacerts, KeyStore & TrustStore
════════════════════════
𐀪 Author: keylearn
════════════════════════
ⴵ Time: Fri, 20 Feb 2026 12:39:52 GMT
════════════════════════
⌗ Tags: #java #spring_boot #api_security #ssl #java_security
Medium
Securing Spring Boot APIs with Cacerts, KeyStore & TrustStore
A production-grade guide to SSL/TLS security — why it matters, how the pieces fit together, and exactly how to configure it in Spring Boot.
57 views
Daily Writeups
⤷ Title: Massive SonicWall Reconnaissance Campaign Signals Imminent Ransomware Strikes
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 28 Feb 2026 01:23:33 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Akira ransomware #Attack surface mapping #CVE_2024_53704 #Fog Ransomware #GreyNoise #infosec #reconnaissance #SonicOS #SonicWall #SSL VPN #threat intelligence
Daily CyberSecurity
Massive SonicWall Reconnaissance Campaign Signals Imminent Ransomware Strikes
GreyNoise detects a coordinated surge in SonicWall reconnaissance. With over 84,000 scans, attackers are mapping VPNs for Akira and Fog ransomware strikes.
31 views
Daily Writeups
⤷ Title: Unauthenticated Nginx UI Flaw Leaks Decryption Keys and Server Secrets
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 08 Mar 2026 03:39:42 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API security #Backup Leak #CVE_2026_27944 #cybersecurity #infosec #Nginx UI #Patch Alert #SSL Exfiltration #unauthenticated access #Vulnerability
Daily CyberSecurity
Unauthenticated Nginx UI Flaw Leaks Decryption Keys and Server Secrets
A critical 9.8 CVSS flaw (CVE-2026-27944) in Nginx UI lets hackers download and decrypt full system backups via an open API. Update and rotate secrets!
22 views
Daily Writeups
⤷ Title: From 398 Days to 47: Why Legacy Pinning Breaks and How SPKI Fixes It
════════════════════════
𐀪 Author: Mark Solo
════════════════════════
ⴵ Time: Sun, 08 Mar 2026 15:18:44 GMT
════════════════════════
⌗ Tags: #ssl_pinning #pki #cybersecurity #mobile_security #application_security
Medium
From 398 Days to 47: Why Legacy Pinning Breaks and How SPKI Fixes It
TL;DR: The End of Static Pinning
Abstract
Problem Statement
What SPKI is
Why certificate-bound pinning breaks
Why SPKI survives the new…
24 views
Daily Writeups
⤷ Title: The “Invulnerable” Leak: How Qihoo 360 Accidently Shipped a Private SSL Master Key in its AI Installer
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 19 Mar 2026 09:26:32 +0000
════════════════════════
⌗ Tags: #Data Leak #360 Security Claw #AI Assistant #China Cybersecurity #Digital Certificate #Encryption Failure #Lukasz Olejnik #OpenClaw #Private Key Exposure #Qihoo 360 #SSL Leak
Penetration Testing Tools
The "Invulnerable" Leak: How Qihoo 360 Accidently Shipped a Private SSL Master Key in its AI Installer
The Chinese conglomerate Qihoo 360, a preeminent leviathan within the cybersecurity dominion, has become ensnared in a controversy
14 views
Daily Writeups
⤷ Title: Client security, runtime tampering, and why SPKI and TLS do not prove trusted execution
════════════════════════
𐀪 Author: Mark Solo
════════════════════════
ⴵ Time: Thu, 19 Mar 2026 20:36:57 GMT
════════════════════════
⌗ Tags: #application_security #information_security #mobile_app_architecture #ssl_pinning #cybersecurity
Medium
Client security, runtime tampering, and why SPKI and TLS do not prove trusted execution
SPKI pinning and TLS can prove that a mobile app reached the correct backend over a protected channel. They cannot prove that the client…
22 views
Daily Writeups
⤷ Title: SSL Sadece Bir Şifreleme mi, Yoksa Küresel Bir Güven Sözleşmesi mi?
════════════════════════
𐀪 Author: Mevlüt Kamalı
════════════════════════
ⴵ Time: Wed, 08 Apr 2026 09:28:20 GMT
════════════════════════
⌗ Tags: #ssl #computer_networking #cybersecurity #ethical_hacking #web_güvenliği
Medium
SSL Sadece Bir Şifreleme mi, Yoksa Küresel Bir Güven Sözleşmesi mi?
Modern web güvenliğinin temel taşı olan SSL (Secure Sockets Layer), sadece tarayıcıdaki o küçük “kilit” simgesinden ibaret değildir…
34 views
Daily Writeups
⤷ Title: VPN Security Alert: Synology Patches Flaws in SSL VPN Client
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 02:00:01 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2021_47960 #CVE_2021_47961 #Data Disclosure #infosec #Patch Alert #Remote Work Security #SSL VPN Client #Synology #Traffic Interception #VPN security
Daily CyberSecurity
VPN Security Alert: Synology Patches Flaws in SSL VPN Client
Synology urges SSL VPN Client users to update to v1.4.5-0684. Fixes critical 8.1 CVSS flaw allowing PIN theft and traffic interception. Secure your data now!
