u/Direct_Quail45

Hey everyone,

I graduated last year with a Bachelor's degree in Computer Science, and my current job requires me to port Ghostlock (CVE-2026-43499) to multiple android devices.

Honestly, a lot of it currently goes over my head. I think I understand the basic concept of a use-after-free vulnerability, but I don't understand how it works at the kernel level or how the exploit code actually works.

I'm also struggling to get the exploit working on my target device. Since I don't fully understand the exploit's internals or how the kernel processes the operations involved, I'm having a hard time figuring out what needs to be changed to make it work.

Here's what I have so far:

- Kernel panic logs from my attempts to run the exploit.

- The compiled kernel source code for my target device.

- The ability to modify the kernel source code and flash a custom kernel onto the device.

The problem is that I don't really know where to start. The kernel panic logs are difficult to understand, the exploit's source code is confusing, and navigating the relevant kernel code is equally challenging.

My current plan is to:

1. Learn how to interpret the kernel panic logs.

2. Understand the exploit's source code and how its different parts work.

3. Trace the relevant operations through the kernel source code to understand what's happening internally.

4. Use that understanding to troubleshoot the exploit and figure out what needs to change for my target device.

I'm not sure if this is the right approach or if I'm missing some important prerequisites.

For context, I'm still relatively new to low-level kernel exploitation, so I'm trying to figure out the best way to approach this without blindly changing things until they work.

For those experienced with Linux kernel exploitation or porting Android kernel exploits, how would you approach this problem? Are there any resources or concepts I should focus on first?

Any advice would be greatly appreciated!

Hello everyone,

I'm a 2025 graduate and was recently hired as an Application Security Engineer in April 2026. I got the role mainly because of my security-related projects and open-source contributions. However, I had zero bug bounty or web application security experience when I joined.

Initially, I was given some time to learn on my own, so I went through PortSwigger Web Security Academy. After that, I was assigned multiple projects to perform security reviews on.

One of the projects reportedly had around 2 billion lines of code, while the smaller projects still had lakhs/crores of lines of code. I was given roughly one week for the smaller projects and one month for the huge project.

I asked for source-code access because I thought reviewing the source would be more effective than just black-box testing. The problem was that much of the code was written in language I didn't know (Laravel/PHP and C#)

At first, I basically used grep to search for common patterns related to SQLi, XSS, SSRF and path traversal (that's it), and looked for exposed/open endpoints.

However, somewhat by coincidence, I found an interesting issue where an OTP was being stored in a browser cookie before it was sent for 2FA. I found this with some help from Codex, and it made me realize that simply grepping for common vulnerability patterns isn't enough.

The company plans to give me these same applications again in about three months after more code has been added.

This is where I'm stuck.

The problem is that grep takes only a few hours, while manually understanding codebase of even a single small project can take months. I also can't paste an entire project into the free version of Codex.

Once I've finished the obvious searches and run out of Codex usage, I sometimes end up staring at the screen with nothing meaningful to do.

This has also become uncomfortable because my employer has indirectly mentioned that they doubt my skills since it looks like I'm just sitting in front of the computer

I'm worried about what happens when I'm given the same applications again in three months. What am I actually supposed to do?

I feel like I've been given a task without a proper methodology for approaching it.

My boss is a Cyber Security Specialist, but as far as I know, he hasn't actually worked specifically in Application Security, so there isn't really anyone senior on the team who can teach me how a proper large-scale AppSec review should be conducted.

For experienced AppSec engineers:

->How would you approach a codebase this large?

->How do you systematically find vulnerabilities without manually reading millions/billions of lines?

->What tools/techniques should I learn beyond grep and AI?

->Is it normal for a junior AppSec engineer to be given huge codebases with little guidance, or is the task itself structured incorrectly?

I genuinely don't know what the next step should be.

Location: India

Hi everyone,

I’m a 2025 graduate, and I really want to get into TCS. It’s honestly one of my dream companies, and my parents also really want me to join TCS.

I have a low CGPA (6.18), and I had a backlog when TCS came to my campus for recruitment. I’ve now cleared all my backlogs and completed my degree.

This year, I appeared for TCS NQT for free through a notification from my college. I managed to solve one coding question, with 6/7 test cases passing. Unfortunately, a few days ago I received an email saying that I wasn’t shortlisted.

