News
-
r/AskNetsec
Please I Need Help With a Malware Simulation Scenario for My Graduation Project
Hi everyone! I’m a university student working on my cybersecurity graduation project, and I’m looking for guidance on creating a controlled lab scenario involving a Windows VM. My project may include scenarios involving Trojan horses, keyloggers, ransomware simulations, and other malware-related attacks for educational purposes. If anyone has experience with these topics, I’d appreciate advice, u…
-
SecurityWeek
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek.
CVE-2026-41709 -
Dark Reading
Cyber Vulnerabilities Besiege Italy, Absent Clear Cause
Researchers can't quite explain why cyber threats look so different in Italy compared to everywhere else.
-
r/cybersecurity
hack the box vs try hack me
whats better if i have already been using linux for 1 year and i know some basics of cybersecurity not to deep but i don't want try hack me to be to easy so should i just hop into hack the box? and what subscription u recommended
-
r/ReverseEngineering
Reconstructing an MF904Q LK Unlock Path: Actual Gate Inputs, Corrected Return Instrumentation, and Persistence Under Factory LK
r/ReverseEngineering · github.com
-
r/ReverseEngineering
I am testing the power of this obfuscator is there anyone who can deofuscate this code because I am testing the power of this obfuscator
r/ReverseEngineering · gist.githubusercontent.com
-
r/ReverseEngineering
An Forgotten Mobile Masterpiece: Can AI or Reverse Engineering Rescue "Primal Legends" (Kobojo/Celsius)?
r/ReverseEngineering · youtu.be
-
r/blueteamsec
WhatPatchguardProtects: Reference of all kernel structures, routines, and MSRs monitored by PatchGuard (KPP) on Windows.
r/blueteamsec · github.com
-
The Hacker News
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector. The vulnerability in question is CVE-2026-41709 (CVSS score:
CVE-2026-41709 -
r/cybersecurity
BCIT CIT -> Digital Forensics & Cybersecurity degree or SFU CS for cyber?
I'm a high school senior in Vancouver trying to decide between: BCIT CIT diploma → Digital Forensics and Cybersecurity degree SFU Computing Science → possibly a cybersecurity master's later I'm interested in SOC, incident response and digital forensics. I like understanding how systems work and get attacked, but I don't really see myself as a software developer. I'm also interested in Engineering…
-
r/cybersecurity
100+ cloned GitHub repos pushing Remus Botnet via password-protected releases, and a registrar that wants a trademark before it will act
TL;DR: Someone is mass-producing fake repos on GitHub (game mods, Windows utils) that lead to a Remus Botnet payload. The archive is password-protected, so GitHub's scanners can't look inside. The gateway domain's registrar (Openprovider) said no to takedown without a trademark/power of attorney or a court order. I've reported it to ICANN, the .art registry, GitHub and Google. IOCs below. What I…
-
The Hacker News
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory. The vulnerabilities, tracked as
-
r/ReverseEngineering
This is my best project till now I didn't use rea for this though I learned and created , it is a bit unorganised and it doesn't have a frontend but it does work pretty well , it creates video with hooking topics and subtitles and musics and posts itself in YouTube and instagram, you just have to se
r/ReverseEngineering · github.com
-
r/cybersecurity
What would be the next step?
I know some coding (junior level), some Linux (junior level) and some networking (junior level like TCP/IP, subnetting... no wireshark). What is the next step I should do? I aim to get into offensive security. What resources to use? Can't really make a move into security direction at my current company, unfortunately
-
r/AskNetsec
Help 👏🏻
🚨 URGENT: LOOKING FOR AN ETHICAL HACKER OR CYBERSECURITY EXPERT Hello everyone, I’m from Bulgaria and I need advice regarding a serious online safety incident. The Instagram username connected to the situation is @leximalone2_. I have information about what happened and I’m looking for a trustworthy cybersecurity professional who can advise me on how to handle the situation safely and legally. I…
-
r/cybersecurity
Today I spotted, investigated, and remediated my first legitimate attack
I’m an engineer with about a YOE, this morning I was combing thru logs for something completely unrelated, and stumbled upon some logs that looked funny to me, and ended up going to the SIEM and finding the issue was much larger. It flew under all our alerting systems, bypassed multiple security controls, and was going on for many hours before I found what was going on. Our AI didn’t find it, our…
-
r/AskNetsec
Who's leading in AI agent identity management right now?
Our IAM team can't agree on how to model agents. Treating them as service accounts ignores that they act for users, treating them as users ignores that they run unattended, and meanwhile each agent reuses the credential it shipped with. I'm more interested in the modeling question than products, though examples of vendors handling it well would help the debate.
-
SANS Internet Storm Center
Yet Another ClickFix Campaign, (Wed, Oct 28th)
Introduction On Wednesday, 2026-10-28, I ran across a ClickFix campaign I haven't seen before. Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page. It targets both macOS and Windows. I don't yet have a name for this specific activity, but this diary shares some screenshots and indicators. Unfortunately, I was unable to get the macOS or Windows malware distributed through this particular ClickFix campaign. Screenshots of the Activity Shown above: Fake verification page with ClickFix instructions when viewed on a Windows host. When I ran the command on a Win…
-
Hacker News (security terms)
GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
CVE-2026-97229166 pts · 76 comments -
Hacker News (security terms)
Open U.S. Department of Homeland Security Directory
-
r/cybersecurity
What should you have under your belt as a university junior looking for an internship?