11 views
Daily Writeups
⤷ Title: Patch Now: GnuTLS Release 3.8.13 Fixes 12 Vulnerabilities
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 04 May 2026 13:07:51 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #cryptography #CVE_2026_33846 #DTLS #GnuTLS #Heap Overwrite #infosec #Linux Security #OCSP Revocation #patch management #RSA_PSK #SSL/TLS
Daily CyberSecurity
Patch Now: GnuTLS Release 3.8.13 Fixes 12 Vulnerabilities
GnuTLS v3.8.13 fixes critical heap overwrites, identity truncation, and OCSP bypasses. Secure your Linux comms and upgrade to the latest version now.
45 views
Daily Writeups
⤷ Title: Microsoft Defender Flaw Erased DigiCert Root Certificates and Paralyzed Windows Systems
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 05 May 2026 08:32:06 +0000
════════════════════════
⌗ Tags: #Malware #Browser Error #cyber security 2026 #DigiCert #EV Code Signing #false positive #Microsoft Defender #Root Certificate #SSL/TLS #Trojan:Win32/Cerdigicert.A!dha #Windows 10 #Windows 11 Security
Daily CyberSecurity
Microsoft Defender Flaw Erased DigiCert Root Certificates and Paralyzed Windows Systems
Microsoft Defender erroneously flagged DigiCert root certificates as "Cerdigicert" malware. Discover the fix and how to restore your system's trusted root store.
7 views
Daily Writeups
⤷ Title: Let’s Encrypt Slashes Certificate Lifespans and Sunsets mTLS on May 13
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 09 May 2026 02:31:06 +0000
════════════════════════
⌗ Tags: #Technology #45_Day Certificates #ACME #cybersecurity #DevSecOps #Generation Y Intermediates #Let's Encrypt #mTLS #ssl #SysAdmin #tls #Web Security
Daily CyberSecurity
Let’s Encrypt Slashes Certificate Lifespans and Sunsets mTLS on May 13
May 13 Deadline: Let’s Encrypt launches 45-day certs, freezes mTLS, and moves to Gen Y intermediates. Is your automation ready for the triple-threat update?
22 views
Daily Writeups
⤷ Title: Regulatory Alignment: Let’s Encrypt Amends Subscriber Agreement to Enforce US Sanctions and Export Compliance
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 10 Jun 2026 08:50:55 +0000
════════════════════════
⌗ Tags: #Technology #domain certificate rules #Let's Encrypt subscriber agreement #SSL sanctions compliance #U.S. export controls tool #Version 1.7 update #Web Hosting Security
Daily CyberSecurity
Regulatory Alignment: Let’s Encrypt Amends Subscriber Agreement to Enforce US Sanctions and Export Compliance
Discover the new Let's Encrypt subscriber agreement changes. Learn how Version 1.7 integrates U.S. sanctions compliance for global SSL domains.
11 views
Daily Writeups
⤷ Title: CISA KEV Additions: Arista VeloCloud and FortiOS Flaws Now Exploited
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 21:52:47 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arista #CISA KEV #CVE_2025_68686 #CVE_2026_16812 #Fortinet #FortiOS #Known Exploited Vulnerabilities #os command injection #SSL VPN #VeloCloud Orchestrator
Daily CyberSecurity
CISA KEV Additions: Arista VeloCloud and FortiOS Flaws Now Exploited
TL;DR: On July 27, 2026, CISA made two KEV additions. Both are known exploited vulnerabilities. One is a critical Arista VeloCloud RCE, while the other is a FortiOS persistence bypass. Why These C…
18 views
Daily Writeups
⤷ Title: CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 28 Jul 2026 13:01:47 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ASLR Bypass #CVE_2026_42533 #heap overflow #map directive #nginx #NGINX Plus #proof_of_concept #Remote Code Execution #ssl_preread #stream module
Daily CyberSecurity
CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released
TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets an unauthenticated attacker corrupt worker memory through crafted requests. Researc…
5 views
Daily Writeups
⤷ Title: Certificate Pinning in Production (Android)
════════════════════════
𐀪 Author: Khizar Khan
════════════════════════
ⴵ Time: Mon, 10 Aug 2026 06:07:46 GMT
════════════════════════
⌗ Tags: #ssl #mobile_security #cybersecurity #application_security #android_development
Medium
Certificate Pinning in Production (Android)
Part 3 of our Android security series. Part 2 covered Network Security Config — pinning builds directly on top of it.
7 views