News · r/cybersecurity
-
r/cybersecurity
A Company Trusted to Keep Websites Safe Used the Number 4 as a Secret Key
r/cybersecurity · aiar.news
-
r/cybersecurity
What do you recommend if you think you have a virus but aren't sure?
I used the Windows scanner but I'm not convinced, I've tried learning how to look for viruses but from what comes up it's better to format it, I want to avoid doing that since like I said I'm not sure if I have a virus or not and I want to learn at least a few things about this topic, whether it's tips on how to avoid installing things with viruses, how to scan my PC, if I want to transfer certai…
-
r/cybersecurity
Anthropic's Claude AI Bypassed Georgia Vote Data Paywall Without Human Authorisation Ahead of US Midterms
r/cybersecurity · ibtimes.co.uk
-
r/cybersecurity
Is it worth switching from Cloud Security and Automation to Product Security?
6 years in the industry. Started as a SOC analyst. I am currently a senior security solutions engineer. My tasks are aligned with security automation (python scripting), building and security CI/CD pipelines, doing security reviews. I have an opportunity on the horizon for Senior Engineer in product security. Is it worth a switch when there is on-call (no extra pay), but higher base overall? I am…
-
r/cybersecurity
ISO 42001
Hi, has anyone recommendations on a toolkit (documentation, templates etc.) for ISO42001? Open to spend some budget for a solid designed toolkit. If anyone has good experiences feel free to share!
-
r/cybersecurity
Mentorship Monday - Post All Career, Education and Job questions here!
This is the weekly thread for career and education questions and advice. There are no stupid questions; so, what do you want to know about certs/degrees, job requirements, and any other general cybersecurity career questions? Ask away! Interested in what other people are asking, or think your question has been asked before? Have a look through prior weeks of content - though we're working on maki…
-
r/cybersecurity
GCIH studying. Advice needed.
So far I’m just reading the books. Should I maybe just slow down and focus on the labs first? Index first?
-
r/cybersecurity
Pivoting away from working at an MSSP, advice?
Currently I serve as a lead security engineer for a smallish MSSP shop. We do everything from cloud audits, DFIR, vCISO services, etc. I have been quite burnt out after 4 years and ended up securing a new gig as a security engineer. It has been a while since ive been able to sit within a company and solely focus on THEIR security rather than a bunch of portcos at once. Looking for advice as I wil…
-
r/cybersecurity
Open alternative to Glass wire (for network monitoring)?
I'm looking for a free alternative to Glass wire, but I need it simply for data monitoring (seeing what apps/services use how much data) and don't need firewall. I heard of one called Portmaster here which I tried, but it's clearly more suited for pro's: I need a program that is easy to use and understand for a non-IT person, like Glasswire.
-
r/cybersecurity
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
r/cybersecurity · thehackernews.com
-
r/cybersecurity
Network guy with security background - I have a dumb question. Where can I learn about SASE/DMZ architecture?
Ive been in IT/Networking/Cybersecurity for about 7 years total now. The scope of my roles have been pretty narrow, and I want to understand more about large enterprise network architecture and DMZ engineering practices. Does anyone have any good resources for this specifically? In my network engineering roles - it was for an ISP and security was the customers choice how they wanted to implement…
-
r/cybersecurity
PQC Migration Planning - Inventory of Assets
Hi folks, Worldwide, governments and organizations are beginning to set timelines for the migration to PQC and a sensible first step in achieving that is actually inventorying all areas where cryptography is currently deployed and utilised. So my question for all the cyber pros, GRC consultants and sysadmins, how are you practically executing this inventory phase of the migration? Are there any t…
-
r/cybersecurity
2 years job search and nothing
I've been looking for a job for the past 24 months without luck. I've done everything imaginable, direct contact, answering ads, networking, you name it I've done it. I work with AI governance which for all intents and purposes is the hottest ticket out there. But I obviously don't do it right. Zurich based, B permit. Ideas? \#serious #help
-
r/cybersecurity
Is AI changing the security equation for legacy systems in banking and airlines?
