News · r/cybersecurity
-
r/cybersecurity
Looking for a UK recruiter who actually places GRC/compliance audit roles ,recommendations?
Targeting GRC / compliance auditor roles in the UK. Direct applications are going nowhere, so I'd rather speak to a recruiter who specialises in this space. If you've worked with one who genuinely places GRC and audit candidates (not a generalist spraying CVs), drop the name or agency below. Thanks.
-
r/cybersecurity
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
r/cybersecurity · wiz.io
-
r/cybersecurity
Check if you're vulnerable to PHP2Shell
r/cybersecurity · php2shell.sh
CVE-2026-109618, CVE-2026-109619 -
r/cybersecurity
Agentic AI in CS
Hey, so I’m kind of new in crowdstrike and my manager is just kind of throwing me in it and learn on my own and wants me to come up agentic ai I’m crowdstrike to help out environment. What do you guys implement and deploy to help automate security issues. And what would you tell charlotte ai to make for you? Anything helps! Thanks!
-
r/cybersecurity
I vibe-coded a checker for the eMudhra CA compromise — tells you if your CLI tools still trust the bad roots
r/cybersecurity · github.com
-
r/cybersecurity
What is next in cybersecurity?
All I ever see is how AI is ruining everything and "I'm glad I get to retire soon." Honestly - does anybody know where this industry is heading? Edit: I'm younger and just curious if I should be optimistic at all
-
r/cybersecurity
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise on ConnectWise
r/cybersecurity · microsoft.com
-
r/cybersecurity
Meta pauses MUSE share links after flaw exposes 6,800 user conversations
r/cybersecurity · vectorwire.ai
-
r/cybersecurity
Cybersecurity statistics of the week (October 12th - October 18th)
Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here. All the reports and research below were published between October 12th - October 18th. You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ Ransomware 2026 Ransomware Risk Report…
-
r/cybersecurity
For teams doing SOC 2, how do you evaluate pentest vendors beyond just pricing?
We're looking into pentest vendors for SOC 2 compliance, and the pricing differences are pretty significant. Beyond the obvious stuff like scope and methodology, what do you guys actually look for? Does the quality of the report make a big difference? What about retesting, turnaround time, or how much manual validation goes into the findings? Also curious if anyone's tried the newer AI-powered pe…
-
r/cybersecurity
Website subdomains creation
Hi, I would apreciate any advice on the following: I have two domains, name.com and nickname.com and I want to create some subsomains for vaultwarden and nexcloud. (1) Which domain from the above you will use? (2) One of the domains has dns management by Cloudflare and the other uses another service that doesn't have the "proxied" options. In this second case where would you create the subdomains…
-
r/cybersecurity
Why does UnixGuy’s definition of cybersecurity engineer differ from that if the HTB Discord?
Hi why is this guy saying cyber security engineer is not one job but a category with several subspecialties? He says detection engineer is a type of cyber security engineer: https://youtu.be/shgKU-zjOmw?is=t\_ZXjPsYWRMiZPv0 he also lists appsec engineers, cloudsec engineers, automation engineers, etc in there. The reason I ask is people in the HTB Discord say detection engineer does not equal cyb…
-
r/cybersecurity
Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation
r/cybersecurity · thephp.foundation
-
r/cybersecurity
OWASP: Global Collaborative Org or Political Theater?
Joined in 2024. I’ve attended numerous chapter meet-ups at my local chapter, attended Global Appsec conferences, and even volunteered as a co-lead in my city’s chapter. I can say that I’ve learned invaluable things and connected with amazing people, however there is a common theme I’m starting to notice: Politics. It seems as if people who are more involved (though not exclusively) carry this eli…
-
r/cybersecurity
AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web
r/cybersecurity · vectorwire.ai
-
r/cybersecurity
Critical PHP2Shell Vulnerabilities (CVSS 9.2): CVE-2026-109618 & CVE-2026-109619 — Patch & Hunt Immediately
r/cybersecurity · x.com
CVE-2026-109618, CVE-2026-109619 -
r/cybersecurity
What are you guys doing for IR team training?
