News · r/cybersecurity
-
r/cybersecurity
Does a Ukrainian university degree carry weight abroad in cybersecurity?
Hi everyone, I'm a first-year student at a Ukrainian university, studying on a paid contract. I'm interested in getting into cybersecurity, but I'm seriously considering leaving university. Honestly, I think the degree isn't worth the time and money: I feel I could learn the material faster and cheaper on my own, and put that money into courses instead. There's also no part-time/distance option,…
-
r/cybersecurity
How do you verify another company during an active security incident?
Something I don’t see discussed much is how organizations establish trust with each other after an incident has already started, imagine one of your critical vendors gets compromised. Someone claiming to be their security team contacts you and says credentials need to be rotated immediately, certain integrations should be disabled and all further communication needs to move to a new address becau…
-
r/cybersecurity
CVEs and AI
A lot of people attribute AI to the increase of CVEs, but how are we feeling about that? What do we believe is the actual source of the CVE increase? Is it that AI is helping identify existing vulnerabilities? Is it finding new undiscovered (true zero day) vulnerabilities? Is the rise of using AI for development creating a lot more vulnerabilities in code? A combination of all of the above? What…
-
r/cybersecurity
Cybersecurity
What are the scopes of Cybersecurity in Nepal? Please provide any institutioinstitutions or universituniversities that provide a specific Cybersecurity bachelor's course in Nepal. Additionally,if there are any scholarships or a chance to persuadpersuade cybersecurity in abroad as a middle class kid please let me know that too.
-
r/cybersecurity
eMudhra (a business run by 1 family), passed two audits by BDO after an integrity incident. Is the internet chain of trust broken?
The more I look into the eMudhra incident, the more concerned I am about the auditors and the governance behind this company. We’ve spent plenty of time talking about the fact that one of their intermediate CA private keys was literally the number 4, which is fucking dumb. But I think there’s a much bigger issue here. How did this survive two independent WebTrust audit cycles, including one where…
-
r/cybersecurity
What does AI mean for the future of CyberSecurity? (PHP vulnerability)
I was reading about the recent PHP vulnerability being exploited with AI, and it honestly got me thinking about where we’re heading.. If AI keeps advancing at this rate, will cybersecurity become automated by AI? - Both on the offensive and defensive sides. Its increased use of finding and exploiting vulnerabilities, as well as strengthening security makes me question the future of this industry.
-
r/cybersecurity
(Learning) Help reproducing Privilege Escalation
hey all, I am a software engineer and in general I am in favor of tackling security concerns, however sometimes I struggle to understand the severity of certain potentials. So I want to learn things but I have problems building knowledge because information is scarce. I want to understand how a privilege escalation in a docker container could work and how to reproduce? unfortunately I can not mak…
-
r/cybersecurity
securityheaders api is dead. this is the curl i use now
api.securityheaders.com does not take new keys. the website is still there if you only want to look at a grade. curl -fsS "https://httpsornot.com/api/v1/check?domain=example.com&headersMinGrade=B" no key. 120 requests an hour per IP. GitHub Actions runners share IPs, so that limit shows up fast. a free key goes in X-API-Key if you need more. 422 means the header grade missed B. 429 means the rate…
-
r/cybersecurity
PHP Vulnerability Exposes 100 Lithuanian Websites to Hackers
r/cybersecurity · vanguardeast.com
-
r/cybersecurity
Why people freak out with non verifiable vulnerabilities?
For most of vulnerabilities reported, including this recent php one, I couldn't find any real evidence that it can be used to "take total control of everything and steal everything" as people claim. Shouldn't be these vulnerabilities better classified and layered on level of truth and how can it really be exploited?
-
r/cybersecurity
M3rx Ransomware Attack
I’ve unfortunately become victim to a ransomware attack from these guys. Is there any way of retrieving my data? Unfortunately there’s elements I don’t have backups of that I need.
