Free speech is between you and the state, its not between you and me, you and me don't even have a social contract. Feel free to unfollow, mute me if you don't like my views

Serbian students took to the streets, staging rallies, turning up in rural areas, long been Vučić strongholds, went door-to-door, to rally voters behind their slogan of “Serbia or Mafia?” theguardian.com/world/2026/oct…

MHA declares information on High-Level Committee on Demographic Changes “Confidential”!

In response to an RTI application, the Ministry of Home Affairs (MHA) has refused to disclose copies of the proposal, file notings, approvals and other documents relating to the constitution High-Level Committee on Demographic Changes, stating that the information has been classified as CONFIDENTIAL and is exempt from disclosure under Section 8(1)(a) of the RTI Act, 2005.

The section 8(1)(a) of the RTI Act, 2005, exempts information that would harm India’s sovereignty, security, strategic or economic interests, or foreign relations, or incite the commission of an offence.

The RTI application was filed by social activist @SQMasood.

The the MHA’s response can be accessed through the link below.
rtilibrary.in/share/028e7e9a…

Three things would settle it. The evidence exists:

1. CBI: release SFMS access logs, Oct 15–17.
2. IFTAS: did the hub see the 187 messages, and from which gateway?
3. RBI: is MFA on SFMS console access mandatory now?

The logs name the door. Publishing settles it.

What we did not find: any public statement from RBI or CERT-In. No recovery figure. No account-freeze count. The 187 transfers are per the bank's complaint as reported. IFTAS disputes the breach vector. We grade these separately for a reason.

Passwords still open the doors on the bank side. We read the RTGS System Regulations (Oct 2024), the IDRBT-CA certificate practice statement, and RBI's access circulars. We found no published circular that mandates multi-factor authentication for SFMS console logins.

SFMS is the hub through which RTGS and NEFT messages travel between 300+ banks. Bank side, each member runs a gateway on its own servers. Access rides on INFINET, the closed financial network, and IDRBT-CA digital certificates.

What IFTAS, the RBI subsidiary that runs SFMS, said (22 Oct, reported 25 Oct): no unauthorised access to the SFMS hub, and no security breach. Both statements cannot be equally complete. That is the finding that stands.

What the bank told Mumbai police (complaint, 22 Oct; FIR for cheating by personation; reported 24–25 Oct): unknown persons used the national SFMS messaging system to push 187 unauthorised RTGS credits. Sender records in those messages do not belong to the bank, per its complaint.

₹13.97 crore. 187 transfers. Three days.

Central Bank of India says the money left its settlement account at the RBI between October 15 and 17, and its own books show no matching entries. Full verification: cyber.cashlessconsumer.in/pages/cbi-sfms…

Look who is talking about cyber security. An organisation that is in deep slumber and doesn’t care about citizens rights. Meet the Ministry of Electricity & IT. Your neighbour censor, digital strongman aka the cop who stops your freedoms.

BBMP decentralised into 5 corporations. Blore Police Comissionerate also likely to split into 5.

Why then should protests remain centralised and locked in freedom park ?

Join the Round Table organised by by @horaata_protest on Mon 26 Oct.

@bengawalk @clifroz @aishwaryar23

⚠️ UPDATE: ORACLE PULLS eMUDHRA AND COMODO AAA ROOTS FROM JAVA IN NEW SECURITY ALERT (CVE-2026-114820)

Oracle issued a second eMudhra-related Security Alert on Oct 24, 2026. Its Oct 21 alert (CVE-2026-91403) distrusted the compromised intermediate CA certificates. The new update icates themselves from the JDK cacerts keystore.

* Removed: emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 and Comodo's AAA Certificate Services (owned by Sectigo)
* CVE-2026-114820, CVSS 3.1 9.1 (JSSE, network, no authentication)
* Affected: Oracle Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; GraalVM for JDK 17/21; GraalVM EE 21.3.20.0.2
* Fixed: JDK 27.0.1.0.3, with matching .0.3 baselines for 25, 21, 17 and 11, and 8u511-b33

This is a cleanup step for the eMudhra incident DDW has covered since Oct 20, not a new breach, and no exploitation has been reported. Removing the Comodo root does not mean its key was compromised. If you only patched for the Oct 21 alert, update again, then test anything that still chains to these roots. Check other Java vendors' builds separately.

oracle.com/security-alert…
#CyberSecurity #Java #PKI

⚠️ UPDATE: eMUDHRA CLEANUP GAP: DATADOG'S WINDOWS AGENT STILL TRUSTED CHAINS BUILT ON THE COMPROMISED KEYS

Datadog confirmed that its signed 7.84.5 Windows Agent still accepted cross-signed TLS chains using the compromised eMudhra intermediate CA keys. Its embedded Python loads stores but never reads the Disallowed store, so the OS-level distrust did not reach it.

* Fixed in Datadog Agent 7.84.6 (release notes dated Oct 23, 2026).
* The fix backports CPython's key denylist for CVE-2026-115557: any chain containing one of the 8 compromised eMudhra keys is now rejected, whatever trust store it anchors in.
* CPython merged that fix upstream on Oct 24. Python runtimes that have not picked it up may still trust these chains.
* Sectigo chains and private CAs in the Windows store are not affected.

No exploitation or intercepted traffic has been reported, and this is not a Datadog breach. Upgrade Windows agents, and check the trust your Python runtimes actually enforce, not just the OS or CA bundle.

github.com/DataDog/datado…
#CyberSecurity #SupplyChainSecurity #PKI

Bhakts keep calling me all sorts of names here: 'urban naxal' 'dirty/ugly leftist scum' 'Commie Bong whore'. So I thought I would lean into all this name calling and share a wonderful visual someone shared on Insta about all the things we have because of protests. Protests are a diminishing democracy.

RT @SushantSin: Online security depends not only on the precautions users take, but also on whether the organisations entrusted with protec…

For code to be considered law, it has to be open. But codification of law with software is resulting in black box governance, where one won't know what is the code? We are ending up with Kafka's trial where you are punished because they won't tell you what the law is.

SCOOP: The Censor Board has had a data breach exposing hundreds of documents from the e-Cinepramaan portal. Application dockets were uploaded in bulk on the Internet Archive by a user with a display ID that of Prasoon Joshi's name in Russian.thehindu.com/sci-tech/techn…

Correction: thousands of government sites were impacted from eMudhra cert revocations.

1337+ from India
200+ from Kenya
50+ from USA
and a few from Philippines, Qatar, Ethiopia, Chile, and Dominica.

Updated the list in the blog: captnemo.in/blog/2026/10/2…

Why are the armed forces using tear gas on peaceful GenZ protesters in Arunachal Pradesh?