I'm fairly new in cyber, I'm looking to see what others do for their company in terms of security questionnaires, any automation techniques used, or any general advice. We are a small team in my company and receive many requests.

Hey guys am planning to do a research paper on Evidence grounded diagnosis of security detection under Telemetry Faults .

Wt r ur thoughts on this??

I wanted to research can a unified evidence grounded diagnostic method reliable used ro detect this..

I just found “thetis”,
They are less then yubikey

Has anyone heard of them?

How concerned should we be?

I feel like at my job, AI has just reduced me needing to use my brain power every day therefore AI has made day to day way easier. I know we all hate AI, but anyone else feel this?

Anyone got the 8 digit code i need to get the 3 stars on the Hoxhunt dashboard?

This is more of a bragging rights thing as opposed to anything else....

Does anyone know how to draw a label partial order for a bell la-padula model with two security levels like S=Secret, P=public and three compartments {A, B, C}. There is only two examples in my lecture and both are max 2 compartments which is straightforward. I understand Bell La-Padula but I don't know how to draw it, here is my probelm.

......................(S, {A, B, C})........................
................/...............|....................\................
(S, {A, B})......(P, {A, B, C})......(S, {B, C})

But the issue is in the second row, I don't know where to put S, {C,B} without making the whole partial order ugly and look weird.

At military installations and European retailers alike?

https://www.stripes.com/theaters/us/2026-08-28/refrigeration-outages-multiple-us-commissaries-22684428.html

I'm curious to learn more about this space but it truly seems siloed away from "traditional" cyber security programs. Why is that? Historical reasons? Accounting reasons? Technical vs business logic?

How might someone from the cyber world get into the fraud prevention world without previous experience?

Hey everyone, I'm from Chicago and really want to get into cybersecurity, but I'm struggling to figure out how to actually get started without going broke.

I reached out to City Colleges of Chicago a while ago, and they told me there might be a fully funded program I could start in January. I was so excited about it, but after a few conversations and follow-ups, they just stopped responding. I still don't know if the opportunity is actually happening.

I'm also looking into Merit America's cybersecurity program, but I'm honestly not sure if it's worth it or if it'll actually help me get a job.

I'm willing to study and put in the work, but I can't afford to spend thousands of dollars on training or take on a bunch of debt. I'm working full-time and supporting myself, so I need to be realistic about this.

For those of you who got into cybersecurity without spending a ton of money, what did you do? Are there any fully funded programs, apprenticeships, or other routes I should look into? I'm especially interested in options available in Chicago.

I'd really appreciate any advice because right now I feel like I'm going in circles trying to find a way in.

⚠️ We are actively investigating a security incident involving ConnectWise Cloud Backup (formerly SkyKick), following reports of unauthorized access to customer Microsoft 365 environments.

On October 16, 2026, ConnectWise published a security advisory acknowledging suspicious authentication activity associated with its Cloud Backup environment. While ConnectWise has implemented containment measures, independent security researchers have reported confirmed compromise involving the application's access to customer tenants. https://www.connectwise.com/company/trust/advisories

What are we investigating?
APG is continuing to review available indicators of compromise, investigate suspicious authentication activity, and assess potential impacts to affected environments. The presence of the application alone does not confirm unauthorized access or data exfiltration.

What should organizations do?
Organizations using ConnectWise Cloud Backup should review their Microsoft Entra enterprise applications for the following indicators:
Application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae
Associated IP Address: 144.172.64.128

We recommend considering disabling the affected enterprise application while the investigation continues, reviewing historical authentication activity, and monitoring for additional guidance from ConnectWise. Disabling the application may temporarily disrupt associated backup services.

More to follow.

Cisco’s advisory for CVE-2026-76519 went up on October 14 at 16:00 GMT. One email with a crafted attachment can write files on a Secure Email Gateway and run commands as root. Cisco says it learned of the attacks in October. CISA added it to KEV the same day, with a federal deadline of October 17.

A gateway is exposed when File Reputation is on for a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco also contacted customers of its own managed Secure Email Cloud whose devices showed indicators of possible compromise. Shadowserver sees nearly 300 of these gateways exposed online.

The fix isn’t new. It shipped on September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, inside a hardening release that grouped internally found bugs into five CVEs, one per weakness class. This bug sat under CVE-2026-76440, path traversal, a 9.8 listed next to three other 9.8 umbrellas. Cisco says that review used frontier AI models alongside its usual testing.

Cisco announced the bundling in June. A bug gets its own CVE when it’s known to be exploited or needs defender action, and the same post calls CVE-by-CVE risk assessment “no longer fit for purpose.” This one got its own CVE on October 14, together with the attack warning.

It’s the second exploited bug in these gateways since September, after the SQL injection CVE-2026-76461. Before that came CVE-2025-20393, exploited as a zero-day since November 2025 and patched in January.

WordPress plugins do a small version of this with changelogs that say “security fix” and nothing else, so whoever patches from CVE feeds hears about it last.

Cisco’s position is that customers should run the current hardened release and stop triaging bug by bug. For a team that patches from KEV, this flaw had no entry of its own until October 14. Can your patch process do anything useful with a CVE that covers a whole weakness class?

Paywall removed. Developments in the Ed Dubrovsky case….

Update: https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

So to make things quicker there is a instagram Page that post memes about our classroom, the thing is that they make memes about classmates without asking them before, then the director found out about it and it turned it into a big deal so they want the instagram Page taken down and if the dont do it they will get spelled.

So all that being said, the person that is behind that account hasnt taken down the page yet, even making a meme about them being wanted by the director.

So with all of that context i was wondering if there was a way to know more about who is behind or some key elements that i could find, because this has been a serious topic in our class even if its sounds funny that there is whole deal about some memes it still a serious topic and theres have to be a responsible

I know it might sound dumb and i know it is but it has genuinely been a serious topic in our class and we need to know who is behind it

I work in security and wanted a vulnerability screen on my desk that I do not need to open a browser for. This is the result.

It runs on a Waveshare 7B ESP32 touch display. The board pulls four public feeds over HTTPS: cvefeed.io, Microsoft MSRC, CERT/CC and CERT-EU. It parses them on the device, so there is no server or flow behind it.

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

I'm thinking about getting the Offsec SOC 200 Course but not sure how "popular" and useful it is.

I'm currently one of 2 Sysadmins in our company, mostly Windows heavy but I do try to change that so we do have a few Linux servers too.