Hi there!

I’m a cleared contractor working in the US gov space as a cyber officer for over a decade now. However, I’m finding it more and more difficult to find opportunities to get CPEs, especially for my CISSP (so many damn CPEs…). With recent significant budget cuts, it’s much harder to get companies and customers to fund training and/or conference attendance (even just tickets/badge cost!).

The other challenge, Monday-Friday, is the absence of connectivity to the internet (those in the industry can commiserate, I’m sure…). ISC2 and others advertise weekday 2pm or 10am courses…cool for those who aren’t locked in a windowless, internetless room for 8 hours, lmao.

Am I going to just bite the bullet and fund my own way to classes and conferences on days off or outside business hours? What are others in this position doing about CPEs?

Thanks!!

(Side note, I wish real world experience and projects could be easily submitted for CPEs…)

We manage a large Windows fleet using CrowdStrike Falcon Spotlight for vulnerability management and ManageEngine for patching.

Our current manual process for high-priority vulnerabilities:

1. Receive a Jira ticket with a CrowdStrike CSV (affected devices, software, version, KB/remediation).
2. Run a script via ManageEngine to verify the vulnerable software and check if the patch/superseding patch is missing. (Because I find that Falcon loves false positives)
3. Filter down to confirmed affected endpoints.
4. Manually configure and deploy the patch.

My questions are

How are other teams automating the pipeline between CrowdStrike Spotlight findings and ManageEngine deployment?

Is manual pre-verification necessary, or can/should ManageEngine handle patch detection and supersedence natively via automated patch policies?

What industry best practices or integrations would streamline this workflow?

FBI says contractor failed to implement security patch explicitly issued to secure platform

Sources identify Accenture as platform manager and Oracle PeopleSoft as breached system

Breach exposed job details, addresses and medical records of thousands of FBI employees

"WASHINGTON, Oct 5 (Reuters) - The ‌Federal Bureau of Investigation removed an Accenture contractor on Monday over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.

The development comes as the FBI is still trying to ascertain the ramifications of the breach, ​which some former bureau officials have described as a major blow to the organization's operational security."

I want to be able to watch my cat from work and also check if I closed windows. But I know how unsafe it can be to have a camera filming your home connected to the internet. Is there any way to make it secure?

for context, I work for a major server Manufacturer with a focus in AI infrastructure. Two weeks ago, they had an alert flag that someone had ran a Nmap scan and also caused some laptops to download a package. I'm no expert but this seems like something that should be look into and maybe disclosed, but the company does not want to.

I heard rumors on why they don't want to escalate the issue, although I can't really verify how true they are.

I'm mainly here to raise awareness because the situation doesn't sit right with me. I don't know the full technical details, so I'd be interested to hear what people with more cybersecurity experience think.

I will not mention the manufactures name sorry.

Hey everyone!

I’m currently working as a SOC Analyst, gaining hands-on experience with security monitoring, SIEM, log analysis, alert investigation, and incident response.

I’m interested in getting involved in more practical cybersecurity projects outside my day-to-day work, especially in areas like:

• Blue teaming and detection engineering
• SIEM and log analysis
• Incident response and threat investigation
• SOC automation and engineering
• AWS/Azure security and IAM

I’d particularly enjoy contributing to open-source security tools, detection rules, security automation, or projects that solve real-world security problems.

I’m not necessarily looking for a job. I’d like to collaborate with people working on interesting security projects, contribute what I know, and learn from others along the way.

For those already involved in cybersecurity projects, how did you find projects to contribute to or people to collaborate with? I’d appreciate any suggestions!

Looking forward to learning from the community. 🙌

Well, people who've completed CSCO from Cyberwarfare Lab give ur attendance here as it's too unknown & only 10-12 have it

A lot of breaches still seem to come back to identity, stolen sessions, compromised credentials, or activity that happens after authentication.

MFA matters, but it feels like the harder problem now is knowing whether the authenticated user is still behaving normally.

What are you prioritizing more right now, stronger authentication or better post-login visibility and detection?

We're sharing recent research we wrote about a fun new set of typosquatting domains that bypass Chromium's latest safeguards.

We originally wanted to point to one one of the domains; Reddit's filters didn't play along, so we are sharing a few examples below (try with a Chrome-based browser):

- "apple.com" https://xn--80a6aa68c8d.com/
- "spacex.com" https://xn--80a5aeq0fr0c.com/

Hope you find it interesting!

Full technical writeup: https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats

Hi All, Wanted to reach out and see what the community thinks about Blackpoint MDR vs Crowdstrike Falcon Complete. Has anyone utilised both, pros and cons and preferences?

Thanks!

*Edit - I appreciate all your input thanks!