I’ve heard that getting shortlisted through off-campus TCS NQT is extremely difficult and that very few candidates actually get calls. So I’m wondering:

- Is it realistically possible for someone like me to get into TCS through off-campus NQT?

- Has anyone here actually been hired by TCS through off-campus NQT? If so, what did you do?

- What kind of score should I aim for in each section to have a realistic chance?

- Where should I prepare for TCS NQT?

For some additional context, I have open-source contributions, including a contribution to a Google open-source project, as well as contributions to a few other projects.

I’m currently working at a small company with a package of 5.5 LPA. However, I’m genuinely willing to accept even 3 LPA if it means getting an opportunity at TCS.

I really want to know if there is still a path into TCS for me.

If anyone here has gone through the off-campus process or knows someone who has, I’d really appreciate some honest advice. What should I do from here?

TCS is my dream company — Is it even possible to get into TCS off-campus?

Hi everyone,

I’m a 2025 graduate, and I really want to get into TCS. It’s honestly one of my dream companies, and my parents also really want me to join TCS.

I have a low CGPA (6.18), and I had a backlog when TCS came to my campus for recruitment. I’ve now cleared all my backlogs and completed my degree.

This year, I appeared for TCS NQT for free through a notification from my college. I managed to solve one coding question, with 6/7 test cases passing. Unfortunately, a few days ago I received an email saying that I wasn’t shortlisted.

I’ve heard that getting shortlisted through off-campus TCS NQT is extremely difficult and that very few candidates actually get calls. So I’m wondering:

Is it realistically possible for someone like me to get into TCS through off-campus NQT?

Has anyone here actually been hired by TCS through off-campus NQT? If so, what did you do?

What kind of score should I aim for in each section to have a realistic chance?

Where should I prepare for TCS NQT?

For some additional context, I have open-source contributions, including a contribution to a Google open-source project, as well as contributions to a few other projects.

I’m currently working at a small company with a package of 5.5 LPA. However, I’m genuinely willing to accept even 3 LPA if it means getting an opportunity at TCS.

I really want to know if there is still a path into TCS for me.

If anyone here has gone through the off-campus process or knows someone who has, I’d really appreciate some honest advice. What should I do from here?

Hello,

I'm a fresher and I was just recently hired in a small company. Coded in python a bit 5 years ago. One of my boss has put me in Automation work with python (to compare excel sheets) and I'm ENTIRELY depending on Codex for all work. I write absolutely zero line of code. Just prompt and all my work is done by it. I'm learning absolutely NOTHING even in slightest. And this makes me worried. I must meet deadlines and i don't have enough time to learn it by myself using stack overflow and trial error. This is making me worried — that I'm just becoming a prompt guy and not actual developer/engineer. I want to stop depending on Codex but I can't because they ask me to complete stuff as quick as possible

I wanted to ask — is it common with most developers these days to just depend on Codex when coding something and barely depend on raw coding?

Hello,

I was recently hired as an Application Security Engineer at a company. They liked my resume and hired me directly for the cybersecurity role.

The problem is that I’m the only cybersecurity person here. There’s no senior security engineer, no mentor, and no established security team. I’m also a fresher, so I expected at least some guidance or structured learning. When I asked my manager for direction, the response was basically: “Research it and figure it out on your own.”

They assigned me their applications to pentest, but surprisingly, I’m not finding any major vulnerabilities. Since they expect detailed reports from me, I’ve started stretching minor observations into reportable issues just so it looks like I’m contributing something meaningful.

The company also has a limited number of apps and services. Once I finish reviewing them, I honestly don’t know what work will even remain for me.

Right now, I already spend a lot of time with nothing substantial to do. Sometimes I’m just sitting at my desk staring at the screen so it looks like I’m busy. They even joked about it once.

What scares me is that I feel like I’m neither learning nor growing technically. I’m worried about a few possible outcomes:

1. I keep pretending until I eventually “become” experienced — getting paid and collecting years of experience, but without actually developing strong skills. Then someday I leave and struggle badly in another company because I never truly learned enough.

2. The company eventually realizes they don’t really need me or expects more than I can provide, and I get laid off.

3. I become stuck in a comfort zone where I’m employed but professionally stagnant.

At one point, I even asked for more work because I genuinely wanted to contribute. Since they didn’t have security-related tasks available, they ended up giving me work like comparing Excel sheets and automating the comparison process.

I am honestly worried if this situation is a long-term career risk