Daily Writeups
@Daily_Writeups
4.06K subscribers
4 photos
137K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.06K subscribers
Daily Writeups
⤷ Title: Is Your API Key Alive or Dead? — Validate in Minutes with SecurityToolkits API Key Testing Tool
════════════════════════
𐀪 Author: Haxshadow
════════════════════════
ⴵ Time: Sat, 06 Sep 2025 06:32:44 GMT
════════════════════════
⌗ Tags: #security #bugbounty_tips #temp_mail_api_key #bug_bounty #api_key
Medium
Is Your API Key Alive or Dead? — Validate in Minutes with SecurityToolkits API Key Testing Tool
TL;DR: When doing API key hunting or bug bounty, we often find keys but don’t know if they’re active. With SecurityToolkits’ API Key…
18 views
Daily Writeups
⤷ Title: From Free Nuggets to Full Access: How a Snack Craving Unwrapped McDonald’s Security Flaws
════════════════════════
𐀪 Author: Deven Chhajed
════════════════════════
ⴵ Time: Fri, 26 Sep 2025 03:31:48 GMT
════════════════════════
⌗ Tags: #mcdonalds #ethical_hacking #api_key_exposure #vulnerability_disclosure #cybersecurity
Medium
From Free Nuggets to Full Access: How a Snack Craving Unwrapped McDonald’s Security Flaws
Every good story starts with something small. For cybersecurity researcher BobDaHacker, it began with a craving for chicken nuggets. What…
14 views
Daily Writeups
⤷ Title: Critical Nagios Flaw CVE-2025-44823 (CVSS 9.9) Leaks Plaintext Admin API Keys, PoC Available
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 08 Oct 2025 03:57:58 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API Key Leak #Critical Vulnerability #CVE_2025_44823 #Elasticsearch #Nagios Log Server #privilege escalation #security advisory
Daily CyberSecurity
Critical Nagios Flaw CVE-2025-44823 (CVSS 9.9) Leaks Plaintext Admin API Keys, PoC Available
A Critical (CVSS 9.9) flaw (CVE-2025-44823) in Nagios Log Server allows any authenticated user to retrieve plaintext administrative API keys, leading to full system compromise. Update now.
20 views
Daily Writeups
⤷ Title: Critical Auth Bypass (CVE-2025-61928) in Better Auth Allows Hackers to Steal User API Keys
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 13 Oct 2025 00:30:48 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API Key Theft #Authentication Bypass #Better Auth #Critical Vulnerability #CVE_2025_61928 #Next.js #TypeScript
Daily CyberSecurity
Critical Auth Bypass (CVE-2025-61928) in Better Auth Allows Hackers to Steal User API Keys
A Critical (CVSS 9.3) flaw (CVE-2025-61928) in Better Auth allows unauthenticated attackers to create/modify API keys for any user, risking full account compromise.
13 views
Daily Writeups
⤷ Title: API Keys, Tokens & Secrets: How They Leak and How Developers can Avoid it
════════════════════════
𐀪 Author: Veronica Peter
════════════════════════
ⴵ Time: Tue, 30 Dec 2025 01:21:19 GMT
════════════════════════
⌗ Tags: #api #sdlc #credentials #api_key #application_security
Medium
API Keys, Tokens & Secrets: How They Leak and How Developers can Avoid it
Credential exposures are one of the fastest paths to compromise. In 2024 alone, GitHub detected over 39M leaked secrets across its…
16 views
Daily Writeups
⤷ Title: Malicious Chrome Extension Drains Crypto via Secret API Keys
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 14 Jan 2026 00:01:12 +0000
════════════════════════
⌗ Tags: #Malware #API Key Theft #Chrome Extension Malware #crypto security #Cryptocurrency Scam #MEXC Exchange #Russian cybercrime #Socket Threat Research #Wallet drainer
Daily CyberSecurity
Malicious Chrome Extension Drains Crypto via Secret API Keys
A seemingly helpful tool for cryptocurrency traders has been exposed as a sophisticated wallet-draining trap. Socket’s Threat Research Team has identified a malicious Google Chrome extension, MEXC…
15 views
Daily Writeups
⤷ Title: “Distillation” Theft: Attackers Target AI Models in New Wave of Intellectual Property Heists
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 16 Feb 2026 00:21:01 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI security #API Key Theft #artificial intelligence #DeepMind #Distillation Attack #Google Threat Intelligence #Intellectual Property #Model Extraction #One API #Xanthorox
Daily CyberSecurity
"Distillation" Theft: Attackers Target AI Models in New Wave of Intellectual Property Heists
Google Threat Intelligence reports a surge in "model extraction" attacks. Private entities are cloning AI models & stealing API keys. Stay alert.
