News
-
r/AskNetsec
Pentesters: how do you handle retests after delivering the report?
Genuinely curious how other firms run this, because it's the part of the job I see go wrong most often. - Does the client tell you when something is fixed, or do you chase them? - Is one retest included in the price, billed hourly, or unlimited within a window? - Do you re-issue the report as v2 or send a separate retest letter? - How long do findings usually stay open in practice? For context, I…
-
r/blueteamsec
Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access
r/blueteamsec · lumen.com
-
r/Malware
Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing
If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers. JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically. Attaching Frida immediately crashes the app due…
-
BleepingComputer
Sony ISP subsidiary data breach exposes 2.5 million customer records
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. [...]
-
The Record
Moldova investigates possible foreign involvement in major government cyberattack
Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens' personal data and government digital infrastructure, according to local media reports.
-
r/AskNetsec
How are companies handling fake LinkedIn profiles impersonating their executives?
Most of the conversations I see about executive impersonation focus on phishing emails but what about everything happening outside the inbox? Fake LinkedIn profiles using a CEOs name and photo, accounts pretending to be recruiters or someone impersonating an executive to contact employees and customers directly. Email security doesn't really help with any of that and reporting these accounts indi…
-
r/cybersecurity
Transferring existing certs and WGU degree
I've been in cybersecurity for about 20 years. Got my CISSP in 2014, CCSP just last month. Also recently have a couple of certs that my employer paid for within the last 5 years (AWS Cloud Practitioner, GWAPT). I have no college degree currently, but have a ton of experience. Is applying to WGU for a bachelor's in cybersecurity worthwhile? I also have a handful of credits from a liberal arts coll…
-
r/cybersecurity
Researchers uncover Volt Typhoon’s covert, ephemeral network
r/cybersecurity · cyberscoop.com
-
The Hacker News
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root
-
r/cybersecurity
Tailscale Releases Emergency Fix for “Tailworm” SSH Flaws
r/cybersecurity · tailscale.com
-
BleepingComputer
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
-
Cisco Security Advisories
Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories. Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability infor…
-
The Register · Security
Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles
Ukrainian ransomware crook Artem Stryzhak has been sentenced to 70 months in the slammer by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain. The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands. One of Nefilim's most high-profile attacks was on Australian logistics giant Toll G…
-
r/cybersecurity
Discord Is Making Public Messages Searchable on Google, and Your Old Posts Could Reach Strangers
r/cybersecurity · techtimes.co.uk
-
r/cybersecurity
AI Workshop Training Question
Hello, I’m sort of diving into the AI Cyber Security side of things and I’m a bit struggling and looking for some guidance. I’m very interested in the security side of this but I’m having a very hard time wrapping my head around agents / RAGs / LLM and prompts etc and how they all work together and so on. I’m an extreme hands on learner and I want to build my own from scratch just some simple “AI…
-
r/cybersecurity
Architecture Review: Full-System Design for a Hybrid ML/GNN Network Intrusion Detection System MVP
Context: I am developing a Python-based Network Intrusion Detection System (NIDS) designed to move beyond traditional signature-based constraints. The application is a hybrid system: it uses an ensemble layer (Random Forest + XGBoost) for fast statistical flow classification, paired with a Graph Neural Network layer (GraphSAGE) to analyze structural anomalies and lateral movement patterns. The pr…
-
The Record
UK to look at making software companies liable for cyber breaches
The new U.K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has relied on voluntary codes to encourage software vendors to improve security.
-
r/netsec
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
r/netsec · mongodb.com
-
Graham Cluley
Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems
A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read more in my article on the Hot for Security blog.
-
The Record
Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine
Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, researchers said Wednesday.
-
r/blueteamsec
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
r/blueteamsec · hybrid-analysis.blogspot.com
-
SecurityWeek
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.
-
r/cybersecurity
Global Vulnerability Scanning of Backport Fixes
Working in a large org, I am curious how other teams are validating backported patches when large security vendors are not able to successfully delineate the differences between patched and unpatched versions? (Specifically recent events) I say this as I have already verified that backport patches are in place on machines that are still showing as vulnerable in some vulnerability scanners. Does a…
-
BleepingComputer
Microsoft urges Entra ID admins to migrate users to passkeys
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...]
