Hackup's

Learning only. Use only on systems you own or are authorized to test. Unauthorized access is illegal under India’s IT Act. Some methods/contexts are outdated or third-party reports. Your physical card is in your wallet. Your phone never left the house. Then a bank SMS lands: a charge in Brazilian reais, half a world away, sometimes tagged like a digital-wallet payment. That was the scare from late September into early October 2026 for a wave of Mastercard holders — especially Bank of China cards — and a clean reminder that tokenization reduces risk; it does not erase it . Not a news dump, not geopolitics: short scare → hygiene CTA → builder/QA checklist for wallet, banking, and card-not-present (CNP) flows. New here? Start with Start Here , then come back. What reportedly happened Per Caixin Global (8 Oct 2026) and Caixin Chinese (7 Oct 2026) : Late September 2026: some Bank of China Mastercard holders reported unauthorized overseas spend , heavily t...

Last week one of the most popular Python libraries in the AI world shipped malware to its own users. On 21 October 2026, a poisoned release of LiteLLM , the open-source gateway many teams use to talk to OpenAI, Anthropic, Gemini and other model providers, was published to PyPI and to the project's official Docker images. For about two hours, anyone who installed or pulled the "latest" version received a credential stealer instead of a routine update. No code was broken into. The attackers used stolen developer credentials to run the project's real release pipeline against a lookalike repository. If you write Python, run AI apps, or manage CI/CD, this incident is a clear lesson in how modern supply-chain attacks work and what actually stops them. This post covers what happened, how to check whether you were affected, and the habits that would have protected you. What happened in the LiteLLM 1.107.0 compromise According to LiteLLM's own incident report , the...

This article is for learning and defence. Use what you read here only on systems you own or are explicitly authorised to test. Attempting to exploit these flaws on systems you do not control is illegal under India's IT Act and similar laws worldwide. Do not try to reproduce or weaponise these vulnerabilities. Two critical PHP bugs, nicknamed php2shell , can lead to unauthenticated remote code execution on web-facing PHP. Patch to 8.5.12 , 8.4.27 , 8.3.36 or 8.2.35 as soon as you can. If you cannot patch an internet-facing host, take it offline until you can. This post explains impact and patching only — not how to attack anyone. If you run PHP on the public internet — WordPress, Laravel, custom APIs, shared hosting, the works — you need to read this today. In late October 2026 the security community lit up around a pair of critical PHP flaws that people are calling php2shell . CISA told operators to patch immediately. CERT-EU noted that proof-of-concept material was ...

For most of my career, security testing sat in a separate room. QA checked that features worked, and once or twice a year a security team or an outside firm ran a penetration test, handed over a PDF, and left. Everything found in that PDF was expensive to fix, because it had been in production for months. That model does not survive weekly releases. After 11 years in software testing and QA leadership, I am convinced the biggest untapped security resource in most teams is the QA engineer who already knows every screen, every role and every edge case. You do not need to become a penetration tester. You need a few habits, one free tool and a handful of automated checks. This guide is the starter kit I wish I had been given. Everything here is defensive and meant for applications you own or are explicitly authorised to test. Why Security Belongs in Your Test Plan Security bugs are bugs. A user who can open another customer's invoice by changing a number in the URL is a funct...

The last time I wrote on this blog, a phishing email gave itself away with bad grammar, a strange sender address and a "Dear Customer" greeting. That was 2015. Today the same scam can arrive in flawless English, quote your manager's name, and be followed by a phone call in a voice that sounds exactly like someone you trust. Hackup's is back, and I can't think of a better comeback topic. AI has made scams cheaper, faster and far more convincing. The good news is that the defence is still simple, as long as you change what you look for. I've spent the last 11 years in software testing and QA leadership. My job is to assume something is broken until it proves otherwise. That habit, it turns out, is the best anti-scam tool I know. Let me show you how to use it. Why AI Phishing Is a Different Game in 2026 The numbers are moving in the wrong direction. The Anti-Phishing Working Group's Phishing Activity Trends Report for Q2 2026 fo...

Artificial Intelligence: An Economic Disaster? Effect on Common Man and Middle Class. Previously we talked about Artificial Intelligence and it's good and bad factors, that will possiblly be the outcome of using them for various application across the globe. In this Post However, the Focus is on how it will affect the Common man, the Middle Class and the Lower Class of the society. First of all, let us just classify what and of whom are we actually talking about. The middle class is the service class, the guys who do a job in some company as an IT professional, accountant, Manager, Customer Support executives including the jobs in BPO and KPO that provides work services(inbound and outbound calls). And by the lower class, we mean Construction Workers, Labours and Small business Workers who do earn for a day and survival. And the upper class is the businessman tycoons and investors who are already rich, have a good reputation, capital, and running factories. Genera...