Hello all, title is self explanatory. Most of my peers have little more than the classes they've taken and some light experience gained from working with stuff like Snort during lab assignments. As of right now, neither I nor my peers have any certifications since that kind of money is getting funneled into tuition/housing plans as you can probably guess. Many internship opportunities near me are…
-
Cisco Talos blog
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos has identified UAT-11473, a highly sophisticated advanced persistent threat (APT) actor, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems. UAT-11473 then installed a custom malware framework we track as “KeyDrift” consisting of multiple components geared towards collecting sensitive keying information, acting as backdoors and intermediate command-and-control (C2) hosts. Observed targeting spans across space and satellite services, defense and…
CVE-2026-20127 -
Hacker News (security terms)
Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents
-
r/blueteamsec
Agentic artificialintelligence is accelerating cyber attacks
r/blueteamsec · cyber.gc.ca
-
The Record
Court strikes down West Virginia law barring disclosure of public officials’ personal data
A federal appellate court panel said West Virginia's version of Daniel's Law — meant to shield the personal data of police and other officials — is unconstitutional.
-
BleepingComputer
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]
-
The Record
Japan Airlines warns of data breach as country grapples with multiple cyber incidents
Hackers stole passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers.
-
r/cybersecurity
If-statement that caused HTTP2Shell was itself undisclosed patch of vulnerability
r/cybersecurity · bugsink.com
-
r/cybersecurity
My CTI lecturer says students who skip his lectures usually fail. What is he teaching that I can't learn through self-study/online?
My lecturer in cyber threat intelligence said something that got me very curiousss🤔 So he basically told us that students who attend the lectures usually have a good chance of getting an A/B, while students who rarely or never attend will most likely fail. The way he described it was almost like "top grade or fail" ripp hahah, and ofc obviouslyyy I understand that attending lectures matters BUUT…
-
r/cybersecurity
How push Defender indicator blocks to all clients
The MSSP SOC I work for currently only adds entities to the Defender indicator lists as a reactive action based on alerts. These indicators are only blocked for the client where the alert triggered. I'm wanting to change this, but I'm not sure how. The ideal work flow would be that all indicators added to any clients Defender would be automatically collected, validated, then have the ability push…
-
r/cybersecurity
Recherche stage pfe
Looking for a 6-Month Cybersecurity PFE Internship – France / Remote / International Opportunities Hi everyone! I’m currently looking for a 6-month end-of-studies internship (PFE) in Cybersecurity, ideally starting between January and April 2027. I’m currently pursuing an Engineering degree in Computer Science, specializing in Cybersecurity, at the Faculté Polytechnique de Sousse, Tunisia. My aca…
-
r/cybersecurity
we found two promot_attack policy incidents at work,here is what happened!!
I work for healthcare company, and for long time devs are using open source plugins like SuperPowers, BMAD for building features/products. Recently, few people blocked with the error message PROMPT_ATTACK which was enforced by my team recently third party platform called looplabs.run, initially we thought something wrong with the platform but later we noticed every prompt the developers/product m…
-
The Register · Security
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells. First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. “Our Oracle E-…
CVE-2026-101767 -
Dark Reading
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.
-
r/cybersecurity
‘Silent Train’: rotating relay chains used to exploit 4 zero-days in SD-WAN and IT-management platforms
r/cybersecurity · helix.ml
-
r/netsec
An attacker can crash a Godot game server using DTLS with an unauthenticated UDP datagram
r/netsec · axeghost.offprint.app
-
BleepingComputer
Discord to let search engines index public server messages
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]
-
r/AskNetsec
Huawei AR611W VRP V5.170 – Understanding $1a$ irreversible-cipher password format
Hi everyone, I'm working with a Huawei AR611W router running VRP V5.170 and trying to understand how local user passwords are stored. When I run: display current-configuration configuration aaa I get an entry similar to: aaa local-user root password irreversible-cipher $1a$[REDACTED] local-user root service-type ftp telnet ssh local-user root level 15 I would like to clarify a few things: What ha…
-
r/blueteamsec
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
Our Threat Research Unit published a breakdown of “The Gentlemen” - a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, reportedly after affiliates split off from established groups like LockBit and Qilin. A few things that stood out from the research: They’re offering affiliates up to 90% of ransom revenue - aggressive even by RaaS standards Claimed 800+ victims across the…
-
The Hacker News
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report shared
-
The Record
European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance
Noyb alleges the platform in some cases records freelancers’ mouse clicks and keystrokes every few seconds and claims the collected information can be used to generate video documenting freelancers’ entire workday.
-
The Record
US sanctions Russians, North Koreans for laundering IT worker earnings
The U.S. Treasury Department sanctioned Russian and North Korean nationals for allegedly laundering the earnings of illicit IT workers on behalf of Pyongyang.
-
r/cybersecurity
Web Exploitation 101: Using FFUF to find hidden endpoints on a website
r/cybersecurity · youtu.be
-
r/ReverseEngineering
I made a reverse engineered version of cursor that you can customize as you want
r/ReverseEngineering · github.com
-
r/AskNetsec
Pentesters: how do you handle retests after delivering the report?
Genuinely curious how other firms run this, because it's the part of the job I see go wrong most often. - Does the client tell you when something is fixed, or do you chase them? - Is one retest included in the price, billed hourly, or unlimited within a window? - Do you re-issue the report as v2 or send a separate retest letter? - How long do findings usually stay open in practice? For context, I…
-
r/cybersecurity
Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing
If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers. JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically. Attaching Frida immediately crashes the app due…
-
r/blueteamsec
Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access
r/blueteamsec · lumen.com