Mainframe, COBOL, etc - Seeing what happened this week with much newer systems and languages - Then what about legacy systems connected to the internet? As an example, I'm just thinking about banking and aero industries... the people behind many of these systems are the gurus who have kept them running for decades, often close to retirement. In my experience, some are strongly against AI or seem…
-
r/cybersecurity
From a decoy log: one scanner posed as 25 different AI and search bots in 12 seconds while hunting for .env files
I run decoy files on a few small sites and log what touches them. On Oct 25 one Google Cloud address made 66 requests in 12 seconds. Almost every request used a different bot name: GPTBot, ClaudeBot, GrokBot, DeepSeekBot, PerplexityBot, OAI-SearchBot, Googlebot, bingbot, CCBot and 16 more. Each name asked for a different .env path (/ai/.env, /llm/.env, /agents/.env, /chatbot/.env and so on). My g…
-
r/cybersecurity
Kali Linux Cannot Find Target Linux VM's IP in VMware
Hi, I'm having trouble finding the IP address of my target Linux machine in VMware Workstation. The target was initially configured with Bridged networking, but I changed it to Host-only to try to find its IP address. Kali Linux still cannot discover the target using Nmap. On the target machine, the network interface ens33 is DOWN, and trying to bring it up returns Operation not permitted. How ca…
-
r/cybersecurity
PHP2Shell Explained: How One HTTP Request Can Take Over a PHP Server
r/cybersecurity · youtube.com
-
r/cybersecurity
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
r/cybersecurity · thehackernews.com
-
r/cybersecurity
Cookies - Could they be a way to hack someone?
This was my thought when I was showering so sorry if nothings connecting or it's a bit messy What if we could exploit cookies? they get saved by the browser, physically in the users device, and get loaded back whenever the user visits the site since that data gets saved physically, there's just gotta be a way idk if some people have already researched this to see if it's exploitable or not but so…
-
r/cybersecurity
Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
r/cybersecurity · reuters.com
-
r/cybersecurity
AI Agent Containment Fails at Every Stack Layer, From Hypervisor to IAM
r/cybersecurity · vectorwire.ai
-
r/cybersecurity
Velum-VMM - Hook syscall's on Mdern Windows using Intel-VT-x
I've published Velum-VMM, a Windows x64 research hypervisor written in C and assembly using Intel VT-x and EPT. Source: https://github.com/Dovughs/velum-vmm Technical write-up: https://github.com/Dovughs/velum-vmm/blob/main/readmes/technical-writeup/README.md Velum virtualizes an already-running Windows kernel and provides an interactive console for observing native calls and experimenting with s…
-
r/cybersecurity
Is everyone actually that miserable?
I'm about to enter my first cyber security role, moving from a career in network engineering, so I (probably mistakenly) joined this sub. Is everyone really that miserable doing this work ? I was working 2-3 nights a week in network eng. I am hoping taking this role will stop most of the night work. This will be for a small to medium sized business. Am I kidding myself ? Did I make a wrong choice…
-
r/cybersecurity
PHP2Shell: Google and Mandiant Warn That PHP Servers May Remain Vulnerable After Installing Patches
r/cybersecurity · cloud.google.com
CVE-2026-109618, CVE-2026-109619 -
r/cybersecurity
How do you guys manage users & phishing sim repeat clickers?
We're using Knowbe4 and tbf, most of our users are decent. But I haven't quite worked out what the process should be for repeat clickers?
-
r/cybersecurity
PICARD 0.3.x: encrypt, chunk, and scatter data across 264 protocol adapters -- including DRAM and CPU cache
PICARD (Protocol-Introspecting Chunk Adapter for Resilient Data) is a technical security experiment in creating storage and persistence where it is traditionally not allowed. PICARD encrypts your data, slices it into chunks, and scatters them across whatever protocol endpoints you configure: DNS TXT records, MQTT brokers, Reddit posts, S3 buckets, Bluetooth advertisements, or all of them at once.…
-
r/cybersecurity
I’m a cybersecurity leader who is neurodivergent or an advocate for those who are. Ask me anything about the successes, failures, and lessons along the way.
The editors at CISO Series present this AMA. This has been a long-term partnership between r/cybersecurity and CISO Series. This month, CISO Series has assembled a panel of security leaders who are neurodivergent or are advocates for neurodivergent people in our field. They're here to talk openly about how ADHD, autism, and other forms of neurodivergence have shaped their careers and leadership.…
-
r/cybersecurity
V-DAP: investigating cryptographic timing and latency diagnosis
V-DAP: investigating cryptographic timing and latency diagnosis I’ve been developing V-DAP, an experimental Rust engine focused on measuring cryptographic execution timing and investigating whether these measurements can provide useful information for diagnosing request latency. The project has reached a point where I want to move beyond testing in my own environment and invite independent techni…
-
r/cybersecurity
NetworkWalks Internship, is it a SCAM ?
