
Tech, Policy, Digital, Green | India's 1st GRIHA Home | Stephanian | Xaverian | [email protected]
New Delhi, India
Joined July 2008
- Tweets181K
- Following2.1K
- Followers22.3K
- Likes70.8K
Pinned Tweet
"We must always take sides. Neutrality helps the oppressor, never the victim. Silence encourages the tormentor, never the tormented": Holocaust survivor Elie Wiesel, Nobel Peace Prize Acceptance Speech 1986
PKR | প্রশান্ত | پرشانتو retweeted
A mild-mannered primary school teacher proposed marriage to unmarried women without asking for dowry, spent one night in a lodge, and handed them a "contraceptive pill" outside public bus stand washrooms—leaving 20 women dead from cyanide poisoning.
The reason might surprise you.
Between 2003 and 2009, a baffling pattern of unattended deaths troubled police across Karnataka and neighboring states.
Young women from lower-middle-class families were turning up dead inside the cubicles of public washrooms at major KSRTC bus stands in Mysuru, Madikeri, Hassan, and Bengaluru.
Each scene looked identical:
The victims showed zero external injuries, signs of physical struggle, or weapon wounds.
Their gold jewelry, handbags, identity proofs, and cash were gone.
Beside them lay only a tiny, empty plastic capsule foil or a sachet.
Local police precincts initially treated the deaths as isolated suicides caused by failed love affairs, closing the case files without connecting the dots across district borders.
Behind this calculated routine stood Mohan Kumar—a 46-year-old physical education teacher from Bantwal, known chillingly to forensic history as "Cyanide Mohan."
His modus operandi was a masterclass in exploiting social vulnerability:
The Target: He scouted bus stations and temple towns looking for unmarried women in their late twenties or thirties facing difficulty finding grooms due to societal pressure or heavy dowry demands.
The Pitch: Presenting himself as a respectable, eligible bachelor under various false Hindu and Muslim aliases (Anand, Sudhir, Shashidhar), he claimed to be an influential government official. He won over their trust by promising immediate marriage without demanding a single rupee of dowry.
The Setup: He convinced the women to elope with him, instructing them to wear their finest bridal sarees and carry all their family gold ornaments. He took them to out-of-town lodges, spent the night, and convinced them to leave their jewelry in the room the next morning before visiting a nearby temple for wedding rituals.
The "Pill": On the way, near a crowded bus stand, he handed them a capsule, falsely claiming it was a pregnancy prevention pill to avoid conceiving before the wedding ceremony. To avoid vomiting, he instructed them to swallow it inside the private washroom with a sip of water.
The capsule was packed with industrial-grade potassium cyanide, sourced from local goldsmiths under the pretext of cleaning silver ornaments.
Within seconds of ingestion, the cyanide paralyzed cellular respiration. As the victims collapsed inside locked cubicles, Mohan walked back to the lodge, packed up their gold and cash, and caught the next outbound bus.
The five-year killing spree collapsed in October 2009:
A 22-year-old woman named Anitha from Barimar went missing after leaving home for a temple.
Her family relentlessly tracked her call records. When police analyzed the phone logs, they noticed a recurring number that had gone silent the day of her disappearance.
Detectives traced the handset tower pings to Deralakatte near Mangaluru, leading to Mohan Kumar’s arrest on October 21, 2009.
When police raided his quarters, they recovered:
8 packets containing raw cyanide powder.
Multiple fake identity cards, voter IDs, and over 100 mobile SIM cards used to groom victims.
Piles of gold jewelry pawn receipts.
Under sustained interrogation, Mohan confessed to luring and murdering 20 women across Karnataka, Kerala, and Tamil Nadu.
His judicial trials set historical legal benchmarks:
Between 2013 and 2020, Mohan Kumar was tried in 20 separate murder cases, securing convictions in all of them—including five death penalties (later commuted to life imprisonment without remission) and multiple life terms.
PKR | প্রশান্ত | پرشانتو retweeted
He is a whistle blower, former intelligence officer, journalist..this was abt his experience with India... But our hinduthuva - RSS guys propaganda as if these white ppl brought this shit to us...
PKR | প্রশান্ত | پرشانتو retweeted
Of the world’s 30 cities with the worst air pollution, 17 are in India. The capital, New Delhi, has the poorest air quality among capital cities globally, with concentrations of particulate matter (PM2.5) nearly 10 times higher than the World Health Organization guidelines.
Look at the dust and pollution along this stretch from RK Puram to Munirka due to road construction. This is on Swami Vivekanand Marg, and the dust has been hanging in the air for over a week now. I have never seen a dust haze this thick. @MCD_Delhi @gupta_rekha
Should we choke ourselves to death.
PKR | প্রশান্ত | پرشانتو retweeted
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
PKR | প্রশান্ত | پرشانتو retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
PKR | প্রশান্ত | پرشانتو retweeted
What happens when you insult the Prime Minister?
In India, a 15-year-old’s life has been upended after remarks at a Cockroach protest. In her first interview since the backlash, she speaks about the trauma and a nightmare that is far from over.
theguardian.com/world/2026/o…
PKR | প্রশান্ত | پرشانتو retweeted
This is my brother, Shuaib, an exceptional paediatric surgeon in North Carolina. He’s been operating on newborns and children (u18) for 35+ years. Yet he still takes mandatory surgery board exams. Last Saturday, he scored nearly 90% (min 80% required for passing).
India aspires to world-class healthcare but we keep lowering medical certification standards. Besides, does it serve our goal of high medical std if passing / entry criteria differ for General and reserved category doctors? What about patient safety?
What do yall think?
