Daily Writeups
@Daily_Writeups
4.06K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.06K subscribers
Daily Writeups
⤷ Title: Unauthenticated Nginx UI Flaw Leaks Decryption Keys and Server Secrets
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 08 Mar 2026 03:39:42 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API security #Backup Leak #CVE_2026_27944 #cybersecurity #infosec #Nginx UI #Patch Alert #SSL Exfiltration #unauthenticated access #Vulnerability
Daily CyberSecurity
Unauthenticated Nginx UI Flaw Leaks Decryption Keys and Server Secrets
A critical 9.8 CVSS flaw (CVE-2026-27944) in Nginx UI lets hackers download and decrypt full system backups via an open API. Update and rotate secrets!
24 views
Daily Writeups
⤷ Title: From 398 Days to 47: Why Legacy Pinning Breaks and How SPKI Fixes It
════════════════════════
𐀪 Author: Mark Solo
════════════════════════
ⴵ Time: Sun, 08 Mar 2026 15:18:44 GMT
════════════════════════
⌗ Tags: #ssl_pinning #pki #cybersecurity #mobile_security #application_security
Medium
From 398 Days to 47: Why Legacy Pinning Breaks and How SPKI Fixes It
TL;DR: The End of Static Pinning
Abstract
Problem Statement
What SPKI is
Why certificate-bound pinning breaks
Why SPKI survives the new…
25 views
Daily Writeups
⤷ Title: The “Invulnerable” Leak: How Qihoo 360 Accidently Shipped a Private SSL Master Key in its AI Installer
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 19 Mar 2026 09:26:32 +0000
════════════════════════
⌗ Tags: #Data Leak #360 Security Claw #AI Assistant #China Cybersecurity #Digital Certificate #Encryption Failure #Lukasz Olejnik #OpenClaw #Private Key Exposure #Qihoo 360 #SSL Leak
Penetration Testing Tools
The "Invulnerable" Leak: How Qihoo 360 Accidently Shipped a Private SSL Master Key in its AI Installer
The Chinese conglomerate Qihoo 360, a preeminent leviathan within the cybersecurity dominion, has become ensnared in a controversy
17 views
Daily Writeups
⤷ Title: Client security, runtime tampering, and why SPKI and TLS do not prove trusted execution
════════════════════════
𐀪 Author: Mark Solo
════════════════════════
ⴵ Time: Thu, 19 Mar 2026 20:36:57 GMT
════════════════════════
⌗ Tags: #application_security #information_security #mobile_app_architecture #ssl_pinning #cybersecurity
Medium
Client security, runtime tampering, and why SPKI and TLS do not prove trusted execution
SPKI pinning and TLS can prove that a mobile app reached the correct backend over a protected channel. They cannot prove that the client…
25 views
Daily Writeups
⤷ Title: SSL Sadece Bir Şifreleme mi, Yoksa Küresel Bir Güven Sözleşmesi mi?
════════════════════════
𐀪 Author: Mevlüt Kamalı
════════════════════════
ⴵ Time: Wed, 08 Apr 2026 09:28:20 GMT
════════════════════════
⌗ Tags: #ssl #computer_networking #cybersecurity #ethical_hacking #web_güvenliği
Medium
SSL Sadece Bir Şifreleme mi, Yoksa Küresel Bir Güven Sözleşmesi mi?
Modern web güvenliğinin temel taşı olan SSL (Secure Sockets Layer), sadece tarayıcıdaki o küçük “kilit” simgesinden ibaret değildir…
34 views
Daily Writeups
⤷ Title: VPN Security Alert: Synology Patches Flaws in SSL VPN Client
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 02:00:01 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2021_47960 #CVE_2021_47961 #Data Disclosure #infosec #Patch Alert #Remote Work Security #SSL VPN Client #Synology #Traffic Interception #VPN security
Daily CyberSecurity
VPN Security Alert: Synology Patches Flaws in SSL VPN Client
Synology urges SSL VPN Client users to update to v1.4.5-0684. Fixes critical 8.1 CVSS flaw allowing PIN theft and traffic interception. Secure your data now!
