News · r/cybersecurity
-
r/cybersecurity
Transferring existing certs and WGU degree
I've been in cybersecurity for about 20 years. Got my CISSP in 2014, CCSP just last month. Also recently have a couple of certs that my employer paid for within the last 5 years (AWS Cloud Practitioner, GWAPT). I have no college degree currently, but have a ton of experience. Is applying to WGU for a bachelor's in cybersecurity worthwhile? I also have a handful of credits from a liberal arts coll…
-
r/cybersecurity
Researchers uncover Volt Typhoon’s covert, ephemeral network
r/cybersecurity · cyberscoop.com
-
r/cybersecurity
Tailscale Releases Emergency Fix for “Tailworm” SSH Flaws
r/cybersecurity · tailscale.com
-
r/cybersecurity
Discord Is Making Public Messages Searchable on Google, and Your Old Posts Could Reach Strangers
r/cybersecurity · techtimes.co.uk
-
r/cybersecurity
AI Workshop Training Question
Hello, I’m sort of diving into the AI Cyber Security side of things and I’m a bit struggling and looking for some guidance. I’m very interested in the security side of this but I’m having a very hard time wrapping my head around agents / RAGs / LLM and prompts etc and how they all work together and so on. I’m an extreme hands on learner and I want to build my own from scratch just some simple “AI…
-
r/cybersecurity
Architecture Review: Full-System Design for a Hybrid ML/GNN Network Intrusion Detection System MVP
Context: I am developing a Python-based Network Intrusion Detection System (NIDS) designed to move beyond traditional signature-based constraints. The application is a hybrid system: it uses an ensemble layer (Random Forest + XGBoost) for fast statistical flow classification, paired with a Graph Neural Network layer (GraphSAGE) to analyze structural anomalies and lateral movement patterns. The pr…
-
r/cybersecurity
Global Vulnerability Scanning of Backport Fixes
Working in a large org, I am curious how other teams are validating backported patches when large security vendors are not able to successfully delineate the differences between patched and unpatched versions? (Specifically recent events) I say this as I have already verified that backport patches are in place on machines that are still showing as vulnerable in some vulnerability scanners. Does a…
-
r/cybersecurity
Question
Alright, question for other seasoned cyber professionals. I've been in offsec for about a decade, I currently have something like 12 certs and 2 masters. My question, my current job paid for all of those except i think 3 certs. I have zero desire to get another certification. my question, if work was paying, and you knew you could finish another degree from WGU in 6 months of less, and you're all…
-
r/cybersecurity
Interplains - zero breach
Has anyone seen this tool called zero breach by some people called interplains or something? Publicity seemed very suspicious, and their delivery seemed even more... Given my limited if even existing expertise in this matter, I wanted some opinions before trying it. They have a repository on github "interplains" "zero breach". Thank you
-
r/cybersecurity
Saw a 10+ year Big 4 IT Auditor say AI is automating core testing and shrinking contracts. How accurate is this from the Cyber/GRC side?
Saw a post over on r/ITAudit recently from a Big 4 vet with 10+ years in the field, and it raised some interesting points about where the domain is heading. His main argument wasn't just the usual complaint about burnout or long hours. He claimed IT Audit is going through a real structural shift because of AI and client budget cuts: Contract prices are getting squeezed: Clients are renegotiating…
-
r/cybersecurity
AMA: I spent eight months investigating the cybersecurity bootcamp IronCircle (formerly ThriveDX)
I'm an investigative reporter with The Hechinger Report, a national education news site. I've spent much of this year looking into the for-profit cybersecurity bootcamp IronCircle (formerly ThriveDX and HackerUSA.) You can read my story here: https://hechingerreport.org/a-university-branded-boot-camp-promised-tech-jobs-it-delivered-only-debt/ Over the course of my reporting, IronCircle was first…
-
r/cybersecurity
😲 An operator stole 68 GB from a Philippine government agency, then left the evidence open on the internet
r/cybersecurity · hunt.io
-
r/cybersecurity
The largest cyber attack on the Republic of Moldova: over 750,000 ID numbers compromised, public services paralyzed and major fraud risks
r/cybersecurity · rfi.fr
-
r/cybersecurity
Getting harder to distinguish bots. Are there useful application-side techniques?