18 views
Daily Writeups
⤷ Title: From $180 to $82,000 in 48 Hours: The Gemini API Key Leak Bankrupting Small Dev Teams
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 04 Mar 2026 04:26:40 +0000
════════════════════════
⌗ Tags: #Data Leak #API Key Leak #billing alert #Cloud Security #Cybersecurity 2026 #developer cautionary tale #Gemini API #Google AI Studio #Google Cloud #Shared Responsibility Model #tech bankruptcy
Daily CyberSecurity
From $180 to $82,000 in 48 Hours: The Gemini API Key Leak Bankrupting Small Dev Teams
A Mexican dev team faces bankruptcy after a leaked Gemini API key racked up an $82,314 bill in 48 hours. Is Google Cloud's billing model to blame?
20 views
Daily Writeups
⤷ Title: The Skeleton Key: How Google’s “Safe” Maps Keys Silently Became Gemini Credentials
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 04 Mar 2026 07:09:01 +0000
════════════════════════
⌗ Tags: #Data Leak #AIStudio #API key security #cybersecurity research #Data Breach 2026 #firebase #Gemini API #google cloud #privilege escalation #Tech News 2026 #Truffle Security
Penetration Testing Tools
The Skeleton Key: How Google’s "Safe" Maps Keys Silently Became Gemini Credentials
For years, Google reassured developers that its API keys could be safely left in plain sight, embedded directly
18 views
Daily Writeups
⤷ Title: The $82,000 Mistake: Google AI Studio Finally Launches API Spending Ceilings
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 14 Mar 2026 06:56:26 +0000
════════════════════════
⌗ Tags: #Technology #AI Model Costs #API Key Security #Cloud Billing #Cyber Security #Developer Tools #Financial Guardrails #Google AI Studio #Google Cloud #Google Gemini #Spending Limits #Tech News 2026
Daily CyberSecurity
The $82,000 Mistake: Google AI Studio Finally Launches API Spending Ceilings
After a developer hit an $82k debt in 48 hours, Google AI Studio has added spending limits. Learn how to set your fiscal guardrails and protect your account.
32 views
Daily Writeups
⤷ Title: The $100 Fast Track: Google Slashes Gemini API Tier 2 Requirements and Adds Critical Spend Caps
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 18 Mar 2026 04:35:23 +0000
════════════════════════
⌗ Tags: #Technology #API Key Safety #API Rate Limits #cyber security 2026 #Developer Tools #Gemini API #Google AI Studio #Google Cloud Billing #Google DeepMind #Spend Caps #Tier 2 Upgrade
Daily CyberSecurity
The $100 Fast Track: Google Slashes Gemini API Tier 2 Requirements and Adds Critical Spend Caps
Google is persistently upgrading the Gemini API platform, empowering developers to ascend through its echelons with greater celerity to unlock superior rate limits. The permissible invocation velo…
17 views
Daily Writeups
⤷ Title: The EU’s AWS “Master Key”: How a Compromised Trivy Update Leaked 340GB of Data
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 03 Apr 2026 09:40:11 +0000
════════════════════════
⌗ Tags: #Data Leak #API Key Theft #aws security #CERT_EU #CI/CD security #data leak #EU Security #European Commission #infosec #ShinyHunters #supply chain attack #TeamPCP #Trivy
Daily CyberSecurity
The EU’s AWS "Master Key": How a Compromised Trivy Update Leaked 340GB of Data
A massive supply-chain attack hit the European Commission via a compromised Trivy update. 340GB of data was leaked by ShinyHunters. Rotate your AWS keys!
5 views
Daily Writeups
⤷ Title: North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 10 Apr 2026 02:00:41 +0000
════════════════════════
⌗ Tags: #Malware #AI Tools #API Key Theft #Claude Code #Contagious Interview #Cursor AI #Cyberespionage #developer security #infosec #North Korea #npm malware #OtterCookie #WindSurf
Daily CyberSecurity
North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens
North Korean hackers are now targeting AI tools like Cursor and Claude. The OtterCookie malware steals API keys and conversation logs. Is your dev environment safe?