12 views
Daily Writeups
⤷ Title: Patch Now: GnuTLS Release 3.8.13 Fixes 12 Vulnerabilities
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 04 May 2026 13:07:51 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #cryptography #CVE_2026_33846 #DTLS #GnuTLS #Heap Overwrite #infosec #Linux Security #OCSP Revocation #patch management #RSA_PSK #SSL/TLS
Daily CyberSecurity
Patch Now: GnuTLS Release 3.8.13 Fixes 12 Vulnerabilities
GnuTLS v3.8.13 fixes critical heap overwrites, identity truncation, and OCSP bypasses. Secure your Linux comms and upgrade to the latest version now.
45 views
Daily Writeups
⤷ Title: Microsoft Defender Flaw Erased DigiCert Root Certificates and Paralyzed Windows Systems
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 05 May 2026 08:32:06 +0000
════════════════════════
⌗ Tags: #Malware #Browser Error #cyber security 2026 #DigiCert #EV Code Signing #false positive #Microsoft Defender #Root Certificate #SSL/TLS #Trojan:Win32/Cerdigicert.A!dha #Windows 10 #Windows 11 Security
Daily CyberSecurity
Microsoft Defender Flaw Erased DigiCert Root Certificates and Paralyzed Windows Systems
Microsoft Defender erroneously flagged DigiCert root certificates as "Cerdigicert" malware. Discover the fix and how to restore your system's trusted root store.
7 views
Daily Writeups
⤷ Title: Let’s Encrypt Slashes Certificate Lifespans and Sunsets mTLS on May 13
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 09 May 2026 02:31:06 +0000
════════════════════════
⌗ Tags: #Technology #45_Day Certificates #ACME #cybersecurity #DevSecOps #Generation Y Intermediates #Let's Encrypt #mTLS #ssl #SysAdmin #tls #Web Security
Daily CyberSecurity
Let’s Encrypt Slashes Certificate Lifespans and Sunsets mTLS on May 13
May 13 Deadline: Let’s Encrypt launches 45-day certs, freezes mTLS, and moves to Gen Y intermediates. Is your automation ready for the triple-threat update?
23 views
Daily Writeups
⤷ Title: Regulatory Alignment: Let’s Encrypt Amends Subscriber Agreement to Enforce US Sanctions and Export Compliance
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 10 Jun 2026 08:50:55 +0000
════════════════════════
⌗ Tags: #Technology #domain certificate rules #Let's Encrypt subscriber agreement #SSL sanctions compliance #U.S. export controls tool #Version 1.7 update #Web Hosting Security
Daily CyberSecurity
Regulatory Alignment: Let’s Encrypt Amends Subscriber Agreement to Enforce US Sanctions and Export Compliance
Discover the new Let's Encrypt subscriber agreement changes. Learn how Version 1.7 integrates U.S. sanctions compliance for global SSL domains.
11 views
Daily Writeups
⤷ Title: CISA KEV Additions: Arista VeloCloud and FortiOS Flaws Now Exploited
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 21:52:47 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arista #CISA KEV #CVE_2025_68686 #CVE_2026_16812 #Fortinet #FortiOS #Known Exploited Vulnerabilities #os command injection #SSL VPN #VeloCloud Orchestrator
Daily CyberSecurity
CISA KEV Additions: Arista VeloCloud and FortiOS Flaws Now Exploited
TL;DR: On July 27, 2026, CISA made two KEV additions. Both are known exploited vulnerabilities. One is a critical Arista VeloCloud RCE, while the other is a FortiOS persistence bypass. Why These C…
24 views
Daily Writeups
⤷ Title: CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 28 Jul 2026 13:01:47 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ASLR Bypass #CVE_2026_42533 #heap overflow #map directive #nginx #NGINX Plus #proof_of_concept #Remote Code Execution #ssl_preread #stream module
Daily CyberSecurity
CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released
TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets an unauthenticated attacker corrupt worker memory through crafted requests. Researc…
6 views
Daily Writeups
⤷ Title: Certificate Pinning in Production (Android)
════════════════════════
𐀪 Author: Khizar Khan
════════════════════════
ⴵ Time: Mon, 10 Aug 2026 06:07:46 GMT
════════════════════════
⌗ Tags: #ssl #mobile_security #cybersecurity #application_security #android_development
Medium
Certificate Pinning in Production (Android)
Part 3 of our Android security series. Part 2 covered Network Security Config — pinning builds directly on top of it.