PKR | প্রশান্ত | پرشانتو retweeted
Statement : CERT-In needs to stop spamming vague and alarming cybersec alerts
October 22, 2026
The Internet Freedom Foundation is concerned about government SMS messages circulated in English and Hindi under the sender ID AD-ARWGOV-S (Screenshot 1 and 2). These messages invoke CSK and CERT-In, advise recipients to keep their devices free of botnets and malware, and ask them to download a free removal tool from csk.gov.in. The screenshots also show repeated messages from the same sender warning of imprisonment and fines for fraudulently obtaining SIMs or telecom services.
The malware advisory provides no finding about the recipient’s device. Yet the linked website tells visitors their device is “probably infected”, while its FAQ says their internet service provider has been notified (Screenshot 3). Receiving a generic SMS or visiting this public webpage does not establish an infection. Presenting general awareness messages this way risks causing needless panic and making recipients believe their devices have been individually identified as compromised.
There are also concerns about M-Kavach 2, one of the recommended tools. Its Google Play listing declares “No data collected”, while its linked Android privacy policy describes collecting device identifiers and installed-app details and transmitting this information for analysis. C-DAC must explain this discrepancy and disclose access, security and retention safeguards.
CERT-In must immediately correct the website and clearly distinguish general advisories from evidence-based infection alerts. Encouraging software downloads through unsolicited SMS links risks normalising behaviour that scammers exploit. Government-recommended tools must remain voluntary, minimise permissions and data collection, and undergo independent security and privacy audits with published findings.
We urge the nodal ministry, MEITY to redirect its resourses from political censorship towards the cyber security of ordinary Indians.
The eMudhra leak has become a major cyber security issue globally. Many global infosec accounts and experts are questioning the capability of Indian Firms. While some of their criticism is justified but we need to ask them one question. Can they sing two stanzas of Vande Mataram?
PKR | প্রশান্ত | پرشانتو retweeted
The Congress party’s response to multiple charges of sexual harassment levelled against its MP Bimol Akoijam is one more example of an alleged sexual offender who is sought to be protected by his power circle.
The Congress could have and should have done better.
My column in NDTV
ndtv.com/opinion/bimol-akoij…
An excerpt:
“There have been veiled suggestions that the two cases cannot be equated since Brij Bhushan Sharan Singh is a strongman from the Hindi heartland with several criminal cases against him, and Bimol Akoijam is a scholar and an academic. However, the fact is that a person's level of scholarship or refinement or professional mettle has no bearing whatsoever on his alleged acts of sexual misconduct. The sexual abuse of women in the workplace or, for that matter, in academia arises out of a powerful man's conviction that he can get away with molesting a woman physically or verbally on account of his institutional clout. It is embedded in his belief that because of the power asymmetry between himself and the woman, he is entitled to look upon her as his prey, ask her for sexual favours, touch her inappropriately, or subject her to sexually offensive remarks. It is patriarchy at its ugliest, male entitlement at its crudest.”
PKR | প্রশান্ত | پرشانتو retweeted
Anderson Cooper takes a look at President Trump's history of commenting on men's bodies after his recent remarks on a senator's body.
Like Trump's insider trading?
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
PKR | প্রশান্ত | پرشانتو retweeted
Wikipedia, which went online in January, 2001, is now the greatest compendium of human knowledge ever assembled. Yet in the last four years, it has lost 25 per cent of its traffic—more than a billion monthly visitors. Since the site recruits its editors from its audience, this dip also threatens its growth and quality. Many users have been intercepted by A.I. “It’s a cruelly ironic fate,” Julian Lucas writes. Wikipedia was the single most important training corpus in the history of artificial intelligence. Now artificial intelligence is threatening its survival. Read Lucas’s report on the future of Wikipedia: newyorker.com/books/under-re…
PKR | প্রশান্ত | پرشانتو retweeted
Bhakts, chaddis and tech volunteers of Koramangala. India's lakshman rekha sovereign cryptography is under attack. Rise up and build Aadhaar linked quantum crypto sovereign signatures. Do your karmic duty and lead us to another crisis 🍿
PKR | প্রশান্ত | پرشانتو retweeted
My father's phone was hacked by cyber fraudsters and they've withdrawn a huge amount from his bank. I have called your number endless times @Cyberdost but your responders are busy ALL THE TIME
What's even the point of this helpline?
PKR | প্রশান্ত | پرشانتو retweeted
Three cartoons which the Modi Sarkar didn't want to be seen by Indians on Instagram. (The first cartoon was blocked TWICE in three days, I presume, just to speed up the profile-blocking process)
If you have Instagram account, please DON'T post these cartoons on Instagram, just to STOP more Indians from seeing them! #BlockSarkar
Political leaders may never have enjoyed being mocked, and censorship of artists is certainly not new in India. But there is a significant difference between disagreeing with a joke and having the ability to make it inaccessible to millions of people with a legal notice.
(1/3)
#freespeech #FoE #censorship
Three cartoons which the Modi Sarkar didn't want to be seen by Indians on Instagram. (The first cartoon was blocked TWICE in three days, I presume, just to speed up the profile-blocking process)
If you have Instagram account, please DON'T post these cartoons on Instagram, just to STOP more Indians from seeing them! #BlockSarkar
Ahhh. They should be jailed because Paris. That makes sense
In the hearing on Saurav Das and Ashutosh Ranka’s plea challenging their judicial custody before the Delhi High Court today, Justice Subramonium Prasad cautioned that peaceful protests could escalate into arson, looting and burning, citing what is happening outside the country.
Read here: barandbench.com/news/litigat…
@Cockroachisback @AshutoshRanka @SauravDassss































