Himanshu Anand

One missed TLB shootdown a page table I could write to. One kernelCTF flag. My latest write up explains the debugging and not just the result. Known bug (n day) authorized challenge. blog.himanshuanand.com/2026/09/i-mi... #Linux #Security

“Your monthly maintenance window is not a safety margin. It is an attack window.” blog.himanshuanand.com/2026/05/the-...

One missed TLB shootdown a page table I could write to. One kernelCTF flag. My latest write up explains the debugging and not just the result. Known bug (n day) authorized challenge. blog.himanshuanand.com/2026/09/i-mi... #Linux #Security

What if Chrome browser exploits could be chained together? #Cybersecurity #SecurityResearch #Chrome #V8 #BrowserSecurity #VulnerabilityResearch #AI #ArtificialIntelligence #AIAgents #LLM #GoogleChrome #ApplicationSecurity #ZeroDay #DevSecOps blog.himanshuanand.com/2026/08/i-ha...

I chained three public V8 ndays against Google v8CTF Chrome build and recovered a real flag. Address oracle → GC stale object → fake array → caged R/W → native leak → JSPI/JDT stack pivot → ROP. Real V8 sandbox escape. Terrible reliability No $10k 😅 blog.himanshuanand.com/2026/08/i-ha...

I found a WPForms PayPal webhook flaw, then learned ten researchers had already reported it. The code bug was small but the rediscovery signal was not. CVE-2026-4986 blog.himanshuanand.com/2026/07/repo...

This entire post is excellent and mirrors my feelings The number of people writing reports where they can't tell their AI is making fundamental mistakes is problematic

Every couple of days I am getting a notifications from @bsky.app regarding some old activity. Is this a bug or a feature to keep users engaged?

The lack of common sense among the people, it should be called "uncommon sense".

Which companies are forcing staff into the office during the tube strike? #London

Don't forget our Call for Papers (also Rookies and Workshops) is still open! Have you got something original and interesting to share, but need somewhere to do it? ➡️ #BSidesLDN2025 More information and to submit your proposal: cfp.bsides.london/bsides-londo... #Security #BSides #London

A web malware campaign tracked as ZuizhongJS has now hijacked over 150,000 websites—and counting—to insert ads and redirect users to Chinese gambling sites: cside.dev/blog/over-15... This campaign started last month: cside.dev/blog/over-35...

Hey cybersecurity folks! As a direct or indirect consequence of the US (and others) cutting foreign aid, there are many who have done cybersecurity for NGOs and at-risk groups who are or will be looking for a job. They often have broad experience, from research to incident response to education 1/2

Hackers are hijacking WordPress sites to push Windows and Mac malware

Honored to be quoted in @techcrunch.com 's latest article on the hijacking of WordPress sites to distribute Windows and Mac malware. It's crucial for website owners to stay vigilant and implement robust security measures. Read more: techcrunch.com/2025/01/29/h...

We found 2 more domains associated with the same attack: iogamesl[.]xyz wp-cdn[.]top In today we have identified a little over 500 websites that were impacted.

I was expecting a crash, but I guess the system's a bit rusty…

WP infected website infecting windows users with SocGholish and Mac Users with AMOS. cside.dev/blog/10-000-...

Black hat SEO, compromised gov and university websites. cside.dev/blog/governm...

Over 5,000 WordPress sites caught in WP3.XYZ malware attack cside.dev/blog/over-5k...

This is crazy, everything I say BOTS 1 new bot follows me. 😅🤣

Post about BOTS get more BOTS. 🥲

I got more bots followers than real people. 🤷‍♂️

When to expect next Ivanti 0day? > My prediction 1 more this quarter.

New year/quarter is incomplete without Ivanti 0day.

Happy CVE-2025-0001

A bit old but I was quoted :D

Bluesky BOTS: bluebots

Can't wait for @bsideslondon.bsky.social !! I will be there (1st time as mentee and 4th time as a volunteer), feel free to DM if you want to meet. See you at #Bsides.

Shell code is nothing but C in its native format.

Daniel Grzelak has released Awseye, a so-called Shodan for AWS, an OSINT and reconnaissance service that tracks and analyzes publicly accessible AWS data awseye.com

Payment only in crypto. 😄

Black Friday sale. Get all my Exploits 25% discount.

Just realized we already have a Bluesky presence.

We have just managed to free up some more tickets for #BSidesLDN2024, when they are gone, they are gone! eventbrite.co.uk/e/bsides-londo… Please be a team player and remember to cancel your ticket if you can no longer be there on the day! #Security #BSides #London #Tickets cross posting from Twitter

When your kitchen devices start asking for sacrifice.