Midsize company, we are struggling to block Muse and I assume it will only get harder from here. Trying to lean on CloudFlare tools but they don't seem to be effective. Wondering if it's worth trying hidden honeypot fields or similar techniques? Something like a reverse captcha that only AI could quickly solve, like obscure trivia or similar? What else can we do?
-
r/cybersecurity
CISA Confirms Active Exploitation of Node2Shell / HTTP2Shell
r/cybersecurity · bleepingcomputer.com
CVE-2026-111497 -
r/cybersecurity
"Hypothetical" issues with a government payment system
Hypothetically if I discovered that a government near mes large scale system that handles 1m+ card transactions per year. Terminals was built but putting a RPI NFC reader USB barcode scanner and a 4g modem in a box and shipping it with Ubuntu 16. This was installed in 2025 and the last build date of the os was 2023 And hypothetically it was setup with default pi username "pi" and unknown if any p…
-
r/cybersecurity
Why are Japanese companies getting hit by cyberattacks lately?
With incidents involving Japan’s hotel reservation systems and now JAL, I’m wondering whether there’s a broader pattern. I’ve noticed several reports of Japanese companies experiencing cyberattacks recently, and I’m curious whether there’s a broader pattern here. From an information security perspective, I’m wondering whether organizational and corporate culture could be contributing factors. For…
-
r/cybersecurity
Consultoria para vagas cyber
Galera do BRasil principalmente, vocês conhecem alguma consultoria que auxilie a conseguir emprego focado em cybersec? Infelizmente o Layoff me pegou e agora estou atrás de um novo emprego. Eu seguia um casal no LinkedIn era uma consultoria com a cor roxa eu acho, eles tavam na gringa e tal. Mas como faz tempo que vi não to achando. Conhecem alguma consultoria de confiança?
-
r/cybersecurity
BTL1 or CCDL1?
Hi! I'm a software engineering student, and i've been creating my roadmap to land my first cybersecurity role, i already passed CompTIA Security+, and ISO 27001 Foundations. Now, i cant decide between BTL1 and CCDL1. My plan after doing one of those is to do Microsoft SC-200/AWS. Looking for advice!.
-
r/cybersecurity
Japan's GMO Internet Group Faces Daily Leak Threats After Refusing Ransom, Purported Customer Data Appears Online
r/cybersecurity · ibtimes.co.uk
-
r/cybersecurity
Microservice for file scan
I'm buildin a open source microservice for the company i'm currently working, the idea is to use it to scan files for our applications that needs to manage files upload,what technologies should i use? my idea was to use: ClamAv for scanning, magica and/or libmagic for identification, and Yara/Yara-x for pattern maching. I've never developed a security microservice so i would like to know if i'm h…
-
r/cybersecurity
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
r/cybersecurity · thehackernews.com
-
r/cybersecurity
How to make viewbots
What’s the process of making a viewbot? I’m a cybersecurity student trying to understand this from a defensive perspective to learn how platforms detect and mitigate them.
-
r/cybersecurity
For small cybersecurity consultancy owners, what's been the hardest part of growing your business?
I'm currently learning about the business side of smaller cybersecurity consultancies and MSSPs as I prepare to build a consulting business focused on this sector. I'm curious to hear from people who've actually started or grown one. What was more difficult than you originally expected? Was it finding customers, pricing your services, standing out from competitors, hiring, or something completely…
-
r/cybersecurity
Recommendations for Quality US-Based Penetration Testing Firms
I’m putting together a shortlist of US-based pentest providers and would appreciate hearing about companies people have hired. The main focus is web apps and external infrastructure, though experience with internal network testing would be useful too. I’m interested in how the engagement went, whether the findings were clearly explained, and how responsive the testers were during remediation. Rec…
-
r/cybersecurity
Tailworm: Tailscale critical vulnerabilities and advisories
r/cybersecurity · tailworm.com
-
r/cybersecurity
My prompt-injection firewall showed a perfect 9/9 score. It was fake.