9 views
Daily Writeups
⤷ Title: US Sanctions Cripple Iranian Bank SSL Certificates
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 15 Sep 2026 08:11:10 +0000
════════════════════════
⌗ Tags: #Technology #Cyber Security #Iran #OFAC Sanctions #SSL Certificates
Daily CyberSecurity
US Sanctions Cripple Iranian Bank SSL Certificates
Recently, numerous Iranian banks and financial institutions experienced severe digital certificate failures. These invalidations completely disrupted normal user access. Consequently, some banks h…
35 views
Daily Writeups
⤷ Title: Misconfigured Server Exposes Massive Thai ISP Intrusion
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Wed, 16 Sep 2026 14:21:22 +0000
════════════════════════
⌗ Tags: #Vulnerability #cyber attack #FortiGate #MeshCentral #SSL VPN
Information Security News
Misconfigured Server Exposes Massive Thai ISP Intrusion
A staggering misconfiguration within an attacker’s own offensive infrastructure fortuitously exposed nearly the entire exploitation chain orchestrated against a prominent Thai internet servi…
32 views
Daily Writeups
⤷ Title: Critical Python SSL Vulnerabilities Fixed in CPython
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 01 Oct 2026 01:39:22 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CPython #CVE_2026_19445 #CVE_2026_19553 #cybersecurity #Python #ssl
Daily CyberSecurity
Critical Python SSL Vulnerabilities Fixed in CPython
TL;DR On September 30, 2026, the Python Software Foundation disclosed two security flaws in CPython. These critical Python SSL vulnerabilities allow memory corruption and bypass certificate hostna…
24 views
Daily Writeups
⤷ Title: Let’s Encrypt Accelerates the Push for Automation
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 09 Oct 2026 07:54:17 +0000
════════════════════════
⌗ Tags: #Technology #Cyber Security #Let's Encrypt #SSL Certificates #Tech News #web development
Daily CyberSecurity
Let’s Encrypt Accelerates the Push for Automation
Following extensive discussions within the CA/Browser Forum, digital certificate authorities are preparing to significantly shorten certificate lifespans. In the near future, these validity period…
10 views
Daily Writeups
⤷ Title: GoDaddy Revokes 404,607 SSL Certificates After Policy Errors
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 19:09:16 +0000
════════════════════════
⌗ Tags: #Security #Cybersecurity #GoDaddy #Hosting #SSL Certificates #Technology
Hackread
GoDaddy Revokes 404,607 SSL Certificates After Policy Errors
GoDaddy revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, with affected sites including some Gibraltar government websites.
36 views
Daily Writeups
⤷ Title: Four Hours To Intercept HTTPS Traffic from an Android App: A Journey Through Certificate Trust…
════════════════════════
𐀪 Author: Yahia Ibrahim khamis
════════════════════════
ⴵ Time: Sat, 24 Oct 2026 19:51:06 GMT
════════════════════════
⌗ Tags: #cybersecurity #ssl_pinning_bypass #penetration_testing #mobile_pentesting #mobile_security
Medium
Four Hours To Intercept HTTPS Traffic from an Android App: A Journey Through Certificate Trust, Split APKs, and Signing Issues
قال الله تعالى: ﴿وَقُل رَّبِّ زِدْنِي عِلْمًا﴾ (سورة طه، الآية 114)
20 views
Daily Writeups
⤷ Title: eMudhra to Exit SSL/TLS Market After 8 CA Keys Found Easily Guessable
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 15:10:07 +0000
════════════════════════
⌗ Tags: #Security #Cybersecurity #eMudhra #security #SSL #SSL Certificates #Technology #TLS #TLS Certificates
Hackread
eMudhra to Exit SSL/TLS Market After 8 CA Keys Found Easily Guessable
eMudhra will leave the global SSL/TLS certificate market after eight intermediate CA private keys were found easily guessable, prompting browser distrust actions.
13 views