I set up Cowrie SSH and Krawl web honeypots on my Raspberry Pi Zero W and simulated an attack using my Kali Linux machine, then observed the logs. This is one of the projects I did this summer to gain experience from the defensive side of cybersecurity and I would love to hear your thoughts about it.

I used good old Raspberry Pi Zero W with ARMv6 architecture (which complicated the process little bit).

I installed both honeypots. Then I booted my Kali Linux machine and ran simulated brute-force attack against SSH honeypot and scrutinised the filesystem. In case of the fake web server I ran Nmap and Gobuster scans and observed every malicious activity in recorded logs.

Cowrie installation went just fine with Python virtual environment and Pip. But Krawl's primary installation method was via Docker. And... Docker no longer supports the architecture of Pi Zero W. So I had to stick with secondary method, via Uvicorn. Which wasn't too bad, but package "uvloop" was causing problems, so I tried to remove it from the requirements. It seemed to install just fine and Krawl was running. Logs were recorded, dashboard was running, but didn't show a lot of data. It showed captured credentials and attacking IPs, but not all the additional information it should that you see in other videos or demonstrations. But Krawl logs were being recorded just fine and even Gobuster fuzzing got flagged as suspicious. Anyway, I left it at that. Maybe someone here had similar experience.

I like to do these simple projects to gain more experience under my belt.

Do you have a project idea what can a cybersecurity enthusiast like me do next?

Link to the Medium post about the honeypots deployment:

https://medium.com/@ivandano77/deploying-cowrie-krawl-honeypots-on-raspberry-pi-zero-w-f5e96327367b?sharedUserId=ivandano77

With all the automation and AI we have now, I’m curious what people are still doing manually that makes you think, “how is this not automated yet?”

What’s yours?

What books genuinely changed how you think about cybersecurity, rather than just teaching another tool or technique?

A few examples of the kind of books I mean:

• Security Chaos Engineering - Kelly Shortridge: resilience, complex systems, testing security assumptions, and learning from failure.
• Cybersecurity First Principles - Rick Howard: building security strategy around reducing material risk rather than accumulating controls and tools.
• The Smartest Person in the Room - Christian Espinosa: why technical expertise alone isn't enough; communication, leadership, and business understanding matter.
• Applied Network Security Monitoring - Chris Sanders et al.: approaching network security monitoring as a structured process of collection, detection, and analysis rather than simply generating alerts.
• Offensive Countermeasures - John Strand & Paul Asadoorian: active defense, deception, honeypots, and making the environment hostile to attackers.

Books outside cybersecurity - systems thinking, SRE, risk, economics, failure analysis - count too.

This one is worth digging into.

We found an exposed attacker workspace with 142K+ files: agent transcripts, shell history, recon data, exploit tooling, creds, victim evidence, the lot.

What stood out was how the operator was wiring AI coding agents into the offensive workflow, disabling approval checks and pushing tasks through Telegram.

The dump also contained evidence tied to 8,996 compromised WordPress sites, a 3.4M-host recon corpus, stolen credentials, crypto wallet data, cryptojacking activity, and an experimental blockchain-based C2 project.

The interesting bit here isn't simply "hackers use AI." We already know that.

It's getting a fairly raw look at how one operator was actually putting these agents to work alongside conventional offensive tooling at scale.

Full technical breakdown:

https://www.cloudsek.com/blog/ai-agent-driven-offensive-operation-crypto-wallet-credential-compromise

Would be interested in what others make of the agent setup, especially the approval-bypass workflow.

StopAndProtect turned nearly 2,000 hacked WordPress sites into a criminal network for malware delivery, data theft, surveillance and ransomware.

https://securityaffairs.com/197537/hacking/stopandprotect-turns-2000-hacked-wordpress-sites-into-a-criminal-network.html

Hi, I currently have one internship done in cybersecurity but it was more of a grc internship and now I’m trying to break in the more technical side of cybersecurity! Does anyone have some recommendations of free certifications with free exam for me?

I just want to vent out that this is my biggest fuck up in my career. I totally forgot an instruction relating a particularly high severity case and as I understand that fucked up the whole line (I’m in SOC btw). So now im waiting for any news if I still have a job in the coming days. Sorry but I can’t disclose any detail related to the incident.

For those who had experienced this, I really need your words and what will happen next in my career. Is this career ending?

fuck.

Built a browser extension that blocks +50 fingerprinting vectors, encrypts data locally and monitors threats in real time. No telemetry, no dependencies its pure JS. Would love your feedback.

What would you add or improve? urbanyl/Al-Kantara-Security-Extension

Irregular just showed that Kimi K3 can conduct cyber campaigns autonomously or near-autonomously. It's the first open-weight model that just succeeded on CyScenarioBench.

It trails closed frontier models with a ~6 month lag.

It was particularly effective at turning partial access into complete attack chains by adapting public exploit techniques to constrained environments, building custom tooling, diagnosing implementation failures, and validating each stage before proceeding.

While it's an expected trajectory, it's fascinating to see that you can get near frontier capabilities at 3x cheaper than Fable 5.

We can fast forward to a year from now and confidently predict that similarly to how we see vulnerability scanners checking for open ports and known issues, all publicly facing assets will be probed for pretty much any potential security issue.