I'm curious to see what other orgs are doing for team incident response training? Do you stick with traditional Tabletop scenario walkthroughs? Is anyone doing simulated incidents in a VM environment? Or simulated exercises through a vendor? Or something else entirely? We've tried a handful of different types of training exercises, and none of them seem to work great, nor are they very realistic…
-
r/cybersecurity
PHP warns admins of two critical flaws, emergency patches coming tomorrow
r/cybersecurity · bleepingcomputer.com
-
r/cybersecurity
PHP: Critical remote code execution vulnerabilities, update now
r/cybersecurity · php.net
-
r/cybersecurity
Two critical RCEs in PHP core 👀 !!!
PHP itself just got hit with two critical Remote Code Execution vulnerabilities. what makes this interesting is that we're talking about runtime-level bugs, not the usual web app vulnerabilities. damn !! Memory management, use-after-free, and the kind of subtle internal state issues that can turn into serious security problems. It’s a good reminder that even mature, widely used projects can hide…
-
r/cybersecurity
PHP - As an IT person, what should I be doing?
Our sec guy is out and I'm dealing with this. What should I be doing? People are saying just patch your shit, but patch what exactly? Where is the impact likely to be strongest here? Am I throwing patch updates on OS's? Software? Literally everything?
-
r/cybersecurity
I built a full-chain Chrome exploit in 6 days using only gpt-5.6-sol…Ask Me Anything!
Hi Reddit! I’m Brendan Dolan-Gavitt, XBOW’s native team lead. In August, I used gpt-5.6-sol to see if I could build a full-chain exploit against Google Chrome. Six days later, we had a working chain. The exploit chained three vulnerabilities to achieve remote code execution and escape the Chrome sandbox, ultimately earning a $250,000 reward from Google’s Chrome Vulnerability Reward Program (the f…
-
r/cybersecurity
HTB OR THM2
I finished soc path 1 on thm and I was confused about continuing on thm path 2 or go for Soc path on htb Which one is the best ? Note: I have the materials of htb only not labs
-
r/cybersecurity
LiteLLM 1.107.0 compromised on PyPI and installs a credential stealer and backdoor
r/cybersecurity · safedep.io
-
r/cybersecurity
PHP2Shell - AI uncovers critical vulnerabilities in the backbone of the web
r/cybersecurity · php2shell.com
-
r/cybersecurity
PHP stuff — what's a regular guy to do?
Title says it all. I'm not a web developer, I've never coded anything in my life, yadda yadda. I use the internet for personal (including entertainment) and academic stuff. Aside from the obvious (not clicking on weird links and keeping stuff updated), is there anything I can do? Or rather, how does this all affect me, if at all? I'm seeing a lot of people panicking on social media saying we shou…
-
r/cybersecurity
GRC and Security Assurance Professionals - What are your biggest day to day challenges
Hi Everyone I am currently pursuing a PhD focused on developing an Agentic AI Framework for Cybersecurity GRC and Security Assurance. Before designing the framework, I want to understand the real challenges professionals face rather than making assumptions about what the industry needs. I am hoping to speak with people working in GRC, Cybersecurity compliance, IT auditing, risk management and sec…
-
r/cybersecurity
Everybody got 100/100 with some magic TOOL - does it means that online certs become meaningless?
Hi Guys, I was thinking lately and with this wave of 100/100 certs first try. And it is not about HTB or cybersec - it is everywhere. I think that usual digital cyber cert is dead - at least I will not look at it by any means when I will interview new guys (or check their CVs). There will be some notorious certificates in big universities that you can pass only face to face - and it is the only w…
-
r/cybersecurity
What's the job market like for Cybersecurity in Mexico and Central America?
I am just curious how it is there. I spoke to a woman in Mexico whom is a Cyber Threat Hunter. She said the pay is much less than USD. However, she says it is not that difficult to find work there than in the United States. Is that true? Is the hiring problem and layoffs only limited to the USA market and Europe because companies and govt are bringing in cheap labor?