Built a 3-layer firewall for an LLM bot (regex -> Gemini classifier -> output check). Wrong model name -> every API call failed -> my fail-closed code blocked everything -> "9/9 attacks caught, 6/6 false positives". Looked like a bug, was actually my code lying to me. Real numbers after fixing it: - Regex only: 2/9 attacks - + Gemini: 8/9, 0 false positives (dev) - Hidden set: 3/3, 0/7 (only 3 at…
-
r/cybersecurity
Code-execution flaw in UEFI firmware affects most servers on planet Earth
r/cybersecurity · arstechnica.com
-
r/cybersecurity
Adviced Needed
I graduated in June 2026 ,then I joined infosys as a system engineer in july 2026 , right now I am having my stream training in cyber security, but before joining I was doing java backend , I want to know about how is the career progression or jobs in cyber security (Appsec or devsecops). Right now I am confused, whether i should go with cyber security or go back to the java backend after my trai…
-
r/cybersecurity
Hacking Attempt Disrupts FEC Campaign Finance Filings Ahead of Midterms
r/cybersecurity · securityboulevard.com
-
r/cybersecurity
What has your career progression been like?
Just curious as to how everyone began. What was your path to the position you’re at now. I’m currently working in Tier 1 help desk support whilst in working towards a computer information systems deg with a specialization in cybersecurity. Hope to finish that and then break into the cyber side after a couple more years of experience.
-
r/cybersecurity
Is anyone else feeling major imposter syndrome from AI.
I work in CS as an SE and every day I get AI generated questions from customer I have to use AI to answer and each time I do it I get praised from management because I’m doing my job. I just feel like my role isn’t needed anymore. Is this feeling normal or should I start to pack it up and try something else.
-
r/cybersecurity
Athena OS - Nix-based distribution intended to build a new concept of pentesting operating system
r/cybersecurity · athenaos.org
-
r/cybersecurity
New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts
r/cybersecurity · hunio.org
-
r/cybersecurity
PHP2Shell can own the process. Does that mean it gets the network too? Where microVM containment helps, and why patching still matters.
r/cybersecurity · runmvm.com
-
r/cybersecurity
Installing random apps on Android and the inherent threats: monitoring and mitigation
Hello, as I try and evaluate a few apps on my Android device every now and then (mostly from the Play Store but also the odd GitHub/apk ones), I realised I am pretty much doing so freely and without worrying about potential threats. How could I know if an app does something untoward, phones home to dodgy actors, collecta data or does anything that is plausible a malicious app could and would do?…
-
r/cybersecurity
CyberStrikeAI and 44 Agents: What TrendAI Found in Japan
r/cybersecurity · kylesinvestigation.com
-
r/cybersecurity
Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
r/cybersecurity · projectzero.google
-
r/cybersecurity
GhostAction Crosses Paths With PolinRider: Inside the October Escalation
r/cybersecurity · blog.gitguardian.com
-
r/cybersecurity
Codex vs Claude Code vs GLM vs DeepSeek: which is actually the best for autonomous offensive security research?
Which AI coding agent is actually the strongest for autonomous vulnerability research? I heard different opinions so far, with deepseek (1017?) being the strongest..? I have pretty boring task and I am allowed to play a little with our code base in Go Therefore I am mainly interested in auditing Go applications with APIs, authentication, access controls and file handling Looking for an agent that…
-
r/cybersecurity
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
r/cybersecurity · bleepingcomputer.com
CVE-2026-109618, CVE-2026-109619 -
r/cybersecurity
NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards
r/cybersecurity · nist.gov
-
r/cybersecurity
Why are so many mid-level cyber jobs getting 100+ applicants?
I've been looking around at the job market again and this has been pretty discouraging. I've been working in a SOC for over 5 years and have moved up a few times since starting as an Analyst I, so I'm definitely not looking at entry-level roles. I'm looking at jobs asking for 3–5+ years of experience where I match most, if not all, of what they're looking for. Yet so many of them have 100+ applic…
-
r/cybersecurity
Curious about how analysts compare malware-analysis results
Hi everyone, I’m trying to learn more about how malware analysts work with results from different sandbox runs or analysis tools, and I’d appreciate hearing about your experiences. For those who regularly analyse samples, I was curious about a few things: How do you usually compare results when the same sample is analysed in different environments or tools? Are there any parts of the process that…
-
r/cybersecurity
FortiBleed 2.0: 975 New Domains & 40,573 Exposed Secrets
r/cybersecurity · infostealers.com