30 views
Daily Writeups
⤷ Title: Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 23 Apr 2026 12:02:03 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API Key Vulnerability #ArcGIS #CVE_2026_33518 #CVE_2026_33519 #cybersecurity #Esri #GIS Security #infosec #OAuth 2.0 #Patch Alert #Portal for ArcGIS
Daily CyberSecurity
Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure
Esri issues an urgent fix for critical 9.8 CVSS flaws in ArcGIS. Over-scoped developer credentials could expose GIS data. Patch your portal immediately.
21 views
Daily Writeups
⤷ Title: A Secret Key in Plain Sight:
How I Earned My First $200 Finding a Hidden API Leak
════════════════════════
𐀪 Author: Theankitsaini16
════════════════════════
ⴵ Time: Sun, 24 May 2026 17:16:28 GMT
════════════════════════
⌗ Tags: #ethical_hacking #reconnaissance #infosec #bug_bounty #api_key
Medium
A Secret Key in Plain Sight:
How I Earned My First $200 Finding a Hidden API Leak
A JavaScript file. One exposed key. And months of patience that finally paid off — here’s the full story of my first paid bug bounty.
28 views
Daily Writeups
⤷ Title: Lock Down Your APIs: A Guide to API Key Authentication
════════════════════════
𐀪 Author: Naduni Pamudika
════════════════════════
ⴵ Time: Mon, 25 May 2026 08:02:31 GMT
════════════════════════
⌗ Tags: #wso2_api_manager #api_security #api_key #wso2
Medium
Lock Down Your APIs: A Guide to API Key Authentication
API keys are lightweight, opaque tokens used to authenticate callers of an API. In WSO2 API Manager 4.7.0 and later, API keys are API-bound…
32 views
Daily Writeups
⤷ Title: pretix Patches Two Critical Session Takeover and SSRF Flaws
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 08 Jul 2026 13:14:14 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API Key Leak #CVE_2026_13602 #CVE_2026_13603 #Payment Plugins #pretix #Session Takeover #ssrf
Daily CyberSecurity
pretix Patches Two Critical Session Takeover and SSRF Flaws
The pretix team shipped version 2026.5.3 to fix two critical flaws. The update also covers 2026.4.5 and 2026.3.5.post1, plus several payment plugins. Both bugs rate critical, so admins should patc…
17 views
Daily Writeups
⤷ Title: An Exposed API Key Cost Me $4,000. Here Is Exactly What to Do To Avoid It.
════════════════════════
𐀪 Author: Belkin Marketing Team
════════════════════════
ⴵ Time: Mon, 03 Aug 2026 10:01:43 GMT
════════════════════════
⌗ Tags: #hacking #exposed_api_key #iaros_belkin #api_key #credential_containment
Medium
An Exposed API Key Cost Me $4,000. Here Is Exactly What to Do To Avoid It.
The Four-Layer Credential Containment Model, the axios supply chain attack that hit 100 million downloads in under three hours, and the…
11 views
Daily Writeups
⤷ Title: METR Security Breach: Stolen API Key Burns $600K in Credits
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 02 Sep 2026 14:18:37 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI Agents #AI security #API Key Theft #METR #Vibe Coding
Daily CyberSecurity
METR Security Breach: Stolen API Key Burns $600K in Credits
The AI safety-evaluation organization METR, the very research body that investigated OpenAI agents attacking Hugging Face, recently disclosed external attacks that took place earlier this year. In…
10 views
Daily Writeups
⤷ Title: The Blast Radius of Zero: Scoped API Keys for LLM Traffic
════════════════════════
𐀪 Author: nRouter.ai
════════════════════════
ⴵ Time: Mon, 12 Oct 2026 12:58:28 GMT
════════════════════════
⌗ Tags: #llm #api_key #api_security #cybersecurity #developer_tools
Medium
The Blast Radius of Zero: Scoped API Keys for LLM Traffic
Every shared provider API key is a bet. The bet is that nobody leaks it, nobody logs it, and nobody abuses it. Infrastructure teams lose…
29 views