Hackup's

Photo: Tirza van Dijk, " Laptop coding programs ", CC0 , via Wikimedia Commons. Ethical-use notice: This guide is for learning only. Use Burp Suite only on applications you own or have written permission to test, such as your company's test environment or a deliberately vulnerable practice app. Intercepting or tampering with someone else's site without authorization is illegal under India's IT Act, 2000 and similar laws elsewhere. If you test web apps for a living, you already probe edge cases like the empty field or the double click on "Pay". Burp Suite simply lets you take that instinct one layer deeper: instead of only poking at the screen, you watch and change the actual HTTP requests the browser sends to the server. This Burp Suite tutorial for beginners walks a QA tester through installing the free edition, capturing traffic, replaying a request, and turning what you find into a proper bug report. New to security testing in general? Start with...

Photo: ノボホショコロトソ — “ Narita Airport Terminal 2 Check-in Area 01 ”, CC BY 4.0 , via Wikimedia Commons . You pick an airline. You never pick the reservation platform sitting behind the booking confirmation email. This week that gap mattered. A vulnerability in a travel-tech provider’s booking-display environment exposed passenger details for several major Asian carriers — and the same pattern showed up elsewhere in hosting tools and analytics stacks. For QA, the question is not “did security miss a CVE?” It is: what should we have tested in third-party integrations before the vendor became the blast radius? This Friday breakdown covers the Amadeus airline incident, the DreamHost File Manager credential leak, and a critical Metabase password-reset flaw — then turns them into a practical checklist. New here? Start Here . Related: our notes on the LiteLLM supply-chain attack and the evergreen Security Testing for QA Engineers guide. What happened with Amadeus (facts only) According t...

Photo: Yuri Samoilov — “ Open lock on laptop ”, CC BY 2.0 , via Wikimedia Commons . A friend gets a “we noticed a new login” email. A colleague’s Instagram starts sending crypto links. Somebody’s Swiggy account orders food to an address in another city. Very often the root cause is the same boring one: an email and password combination leaked from some other website , and the attacker simply tried it everywhere else. You cannot stop a third-party company from getting breached. You can find out quickly whether your details are already floating around, and close the doors before someone walks through them. This guide shows how to check if your email or password was leaked — free, in about ten minutes — and exactly what to do next. New here? Start Here . Why leaked passwords matter even if “nothing happened” When a site is breached, its user table often ends up in public dumps or on sale. Attackers then run credential stuffing : automated tools try each leaked email + password pair...

Photo: Carl Lender — “ Datacenter Server Racks ”, CC BY 2.0 , via Wikimedia Commons . Learning only. Use only on systems you own or are authorized to test. Unauthorized access is illegal under India’s IT Act. Some methods/contexts are outdated or third-party reports. An AI pentest agent showed up in real bank breach logs. Late September into early October 2026, investigators tracing intrusions at South Korean financial firms found traces of ARTEX — a Chinese-built, open-source agentic penetration-testing suite — alongside LLM backends and coding-agent session files. That is not a sci-fi “AI bank heist.” It is a human operator speeding up recon and probing against peripheral portals outside the hardened core banking stack. Not a news dump, not geopolitics: what reportedly happened → what ARTEX-class tools change for defenders → a QA / AppSec checklist. New here? Start with Start Here . This compounds our AI lane with the LiteLLM sup...

Photo: European Commission — “A person using a smartphone to make a payment”, CC BY 4.0 , via Wikimedia Commons . Learning only. Use only on systems you own or are authorized to test. Unauthorized access is illegal under India’s IT Act. Some methods/contexts are outdated or third-party reports. Your physical card is in your wallet. Your phone never left the house. Then a bank SMS lands: a charge in Brazilian reais, half a world away, sometimes tagged like a digital-wallet payment. That was the scare from late September into early October 2026 for a wave of Mastercard holders — especially Bank of China cards — and a clean reminder that tokenization reduces risk; it does not erase it . Not a news dump, not geopolitics: short scare → hygiene CTA → builder/QA checklist for wallet, banking, and card-not-present (CNP) flows. New here? Start with Start Here , then come back. What reportedly happened Per Caixin Global (8 Oct 2026) and Caix...

Photo: Igor Ovsyannykov on Wikimedia Commons (CC0, via Unsplash) Last week one of the most popular Python libraries in the AI world shipped malware to its own users. On 21 October 2026, a poisoned release of LiteLLM , the open-source gateway many teams use to talk to OpenAI, Anthropic, Gemini and other model providers, was published to PyPI and to the project's official Docker images. For about two hours, anyone who installed or pulled the "latest" version received a credential stealer instead of a routine update. No code was broken into. The attackers used stolen developer credentials to run the project's real release pipeline against a lookalike repository. If you write Python, run AI apps, or manage CI/CD, this incident is a clear lesson in how modern supply-chain attacks work and what actually stops them. This post covers what happened, how to check whether you were affected, and the habits that would have protected you. What happened in the LiteLLM 1.1...