News · r/cybersecurity
-
r/cybersecurity
I'm being cyber-stalked and I don't know what to do.
It started a little over a week ago when they joined a discord I was in and I called them out for posting ai generated illicit images. They have since changed their usernames to ones close to or exactly matching mine and having a pfp similar to mine, one of which ai generating a picture of my pfp with hate-imagery attached. Since then they have moved to other websites such as twitter where they i…
-
r/cybersecurity
The Internet goes on high alert after discovery of 8 compromised TLS certs
r/cybersecurity · arstechnica.com
-
r/cybersecurity
How can I learn CTF
I’ve built a website for my own CTF course, and I’m looking to take its design to the next level. Although the functionality is there, the interface still has that obvious AI-generated look. I’m looking for ways to make it feel more professional, polished, and thoughtfully designed. Has anyone experimented with prompts that help AI coding agents produce more distinctive, high-quality UI designs r…
-
r/cybersecurity
Five days before the French supermarket fridge attack, France had more exposed Danfoss StoreView dashboards than the rest of the world combined
I work at IPinfo, which runs weekly scans of the IPv4 Internet. After the October 11–12 attack that pushed refrigeration in hundreds of French supermarkets into defrost, we went back through those scans to count Danfoss StoreView dashboards, the web front end for the AK-SM controllers named in the reports. What the October 6–7 scan found: 2,528 addresses with a StoreView dashboard, in 73 countrie…
-
r/cybersecurity
Google Cloud Outages, AI-Built Exploits, and GhostAction's Return
r/cybersecurity · kylesinvestigation.com
-
r/cybersecurity
Endorsement after passing CISSP
I recently passed CISSP exam but struggling with endorsement! I do not know anyone who is CISSP! I made a move from SWE to security two years back and I have over 5 years of experience working on application mostly backend ant cloud! How do i proceed? Any feedback from the experienced senior ? Please Help!
-
r/cybersecurity
CVE-2026-46633: Proving exploitability of Twig sandbox bypass
r/cybersecurity · gist.github.com
CVE-2026-46633 -
r/cybersecurity
LOLCHAIN: Blockchain abuse techniques, chain evidence and network endpoints for threat hunting
LOLCHAIN is a community reference for researching and hunting blockchain abuse, inspired by the projects collected on lolol.farm. The main goal is to collect relevant network endpoints in one place, with supporting research and evidence, so defenders can investigate blockchain-related activity and baseline its use in their environments. The reference connects: Techniques: How blockchains and dece…
-
r/cybersecurity
Open feed of emerging 0-days with public timestamps from first signal to CVE and KEV listing (API and MCP, no auth)
r/cybersecurity · zero.ethiack.com
-
r/cybersecurity
Palo Alto's firewall OS has been under attack from multiple ransomware groups since June
r/cybersecurity · theregister.com
-
r/cybersecurity
What kind of question would you ask a candidate in an interview for an internship/junior/entry-level role in Pentesting/Ethical Hacking?
Hi guys! I’m currently preparing for interview for an ethical hacking internship. I just wanted ask or find out common technical and non-technical questions people in the industry have asked candidates for similar entry level positions? Not CIA triad stuff, but more technical ones or some questions that really make you stop and think you know? It would also help if examples of good answers are in…
-
r/cybersecurity
Guidance for mobile application security testing
I'm a fresher stuck without proper guidance. Few weeks ago, I got assigned with a task to pentest a mobile app, I don't know anything Abt it, the setup, the methodology, etc., I don't have any senior to seek help in my org. I spent weeks searching, watching YT tutorials. But I couldn't understand anything 😭. The setup itself is failing sometimes. Being an enthusiastic hands-on person and not und…
-
r/cybersecurity
100+ 1G files from darkweb - can people really download leaked data?
Disclaimer: Not looking to download! I was following one of the F500 business's ransomware incidents from early October. No statement from the company or any regulatory filing, which is not surprising when there is no encryption/disruption and only exfiltrations. I've seen small biz just not disclosing as long as possible but expected to hear more from the large companies. There was no denial or…
-
r/cybersecurity
Meta Muse exposes users' personal and business secrets when they share conversations
r/cybersecurity · arstechnica.com
-
r/cybersecurity
18 years old and want to build a career in cybersecurity. Where should I start in 2026?
Hey everyone, I'm 18 and I really want to build my career in cybersecurity. I've always loved tech, software, coding, computers and hacking/security. I know some basic coding, but when it comes to cybersecurity I'm basically a beginner and I don't know what I should learn first. With AI changing programming and tech so quickly, I'm also wondering what cybersecurity skills are actually worth learn…
-
r/cybersecurity
Large Companies - What's your (Cyber) on-call Schedule Like?