-
r/ReverseEngineering
Inside our inline hooking engine: relocating prologues with iced-x86 (x86-64 + AArch64, deps closed to two crates)
r/ReverseEngineering · rutken.com
-
Dark Reading
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
-
Security Affairs
Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users
Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter, speaking to Reuters. Raphael Satter reported it on October 27 in a Reuters story, and the claims rest on sources, not on a published attribution. “Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded…
-
The Citizen Lab
Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk
Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. Following recent findings from the Citizen Lab, members of the European Parliament signed a letter urging the E.U. to investigate the potential exposure of its institutions to zero-click spyware through online targeted advertising. In the U.S., Democratic Sens. Booker and Wyden say that the findings underscore the need for better security practices in the industry. Read the article in CyberScoop The post Politicians in U.S. and E.U. Say Targeted Ads Are a Se…
-
r/cybersecurity
Question
Alright, question for other seasoned cyber professionals. I've been in offsec for about a decade, I currently have something like 12 certs and 2 masters. My question, my current job paid for all of those except i think 3 certs. I have zero desire to get another certification. my question, if work was paying, and you knew you could finish another degree from WGU in 6 months of less, and you're all…
-
r/cybersecurity
Interplains - zero breach
Has anyone seen this tool called zero breach by some people called interplains or something? Publicity seemed very suspicious, and their delivery seemed even more... Given my limited if even existing expertise in this matter, I wanted some opinions before trying it. They have a repository on github "interplains" "zero breach". Thank you
-
r/cybersecurity
Saw a 10+ year Big 4 IT Auditor say AI is automating core testing and shrinking contracts. How accurate is this from the Cyber/GRC side?
Saw a post over on r/ITAudit recently from a Big 4 vet with 10+ years in the field, and it raised some interesting points about where the domain is heading. His main argument wasn't just the usual complaint about burnout or long hours. He claimed IT Audit is going through a real structural shift because of AI and client budget cuts: Contract prices are getting squeezed: Clients are renegotiating…
-
NVD CVE API 2.0
CVE-2026-115968 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115968 -
NVD CVE API 2.0
CVE-2026-104286 · fortinet, fortimail · CVSS 9.8
CVSS 9.8 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) → 9.8 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Modified; +1 -35 CPE criteria (now 1); +1 references (now 2); added to CISA KEV, due 2026-10-04. An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests
Fix: 5 public exploits · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-10-04) · 1 patch or advisory reference on NVD Fix panel
-
r/ReverseEngineering
A new obliterated version of curser that works with your local models
r/ReverseEngineering · github.com
-
BleepingComputer
InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]
-
r/cybersecurity
AMA: I spent eight months investigating the cybersecurity bootcamp IronCircle (formerly ThriveDX)
I'm an investigative reporter with The Hechinger Report, a national education news site. I've spent much of this year looking into the for-profit cybersecurity bootcamp IronCircle (formerly ThriveDX and HackerUSA.) You can read my story here: https://hechingerreport.org/a-university-branded-boot-camp-promised-tech-jobs-it-delivered-only-debt/ Over the course of my reporting, IronCircle was first…
-
r/cybersecurity
😲 An operator stole 68 GB from a Philippine government agency, then left the evidence open on the internet
r/cybersecurity · hunt.io
-
SecurityWeek
Upwind Security Raises $400 Million at $3.8 Billion Valuation
The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog The post Upwind Security Raises $400 Million at $3.8 Billion Valuation appeared first on SecurityWeek.
-
BleepingComputer
Even after PHP2Shell, blast radius matters more than a CVSS score
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]
-
r/cybersecurity
The largest cyber attack on the Republic of Moldova: over 750,000 ID numbers compromised, public services paralyzed and major fraud risks
r/cybersecurity · rfi.fr
-
r/blueteamsec
I recreated a Node2Shell (CVE-2026-111497) RCE attack in the form of an interactive exercise
On 21 October 2026, Google released patched versions of its Brotli compression library for CVE-2026-111497, a vulnerability nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder (fixed builds 1.0.10, 1.1.1 and 1.2.1), reachable through Content-Encoding: br on both incoming requests and fetched responses. I made an interactive, hands-on lab exercise on this vulnerability. The go…
CVE-2026-111497
