Security research & writeups
Long-form, methodology-first writeups by Abhishek Bhaskar (Abhi HackZ) — CVE research and coordinated disclosure, bug bounty, API and web testing, AI-agent security, Android pentesting and recon. Written to be learned from, not skimmed.
Four CVEs in Progress Software Products: Command Injection, SSRF and Chart-Tooltip XSS
What CVE-2026-91140, CVE-2026-92931, CVE-2026-106138 and CVE-2026-106139 are, how each bug class works, how the vendor fixed them and what your team should check.
From a Bugcrowd VDP Report to a Published CVE: How Coordinated Disclosure Actually Works
The full path from finding a bug in a vendor's product to a CVE record with your name on it — VDP submission, triage, CNA assignment, advisories and what to put in the report.
Testing AI Agents and MCP Servers: A Practical Prompt-Injection Playbook
Tool-calling agents and MCP integrations turn every document, web page and ticket into an attack surface. Here is how I test them — threat model, payload classes, proof of impact and fixes.
BOLA, Mass Assignment and the API Bugs That Still Pay in 2026
The OWASP API Top 10 hasn't changed, but the apps have. How I test object-level and function-level authorization, property-level exposure and GraphQL in modern APIs.
Framework-Level Bugs: Middleware Bypasses, SSR Fetches and the SSRF Hiding in Your Renderer
Modern web stacks move logic into frameworks, SDKs and renderers — and so do the vulnerabilities. How to test Next.js-style middleware, server-side fetchers and headless-CMS renderers.
Android App Pentesting in 2026: MASVS-Aligned Method, Frida Workflow and the Findings That Matter
A repeatable Android methodology — static review, dynamic instrumentation, network and storage checks — mapped to OWASP MASVS v2, with the bug classes that keep showing up in fintech and consumer apps.
Building a Recon Pipeline That Scales: From ASN to Live Attack Surface (With AI Where It Helps)
The four-stage recon system behind my bug-bounty and VAPT work — seeding, enumeration, resolution, change detection — and where LLM assistance actually earns its place.
Bug Bounty in 2026: VDPs, AI-Assisted Triage and How to Earn Real Hall of Fame Credit
What changed in bug bounty, why vulnerability disclosure programs are worth your time, how to write reports that survive AI-assisted triage, and the path from first valid report to CVE credit.