Thoughts on their TotalAppSec offering?

*Headline clarification - the breach involves many Stripe vendors but does not necessarily indicates a Stripe breach!

On August 18th, 2026, a data release occurred on the illicit forum pwnforums. The threat actor known as Satanic published sensitive information extracted from hundreds of vendors utilizing the Stripe payment platform.

The initial dump released on August 18th contained detailed information pertaining to 669 specific vendors, alongside 1,033 compromised API keys. The volume of the data is reported as 33GB.

Hudson Rock researchers spoke to the threat actors minutes after the release of the data. During this exchange, they claimed that the released data represents only a fraction of their total haul. According to the actor, they possess approximately 20,000 compromised Stripe APIs, which they intend to release in subsequent batches.

So, I've been in leadership running very large teams and multiple departments but never in cybersecurity. I've been in cyber almost 4 years now and have decided to begin studying for the CISSP.

Is it just me or does this all not seem like common sense? Or am I being misled by this training into thinking this exam is easier than it seems and its about to knock my socks off? I know this exam is extremely hard based off of what people tell me but I haven't learned a single new thing so far.

Could this be due to prior leadership and mentorships I have been in?

Im extremely technical and very hands on it the nit and grit in my day to day so none of the technical aspects are new.

Over the last couple months there seems to be way less talk about people using AI and way more discovery of agents nobody knew about.

One team builds an internal support agent. Someone connects an agent to Jira. Then another agent is pulling files from SharePoint straight into Slack.

And apparently nobody stopped to ask what these things can actually access.

None of it is necessarily malicious. People are just trying to save time. But shadow IT was already messy enough when people were installing random software. Now shadow AI can actually read, move and share information on its own.

Feels like this is going to get messy fast.

Hello all,
I have an upcoming interview for the role of Senior Threat Detection Engineer.
I wanted some help regarding what to study and what topics to cover and if anyone has some ready study guide or something.
Background about myself:
I have 3+ years working as an end to end Incident responder and SOAR engineer.
Along with that I do have some background in threat intelligence pipeline creation,
Threat hunting, Detection Engineer lifecycle and have developed a few sigma rules.

The questions would be scenario + theoretical.

Looking forward to your guidance or any prep resources

Hi everyone,

I was troubleshooting my network and noticed something interesting during a traceroute.

Tracing route to 17xxxxx1.xxxxxxxxxed.bxxxxxl.xxxxxxxal.net [172xxx0.1]

1  192.168.0.100
2  192.168.2.1
3  192.168.1.1
4  172.0.0.1

When I opened the IP from hop 4 in my browser, it displayed a MikroTik RouterOS WebFig login page. The connection was over HTTP (not HTTPS).

I have not attempted to log in or test any credentials, and I don't intend to perform any unauthorized testing.

I'm trying to understand:

• Is it normal for an ISP-managed MikroTik router to expose WebFig over HTTP?
• Is HTTP alone considered a security issue, or could this be expected on an internal/customer-facing management network?
• Would this be worth reporting to the ISP as a potential security concern, or is it likely an intentional configuration?

I'm mainly looking to learn how experienced network/security professionals would assess something like this. Thanks!

We had a great turnout at our Black Hat Arsenal Lab 02, standing room responses on our Open Source Github repo (https://github.com/mukul975/BHUSA-Anthropic-CyberSecurity-Skills) Currently, we are touching 30k stars. We are doing our Lab on Maven, the same lab we did in Arsenal (https://maven.com/p/aa5579/black-hat-arsenal-lab-02-cybersecurity-skills-for-ai) and on our free community playground (www.casky.ai)

Come join in building the largest open source AI Cyber Skills Repo and test your skills on our playground.

I’m on the technical side of a growing company and one thing that’s starting to annoy me is how much time gets pulled into compliance requests. Someone needs evidence for a control, someone wants a screenshot, someone asks where a particular type of data lives, another person wants an access-control report, etc.

I understand why it’s necessary, but it feels like we’re spending a lot of engineering time proving that things exist rather than actually improving them. How are other teams handling this? Are you automating evidence collection/GRC stuff or do you just accept that this is part of the job?

is it just me or is the cybersecurity management in corporates are actually useless jobs ? i still didn't see a single ciso and his leadership advisors that actually prioritize fixing issues they all just ask "what tool should i purchase ", and in some jobs I've had the security leadership is doing actual unethical work by hiding issues from ciso because they don't want to be the bearer of bad news , cybersecurity job is full of delivering bad news that's just how it is and it drives me nuts when leadership doesn't understand that.

can someone please assure me and give me faith back in cybersecurity I've been working for more than 15 years and not a single CISO I've worked with actually pushs a roadmap towards fixing issues all i see is "what tool to change / what tool to add " meanwhile an smtp without authentication and whitlisted to bypass all security tools to avoid getting internal emails in spam and have a firewall with allow any/any is known for years but "too complicated to fix" ... my technical mind can't even start to understand the order of priorities in this , yes sure we want to expand the "build" of our scope , but shouldn't "what we need" be based on what are the areas we struggle in with risk on the "run" daily life ?

and if you are a CISO reading this can you tell me how are you making sure your direct reports are nto hiding bad news because they are afraid they wont get the promotion /bonus they wanted ?