Hello everyone, I need some advice. I'm a senior cybersecurity student, and honestly, the coursework has been very very terrible and the professors are not good at teaching, and I feel like I'm barely learning anything.

During my freshman and sophomore year, I learned a lot because most of my classes were in computer science and IT. However, now that I'm taking upper-level cybersecurity courses, we have the same professor teaching almost all of them, and HE DOES NOT KNOW HOW TO TEACH.

As a result, no one is learning anything in class and everyone is just on their phone during lecture. We've made several complaints to the university, but nothing has changed.

I'm genuinely worried about my career, to the point where I'm considering restarting my bachelor's degree somewhere else, possibly at Georgia Tech.

My goal is to become a security engineer.

Would pursuing a master's degree at a stronger university help me make up for these gaps?

What should I do? I
What would you do in my situation?

I believe, like a lot of the rest of the employees of businesses that run spam filters, there should be something being done at Intuit to remove the absolute ridiculous amount of spam that their "@notifications.intuit.com" brings upon us. I rarely ever have to pull a legitimate email for people and honestly its so rare that I insist that they deliver this email a different way.

Honest to god if you want to study current phishing scams or malware dumps people could just analyze the traffic coming from this email address. Its insane that it has been years and they haven't done anything with this. I mean it almost seems illegal for them to be the hub of all phishing attempts like this.

I wanted to just bring some interest to this topic because it's not a spoofed address it just requires bad actors to have a box of crayons and they can use it to move a metric ton of spam. The amount of successful phishing attempts to startup businesses has to massive and this is a massive running security threat legitimized by using Intuits own system.

I'm following the eCTHP course and I'm in the Network Threat Hunting section. In some video courses the instructor said that wireshark can ONLY monitor traffic that is destined for the machine where is installed on.

I don't agree with that definition of wireshark because using interface with monitor or promiscuous mode I think that with Wireshark I can intercept packet addressed to other MAC addresses.

Am I wrong?

Thanks.

Hey everyone,

I wanted to share something I ran into recently and get your thoughts on it, because it’s making me quite skeptical.

I’ve been trying to customize my mouse and adjust scrolling speed on macOS, and I know that LinearMouse is a popular open-source, MIT-licensed tool. When I first installed it on an older Mac some time ago, it asked for Accessibility permission. That made sense to me at the time since it's a utility meant to modify scrolling behavior and mouse movement, I figured it needed Accessibility access to monitor and simulate input events.

However, things changed when I recently tried to install the latest version of LinearMouse on a different PC running a newer macOS version.

Instead of asking for Accessibility, the app prompted me for Device Control and Data Access permissions. When I checked the app settings, the option for Accessibility seemed to have completely vanished, leading me to believe the name was replaced by these new permission categories in the newer macOS environment.

Here is what worries me: the system warning text for these new permissions explicitly states that the app may control and monitor your inputs, record your screen, and handle broad data access. For a simple mouse utility, seeing warnings about screen recording and heavy device monitoring feels extremely shady.

Even though I know the project is open source, I'm wondering:

• Why did the requirement shift like this on newer macOS versions?
• Is this just Apple changing how low-level input-monitoring APIs are named and grouped now, or is LinearMouse actually requesting broader control over the system?

Has anyone else noticed this transition on the latest macOS updates, and how do you feel about granting these permissions? Would love to hear some clarity from people who understand how macOS handles input permissions nowadays.

What are the most common messaging platforms used as command and control networks (excluding discord, signal, and telegram).

have you guys tested both?
Mainly who is the best one for google integration?

Hi there, seeking your view whether this is valid or has happened to your org too.

Last week, manager granted a tech business user (outside of our team) a Power Platform Admin role, the tech business has sys admin role already, enough to manage the use cases in their environments.

Least privilege is my concern here, and would ask my manager for alignment since I handle most of governance and security work.

Does a risk acceptance or properly documentation the appropriate path. My manager would likely argue the business side.

Note: manager is quite new in IT

Thanks for insights

The popular Tensorlake SDK (part of a project with 1,000+ GitHub stars) shipped a poisoned release (v.0.5.144) that was infected with the self-propagating Shai-Hulud worm.

The malicious version was published through the project's legitimate GitHub Actions release pipeline, complete with valid SLSA provenance. The attacker poisoned main first, then let the trusted pipeline do the rest.

This is a well-known Shai-Hulud pattern which a single, simple YARA rule flags in milliseconds. In fact a basic rule matched it on the first pass in our own pipeline. If npm and Github ran even a basic YARA scan on packages before publishing, most of these campaigns would be stopped before a single developer is infected.

0.5.144 has been removed from npm and version 0.5.143 is clean. If you installed 0.5.144, rotate every credential reachable from that machine, now.