Hello Everyone, So lately I noticed on LinkedIn, some companies offering free cybersecurity internships fully online and all of that, I signed up to one of them NetworkWalks, they even have a website, does anyone have any experience with them? Should I trust it ? 😬 How can I verify? Not sure if it is allowed to add any links here to show any proof, but if you looked networkwalks you will find it…
-
r/cybersecurity
Trend AI Vision one agent - network issue
Hello everyone! Hope anyone can advise me on what to do here. I am an end user and suddenly my laptop showed this error: Your device is isolated from the network. So far, I tried restarting multiple times, disabled windows security, firewall, changed browser. Still no avail. What can I possibly do in this scenario? I cannot connect to the internet; yet wifi logo shows connected. Other devices con…
-
r/cybersecurity
Bye Bye Brotli? Google's Compression Library Is a Security Mess
r/cybersecurity · bugsink.com
-
r/cybersecurity
Moonshot AI strips cyber-offense data from Kimi K3.1 Pro before open-weights release
r/cybersecurity · vectorwire.ai
-
r/cybersecurity
log4j on X: "i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing
r/cybersecurity · x.com
-
r/cybersecurity
TheHive + Cortex + n8n on a single on-prem server for internal incident management: experiences and alternatives?
Hi everyone, I’m setting up TheHive, Cortex, and n8n using Docker on a single on-prem Linux server to support incident management for a small internal security team. We’re currently in the deployment and testing phase, starting with TheHive Community. I want to assess its practical value before requesting additional infrastructure or paid licenses. We already have a SIEM, EDR, asset inventory, an…
-
r/cybersecurity
Google's AI opt-in becomes the legal key to its richest ad data
r/cybersecurity · vectorwire.ai
-
r/cybersecurity
Agent instruction files are effectively executable but skip code review. Anyone dealing with this?
r/cybersecurity · github.com
-
r/cybersecurity
AI, cybersecurity and growing graduated students entering the job market (France)
Hello all. I'm a cybersecurity consultant with ~8 years of experience. Working mostly on threat intelligence and cyber awareness. I am based in France and in 8 years I have seen some huge changes in the cyber job market here. I am also seeing a growing amount of young students who are struggling to find job within the industry, even when they're good because they're isn't enough job opening for t…
-
r/cybersecurity
Microsoft Senior Threat Researcher Interview Experience - Any Insights?
Hi everyone, Has anyone recently or previously interviewed for the Senior Threat Researcher role at Microsoft? I have an upcoming technical screening, and the focus areas mentioned are Threat Detection, Cloud Attacks, and Overall Profile. Would really appreciate it if anyone could share their interview experience, the types of technical questions asked, difficulty level, and any preparation tips.…
-
r/cybersecurity
LiteLLM Hack - Malware in the Official Release | Patch Notes
r/cybersecurity · youtube.com
-
r/cybersecurity
Anyone actually gotten a phishing site taken down on Vercel? What worked?
Title: Anyone actually gotten a phishing site taken down on Vercel? What worked? Body: We’re dealing with a phishing site hosted on *.vercel.app that clones a real brand and harvests credit card data (fake checkout + fake 3DS OTP). We already reported it about a week ago (abuse form / [[email protected]](mailto:[email protected])) and it’s still live. Looking at community threads, that seems pretty…
-
r/cybersecurity
Just a little fun pls. PHP2Shell & Node2Shell: The Week Everything Got Hacked (Security Rap)
r/cybersecurity · youtu.be
-
r/cybersecurity
php2shell Vulnerability PoC & Detection Rules CVE-2026-109618
r/cybersecurity · blog.offensive32.com
CVE-2026-109618 -
r/cybersecurity
How do I safely demo a Red Team attack on a deliberately weak website (fake data) for a class project?
For context: Team project recreating a real data breach on a small scale. We built two versions of a Flask app with 500 fake personnel records, one left with known flaws on purpose, and one hardened (encryption, access logging, alerts). For our presentation we want to show a Red Team attacking the weak version, then the hardened version blocking the same attack. So how can I show it ? This is my…
-
r/cybersecurity
How to report a security issue on a portfolio website?
I am a developer and never been to cybersecurity before. I inspect and analyse websites out of curiosity. I came across an influencer's profile and checked her website on the bio. The security was weak and the admin panel can be accessed without much works. I am not deep diving the technical side here. How do i report the case with the influencer? I am worried if I get into trouble if I let her k…
-
r/cybersecurity
How LLM-Based Penetration Testing Harnesses Work
r/cybersecurity · utkusen.substack.com
-
r/cybersecurity
Connecting personal apps with AI tools
The productivity gains are clear but granting read (sometimes write access too) comes with obvious risks like data exposure, AI training on your data and possible identity theft in case of data breaches. Curious how people here approach connecting everyday apps (Gmail, Drive, Notion etc) to AI apps like Muse Chatgpt Claude Do you actually audit permissions and enforce boundaries before connecting…
-
r/cybersecurity
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds
r/cybersecurity · theregister.com
-
r/cybersecurity
BlackX UEFI Bootkit Leverages “Baton Drop” Flaw to Bypass Secure Boot
r/cybersecurity · kylesinvestigation.com
