Hackup's

Photo: ノボホショコロトソ — “ Narita Airport Terminal 2 Check-in Area 01 ”, CC BY 4.0 , via Wikimedia Commons . You pick an airline. You never pick the reservation platform sitting behind the booking confirmation email. This week that gap mattered. A vulnerability in a travel-tech provider’s booking-display environment exposed passenger details for several major Asian carriers — and the same pattern showed up elsewhere in hosting tools and analytics stacks. For QA, the question is not “did security miss a CVE?” It is: what should we have tested in third-party integrations before the vendor became the blast radius? This Friday breakdown covers the Amadeus airline incident, the DreamHost File Manager credential leak, and a critical Metabase password-reset flaw — then turns them into a practical checklist. New here? Start Here . Related: our notes on the LiteLLM supply-chain attack and the evergreen Security Testing for QA Engineers guide. What happened with Amadeus (facts only) According t...

Photo: Yuri Samoilov — “ Open lock on laptop ”, CC BY 2.0 , via Wikimedia Commons . A friend gets a “we noticed a new login” email. A colleague’s Instagram starts sending crypto links. Somebody’s Swiggy account orders food to an address in another city. Very often the root cause is the same boring one: an email and password combination leaked from some other website , and the attacker simply tried it everywhere else. You cannot stop a third-party company from getting breached. You can find out quickly whether your details are already floating around, and close the doors before someone walks through them. This guide shows how to check if your email or password was leaked — free, in about ten minutes — and exactly what to do next. New here? Start Here . Why leaked passwords matter even if “nothing happened” When a site is breached, its user table often ends up in public dumps or on sale. Attackers then run credential stuffing : automated tools try each leaked email + password pair...

Photo: Carl Lender — “ Datacenter Server Racks ”, CC BY 2.0 , via Wikimedia Commons . Learning only. Use only on systems you own or are authorized to test. Unauthorized access is illegal under India’s IT Act. Some methods/contexts are outdated or third-party reports. An AI pentest agent showed up in real bank breach logs. Late September into early October 2026, investigators tracing intrusions at South Korean financial firms found traces of ARTEX — a Chinese-built, open-source agentic penetration-testing suite — alongside LLM backends and coding-agent session files. That is not a sci-fi “AI bank heist.” It is a human operator speeding up recon and probing against peripheral portals outside the hardened core banking stack. Not a news dump, not geopolitics: what reportedly happened → what ARTEX-class tools change for defenders → a QA / AppSec checklist. New here? Start with Start Here . This compounds our AI lane with the LiteLLM sup...

Photo: European Commission — “A person using a smartphone to make a payment”, CC BY 4.0 , via Wikimedia Commons . Learning only. Use only on systems you own or are authorized to test. Unauthorized access is illegal under India’s IT Act. Some methods/contexts are outdated or third-party reports. Your physical card is in your wallet. Your phone never left the house. Then a bank SMS lands: a charge in Brazilian reais, half a world away, sometimes tagged like a digital-wallet payment. That was the scare from late September into early October 2026 for a wave of Mastercard holders — especially Bank of China cards — and a clean reminder that tokenization reduces risk; it does not erase it . Not a news dump, not geopolitics: short scare → hygiene CTA → builder/QA checklist for wallet, banking, and card-not-present (CNP) flows. New here? Start with Start Here , then come back. What reportedly happened Per Caixin Global (8 Oct 2026) and Caix...

Photo: Igor Ovsyannykov on Wikimedia Commons (CC0, via Unsplash) Last week one of the most popular Python libraries in the AI world shipped malware to its own users. On 21 October 2026, a poisoned release of LiteLLM , the open-source gateway many teams use to talk to OpenAI, Anthropic, Gemini and other model providers, was published to PyPI and to the project's official Docker images. For about two hours, anyone who installed or pulled the "latest" version received a credential stealer instead of a routine update. No code was broken into. The attackers used stolen developer credentials to run the project's real release pipeline against a lookalike repository. If you write Python, run AI apps, or manage CI/CD, this incident is a clear lesson in how modern supply-chain attacks work and what actually stops them. This post covers what happened, how to check whether you were affected, and the habits that would have protected you. What happened in the LiteLLM 1.1...

Photo: Yuri Samoilov — “ PHP Code ”, CC BY 2.0 , via Wikimedia Commons . This article is for learning and defence. Use what you read here only on systems you own or are explicitly authorised to test. Attempting to exploit these flaws on systems you do not control is illegal under India's IT Act and similar laws worldwide. Do not try to reproduce or weaponise these vulnerabilities. Two critical PHP bugs, nicknamed php2shell , can lead to unauthenticated remote code execution on web-facing PHP. Patch to 8.5.12 , 8.4.27 , 8.3.36 or 8.2.35 as soon as you can. If you cannot patch an internet-facing host, take it offline until you can. This post explains impact and patching only — not how to attack anyone. If you run PHP on the public internet — WordPress, Laravel, custom APIs, shared hosting, the works — you need to read this today. In late October 2026 the security community lit up around a pair of critical PHP flaws that people are calling php2shell . CI...