-
r/cybersecurity
Data Center Cyber Security.
Latest verified developments Siemens — Active exploitation confirmed On October 19, Siemens confirmed attackers were exploiting vulnerability CVE-2026-110936 in Siemens Software Center. The company says it has patched the vulnerability and has no evidence its own update infrastructure was breached. Ransomware — New federal advisory CISA and the FBI issued an advisory October 20 about SafePay rans…
CVE-2026-110936 -
r/cybersecurity
Linux Execless Enum
Execless* Linux Enumeration Script: https://github.com/unicornofhunt/ShellBeak I have been doing some research into the idea of execless offensive operation. Treat the script as just an idea, this secret hunting is going to take a while ;)
-
r/cybersecurity
Emudhra still connecting on IOS27.0.1 (updated browsers)
iPhone 17 Fails all 12 tests on emudhra.we-have-a-problem.com Steps taken: Background security improvements enabled Network reset done Restart done twice I believe this is completely unreasonable that latest iPhone is still vulnerable when the fix has been deployed since yesterday. Update: The status has changed for my phone and it shows pass for all 12 tests. Looks like a rolling update or patch…
-
r/cybersecurity
How do you actually verify a finding before it goes in the report?
I've been running automated scanners (nmap, nuclei, sqlmap) against lab targets, and the noise level is brutal. A scanner flags an SQL injection, and I have to manually go back and replay the payload just to prove it's not a false positive. For those of you running real client engagements: Do you have a deterministic validation gate before a finding goes into the report? Or is it still a manual "…
-
r/cybersecurity
Kaspersky identifies new Lazarus APT campaign utilizing AI and post-quantum encryption
r/cybersecurity · kaspersky.com
-
r/cybersecurity
Two critical vulnerabilities in php (presumably since php 5) release today 14:00 UTC
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. https://x.com/thephpf/status/2112633155631108544?s=46&t=4wsX0gGbhwDPX0HdOz2f8Q
-
r/cybersecurity
Can threat intelligence unintentionally sustain the stolen-data market?
When security companies obtain stolen data to protect their customers, how do they ensure they aren’t financially supporting the ecosystem behind the theft? Publicly available leaks are one thing. Fresh datasets sold privately or through paid communities raise a different question. If providers purchase data directly, or through intermediaries, the defensive purpose doesn’t necessarily remove the…
-
r/cybersecurity
Can someone guide me on the limitations of OSINT and the tools?
Background/context: My real name is quite rare and unique. I have never met anyone with the same name as mine. Even my Email id is [First Name]@gmail.com (am not an OG user) Confusion: Recently tried out majority of the free tools which have been recommended on r/ osint and r / osinttools. The tech is amazing. I was able to find my social media account(s) on which my email is linked. So, how adva…
-
r/cybersecurity
Are Rat application so much dangerous ?
Which Rat from your point of view is the most dangerous ?
-
r/cybersecurity
Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug
r/cybersecurity · techspot.com
-
r/cybersecurity
I need to know if I am making a good decision.
Hey everyone, I'm a 23 cybersecurity guy from Mexico, and lately I've been struggling with a decision that could have a pretty significant impact on my career. I'd really appreciate hearing from people who have been in a similar situation, especially those working in cybersecurity who have had to make difficult decisions about their careers, moving abroad, or investing in themselves. I've been wo…
-
r/cybersecurity
Claude Building A Mac’s Monitoring Temperature App For A Vibecoder Uncovered A Cryptominer Using All 12 CPU Cores And Hitting 112°C
r/cybersecurity · wccftech.com
-
r/cybersecurity
Auto tech startup claims it traced hack attempt back to Comma.ai's IP address
r/cybersecurity · theregister.com
-
r/cybersecurity
Cybersecurity experts, what are your thoughts on the review given by METR on Anthropic’s Security Report?
r/cybersecurity · x.com