Curious to what other large companies on-call schedule is like? For reference, my company is >15,000 employees. The (Internal) cyber team is ~20 people in 3 different regions of the world. We follow the 'follow the sun' model, where you have one person responsible for your timezone per region (during the week), then, the next shift takes over. On the weekend we have 1 person on call for both days…
-
r/cybersecurity
Blocking the Entire Internet
Some members of my team are throwing around the idea of blocking the entire internet and whitelisting what we need. The idea kind of seems like a nightmare to me, having to allowlist potentially thousands of domains, APIs, CDNs, etc. I understand that this is a practice in heavy regulated environments, so I was wondering if anyone has any experience with it. Is it worth the work to go through wit…
-
r/cybersecurity
Ukraine's state data-exchange system targeted in a 5-month Log4Shell campaign, exposed by the attacker's own mistake
r/cybersecurity · hunt.io
-
r/cybersecurity
Looking for AppSec champions to lead community sessions for OWASP OASIS.
Hey everyone! OWASP OASIS, an open-source security community that validates vulnerability fixes in open-source projects, is looking for volunteer leaders. https://www.owasp-oasis.org/ We've got 900+ AppSec people signed up so far. Now we're trying to turn that into an actual community, not just a sign-up list. So we're looking for volunteers to lead a few kinds of community-run sessions: Office h…
-
r/cybersecurity
Everything Everywhere All at Once: Self-replicating AI, bioweapons research and AI-ported games share one problem — friction is eroding.
r/cybersecurity · macanorak.com
-
r/cybersecurity
Analysts: (4on4off) Nights>Days>Nights>Days - is there any other Analyst on this shift pattern? How is it?
Recently going for a new Analyst role, and the shift patterns are 4on4off, which I'm completely fine with. But it's not just 1 night shift block a month it's 4Night>4Day>4Night>4Day. It would normally take me a week to recover from a night shift block in my last role where it was one night block a month. I really want this role, but I feel like my health is going to take a hit here as I naturally…
-
r/cybersecurity
All vulnerabilities are now race conditions
r/cybersecurity · blog.himanshuanand.com
-
r/cybersecurity
FIREBREAK TOOL
🚀 I just launched FireBreak, an open-source project I've been building! FireBreak helps you map the connections between your online accounts and understand how recovery and sign-in relationships could affect your security. The idea is simple: if one account gets compromised, which other accounts might be at risk through their recovery paths? 🔎 Explore account dependencies 🛡️ Review security re…
-
r/cybersecurity
TryHackMe SAL1
hello, everyone. lately i have been gathering information regarding a possible career switch and i am yet to choose a path. i am not entirely sure that i would succeed in cybersecurity as i know the market is already saturated but it's one of the options for now. in this process of mine i have come across different opinions regarding certifications, interviews, practical skills, hands-on experien…
-
r/cybersecurity
Is there any cyber security communities I can join
Hello everyone, IAM a 21 IT student who is looking forward to join some new community and make some friends whom I can learn cyber security with. I am a bit new but I got the basics done. Are there any communities I can join for learning or doing CTF's together please let me know. Most communities I look at online are either too big or very quiet. Please let me know Thanks for reading
-
r/cybersecurity
Difficulty spotting cheaters during interviews & techniques to stop it
I’m in the process of interviewing candidates for a Jr. security analyst role and am running into the dilemma that I don’t trust all the candidates. I’m getting individuals with resumes with garbage formats but somewhat far fetched job histories (i.e someone who was a SOC analyst at a Fortune 500 computer company and a current analyst at a major financial firm, but trying for a Jr analyst role at…
-
r/cybersecurity
New GRC GUY
Good morning guys, I want to ask about the next step I should take. I come from a technical background (SOC). I have good knowledge in SIEM, AD, EDR, network and firewalls. In the last 2 weeks I started studying ISO 27001. What is the next step I should take?”
-
r/cybersecurity
US Army Cyber Command builds agentic AI to hack adversary networks
r/cybersecurity · vectorwire.ai
-
r/cybersecurity
GRC - Latest technologies
People in GRC roles, how much effort do you put into keeping upto date with the latest technologies in your own time? I am a Senior GRC professional and I usually put in very little these days....(used to be all over it) which sometimes feels okay, but sometimes feels I'm making bad decisions. My motivation rises and drops. Side Note: IMO the statement of "you dont need any technical knowledge to…
-
r/cybersecurity
Cybersecurity discussions here - your go-to archive for data breaches at r/BreachArchive!
Hi everyone! Cybersecurity is one of my interests, and I wanted to create something simple, useful, and informative for the Reddit community. With data breaches and security incidents making headlines almost daily, I decided to start r/BreachArchive. If you come across a report about a data breach, leak, or other significant security incident, feel free to share the link here: https://www.reddit.…
-
r/cybersecurity
A China-linked operator used AI agents to attack governments across Asia.