-
r/cybersecurity
Disgraced eMudhra drops out of TLS business after using cert private key of 4
r/cybersecurity · arstechnica.com
-
r/cybersecurity
Regarding PHP security exploits that were discovered 2 days ago
My question is about the PHP security exploits that were discovered yesterday. I heard the issue was fixed a day ago meaning yesterday. I am not very familiar with cybersecurity and things like that, but as a regular user right now browsing sites like SourceForge and regular websites, is it totally fine for me to use them, browse normally, and download things, or is there still any danger and the…
-
r/cybersecurity
Help about the recent Cybersecurity issue
Hello everyone. Im super new to this field. Im seeing many attacks for the past two days and hearing buzz words like PHP, AI agents going rogue and stuff like that. I honestly dont know any of this or their meanings. If can someone take their precious time of their day and be patient to explain whats going on and how it started, it'd be great. Thank you in advance
-
r/cybersecurity
Swipelab project
Currently working on a project swipelab, which is a technical research project focused on investigating Tinder’s mobile application, API architecture, security mechanisms, and profile visibility behavior. My main focus is currently to understand how the platform works, identify potential security or business-logic weaknesses, and scientifically investigate which factors may influence profile visi…
-
r/cybersecurity
Which government agencies have actually pulled the plug?
Plenty of sites are still running on WordPress and other PHP stacks, have we actually seen any of them go dark yet?
-
r/cybersecurity
Vulnerability Mgmt advice needed
I work in a fairly small cyber team and one of my duties is vuln management. There wasn't a traditional team up until a year and a half ago, and few systems were even fully documented by the IT Ops team. Recently we recieved a complaint that our vulnerability tickets we logged with IT Ops didn't contain enough information for them to efficiently remediate the vulnerability. This specific one was…
-
r/cybersecurity
Is it necessary to start out in help desk before going into cybersecurity?
I am a 19 year old community college student majoring in computer science. I have already started the CompTIA trifecta certifications because I eventually want to go into AI security as an engineer or architect but I heard that before going into security you have to have experience in help desk for 3-5 years. How true is this? If I get an internship in a security role while still in school, then…
-
r/cybersecurity
Cybersecurity news app for mobile
Can yall legends recommend me some decent news app for cybersecurity?
-
r/cybersecurity
What if this week was every week
Yes this week has been crazy, as evidenced by the million other threads. But what if this was the new norm? With models getting smarter and smarter, what if we continue to find highly-visible, high+ severity CVEs in majorly-used products every week, what would change? Would you leave the industry? At first I thought I might, but then again I figure our workloads will adapt to where we're respondi…
-
r/cybersecurity
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
r/cybersecurity · aikido.dev
CVE-2026-111497 -
r/cybersecurity
Here, the night is really quiet • may everyone enjoy it.
Last night was one of those crazy ones with the php2shell vulnerability. I think in every timezone, every sysadmin, devops, tech enthusiast and intern was wide awake - mid-afternoon in the US, morning coffee in Asia, middle of the night for us. Once again, you did the job. But honestly: When will the people in the high castle understand? Cybersecurity is not a cost, it's your and our lifeline. An…
-
r/cybersecurity
Is it possible to consolidate the whole security program
I’ve been going through this study by PaloAlto and IBM which coins an idea of “Platformization” which consolidates the whole Cybersecurity program under a same platform where dozens of security tools feeds, bridging the silos. https://www.ibm.com/thought-leadership/institute-business-value/en-us/report/unified-cybersecurity-platform is it really possible to build a true security platform? is ther…
-
r/cybersecurity
[Project] I translated the full PHP 8.4.26 HTTP-only RCE research repository into English, including technical documentation and code comments
I recently came across 9bie's php2shell research, which demonstrates an HTTP-only RCE exploit chain against PHP 8.4.26, including an ASLR bypass, under the official production configuration. While the original repository already provides an English README, much of the detailed research documentation and code commentary is written in Chinese. To make the research more accessible to the internation…
-
r/cybersecurity
How do you audit AI agent decisions in regulated workflows?
I'm researching how teams handle evidence and quality for AI agents that make or assist decisions. Three things I'm trying to understand: What record do you keep per decision (policy applied, data accessed, who was responsible), and who actually asks for it? How do you learn later that a decision was wrong, and how long does that feedback take? If you use LLM judges for evals, how do you check th…
-
r/cybersecurity
Any cases of php2shell actually being exploited in the wild?
Its good everyones taking precautionary measures but i would have expected something to go down by now. Makes it seem partially overblown.
-
r/cybersecurity
Vsee Messenger/App, Worst Security Features, Cant believe how its HIPAA compliant.
I was using this application with my Patients, with most sensitve discussions and treatements, my device got compromised so i changed all my passwords, fast forword two months later, i noticed some odd activity, Turns out the Claims of Safety and security was just stardust. - One account can login into unlimited phones despite the claim its end to end encrypted, without any warnings, any security…
-
r/cybersecurity
How severe were the Black October breaches?
Recently I got to read an Article about a large number of mass breaches and exploitations that has happened, how severe were they?
-
r/cybersecurity
Is there any app or AI model can make page cloning and fetch the username and password. NOTE: JUST FOR TESTING ONLY
Is there any app or AI model can make page cloning and fetch the username and password. NOTE: JUST FOR TESTING ONLY
-
r/cybersecurity
How do you guys "Craft" payloads
Hi! I’m relatively new to cybersecurity and bug bounty hunting, and I’m currently studying XSS. When I find a reflected input in the DOM and test it, I don’t really know how to proceed. For example, if the application encodes a <, how do I get past that? I’ve come across some crazy payloads in Medium articles and HackerOne write-ups, and I’m impressed by how people come up with them. I know about…
-
r/cybersecurity
Capcom's Notification of "CAPCOM ID Unauthorized Access" Received, but Isn't Their Security Configuration Way Too Lax?
I recently received a data breach notification email from Capcom titled "Apology and Notice Regarding Customer Information Affected by Unauthorized Access to CAPCOM ID." The email alias service I use, SimpleLogin, flagged this official notice with the following warning right at the top: "This email failed anti-phishing checks when it was received by SimpleLogin, be careful with its content." Upon…
-
r/cybersecurity
PHP2Shell: the leaked PHP RCE everyone is staging and no one has landed (yet)
r/cybersecurity · hunt.io
CVE-2026-109618 -
r/cybersecurity
Transition from software engineer to cybersecurity possibility?
I am currently a software engineer thinking about a career transition away from this role to something closer to security. Would it be a wise move? As all experience i currently have is purely on the development side. I was suggested that i could have a go at app/cloud security Any advice is appreciated.
-
r/cybersecurity
AI Agent Security Requires Hazmat Suits, Not Self-Defense
r/cybersecurity · infisical.com
-
r/cybersecurity
Tabletop exercises validate discussion, not detection. For AI incidents, that's a problem.
Most incident tabletops end the same way: the team talks through the scenario, agrees on the response, and leaves confident. Nothing that was agreed upon gets tested against the real environment. AI incidents make this gap worse. The full attack chain, prompt injection to tool abuse to exfiltration, fits inside a single agent task loop. By the time the conference room assembles, it's over. One ap…
-
r/cybersecurity
What’s the best plan from here?
I’ve worked in IT for around a decade and recently switched to incident response. I can’t stand it , it’s so busy everything is on fire and urgent. Reminds me of my MSP days. We are a consultant firm . Anyway, it pays well but I want to get out ASAP. My question is , where do I go from here? What is the best path to get something less stressful but still in cyber and pays well. Took me ages to ge…
-
r/cybersecurity
Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
r/cybersecurity · forever.security
-
r/cybersecurity
How worried should I be about the cybersecurity stuff from yesterday?
I actually do have a tech background but my expertise is mostly in data engineering. I took a single cyber security class in college so I have a very basic idea of how these things work. I have very little experience with any sort of web dev. The extent of my knowledge of PHP was basically that it existed and a lot of websites use it. That being said, my Twitter feed seems to be having completely…
-
r/cybersecurity
Node.js critical flaw: CVE-2026-111497
Any thoughts on the recently disclosed Node.js critical vulnerability, CVE-2026-111497? Should we consider this as impactful as the recent PHP vulnerabilities?
CVE-2026-111497 -
r/cybersecurity
The Ghost in the Group Chat: How We Unmasked an Anonymous Extortionist
r/cybersecurity · kylesinvestigation.com
-
r/cybersecurity
Someone Knew About PHP's Critical Flaws Four Days Before the Public Did and Amazon Can't Explain How
r/cybersecurity · techtimes.co.uk
-
r/cybersecurity
Newsletters / Exploit News
What would be a good way for me to receive information about new exploits and cyber incidents other than scrolling reddit? Even though it's for good intentions, I don' want to be seen scrolling reddit while at work.
-
r/cybersecurity
OverTheWire bandit1
I can't understand why I have to read the file - using the ''./-'' thing, someone can explain it to me pls?