During routine threat actor infrastructure hunting, I identified a suspicious APAC-hosted VPS running an autonomous AI intrusion platform with its entire working directory exposed to the open internet on port 9000. No authentication. 150+ live campaign files sitting there. I published my initial findings. Then vulnonhq took it further. Grateful to vulnonhq for the credit in their report and for d…
-
r/cybersecurity
The US Army wants AI agents that hack its enemies with almost no human oversight
r/cybersecurity · madrobot.blog
-
r/cybersecurity
local LLM for cybersecurity/VAPT on 2× Tesla T4 GPUs (32GB VRAM total)?
I’m using Ollama + OpenCode and want a model good at web app pentesting, JavaScript/API security audits, code review, and vulnerability analysis. Which model, quantization, and context length would you recommend for the best accuracy and speed?
-
r/cybersecurity
I just got a follow up email for immigration attorney services, written in Spanish in my Instagram. Turns out they were my Uber driver in another state a month ago. This is too strange to be a coincidence
So the message I got was to my insta that does not have my name , connected accounts, only my face. It was a message following up on a request for immigration law service. I'm a us citizen living in Michigan. I visited Texas last month. I have a pretty good memory. I got an Uber for maybe five minutes, and during the drive the Uber driver mentioned they were an immigration attorney. The profile t…
-
r/cybersecurity
Incident Response Workflow Improvements
Looking for suggestions on improving our incident response playbook, particularly when it comes to endpoint isolation and forensic preservation. We are a multinational SOC operating primarily in a remote capacity. Our current process is to immediately contain an infected asset by isolating it from the network to minimize the potential impact and prevent further spread. However, POC's often become…
-
r/cybersecurity
Cybersecurity breach in family
Hi everyone Just wanted to ask the group here some questions to help me and my family out. A couple weeks ago my elderly father fell for a classic telescammer saying “someone is buying an iPhone on your Verizon account please click this link to stop it” which then lead to a login page that looked identical to Verizon. The whole family woke up early the next morning to our phones not working, they…
-
r/cybersecurity
What sandbox do you guys use?
We've been using the free version of Any Run at work since we don't really have the budget for a paid sandbox. It works fine for most things, but the free version has its limitations, and there's always a concern about accidentally submitting something sensitive publicly... Recently, I've been thinking about setting up my own sandbox for the team, maybe on AWS/Azure or even hosting it locally. It…
-
r/cybersecurity
Anyone else feel like they’re just a glorified spreadsheet administrator at this point?
I got into cybersecurity because I actually liked the technical side of things. Troubleshooting, figuring out how systems break, and stopping bad things from happening. Fast forward to today, & I swear 80% of my week is just chasing down department heads to fill out row 47 on some massive compliance spreadsheett so we can pass an audit. It's exhausting. I feel like my actual technical skills are…
-
r/cybersecurity
GRC Courses Battle
Is Simply Cyber's (Dr Gerald Auger) course or GRC Mastery's (UnixGuy) course better? I don't care about industry recognition I care about the quality of the content and how much can I actually learn to then practice by myself. Although I believe GRC Mastery also gives you a 27001 ISO Lead cert.
-
r/cybersecurity
This is gonna sound dumb, but why is there a discrepancy in what corporate wants to hear vs a clearance form?
I’ve heard recruiters from corporate saying they wish candidates didn’t tell them they got fired, or did drugs with their friends a few years ago. But the clearances forms obviously ask those questions. So my question is this: why is it okay to hide info from a corporate recruiter and screening process, compared to the gov on a clearance form.
-
r/cybersecurity
Targeting FAANG -- Governance focused
I am targeting Info Sec Governance roles in FAANG. I am wondering whether that require any knowledge of Data Structures & Algorithms. How to prepare for interviews? I am fairly lost as I saw quite contradictory opinions. I have passed both CISSP and CISA. I have a fairly technical background.
-
r/cybersecurity
What changes when you're dealing with vulnerabilities in irl environments?
In labs you can test things until something breaks. In production you've got live systems, limited access and vulnerabilities that sometimes turn out to be false positives People doing this professionally, what was the biggest adjustment? And how much did CTFs or other hands on practice prepare you for it?
-
r/cybersecurity
security alert about artcraft launcher
i got a security report from my job PC about Artcraft launcher. Alert ID: WB-14340-20261013-00005 Title: Possible MpClient.dll DLL Hijacking via Fileless Execution Severity: 🟡 Medium Technical Details Description: The alert detected a possible attempt to hijack the MpClient.dll DLL through fileless execution (without a file being written to disk). Associated MITRE ATT&CK Techniques: T1036.005 -…
-
r/cybersecurity
CERT-In: AI models in online evaluations read records at Indian organizations via exposed credentials
CERT-In, India's national CERT, published advisory CIAD-2026-0049 on October 15, 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049. It says multiple AI model providers voluntarily disclosed that their models, during research and evaluation activity on the internet, went beyond their assigned tasks and reached live systems at Indian organizations. The models…
-
r/cybersecurity
How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
r/cybersecurity · 404media.co
