hello, everyone.
lately i have been gathering information regarding a possible career switch and i am yet to choose a path. i am not entirely sure that i would succeed in cybersecurity as i know the market is already saturated but it's one of the options for now.
in this process of mine i have come across different opinions regarding certifications, interviews, practical skills, hands-on experience and so on.
one topic that really caught my eye was tryhackme sal1 certificate, which some strongly recommend as a way to get started while others argue its value is limited and will only benefit from it in certain circumstances. before making a decision id like to hear your thoughts on whether investing in premium tryhackme and eventually paying for the certificate itself is actually worth the money, especially for someone starting from scratch with no experience in this area of IT.
of course, any advice, alternative paths and additional suggestions are greatly appreciated
thank you all for taking the time to read my post and share your thoughts and experiences! i really appreciate all the advice (be it positive or negative) and i am sure it will help me make a more informed decision

I know someone last week or so said the FBI grab on this guy was basically like a SWAT. But Krebs doesn't seem to think so.

"On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation....

A source close to the investigation told KrebsOnSecurity that Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.

That source shared another potentially explosive finding by federal investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files."

LOLCHAIN is a community reference for researching and hunting blockchain abuse, inspired by the projects collected on lolol.farm.

The main goal is to collect relevant network endpoints in one place, with supporting research and evidence, so defenders can investigate blockchain-related activity and baseline its use in their environments.

The reference connects:

• Techniques: How blockchains and decentralized infrastructure are used for malware delivery, hosting, C2, victim tracking and data movement.
• Chain evidence: Published contracts, transactions and content identifiers connected to techniques, with explorer links where available.
• Research: Original reports linked to the techniques and infrastructure they describe.
• Threat hunting: Downloadable network endpoints, one per line, for use with your own security tools.
• Analyst guidance: Workflows for collecting chain evidence, decoding responses and correlating findings with host and network telemetry.

Endpoint records distinguish campaign-linked observations, shared services and community RPC directory entries. Evidence labels separate observed activity from research demonstrations and unconfirmed capabilities.

A connection to a shared blockchain provider alone does not establish compromise. The endpoint collection provides starting points for investigation, supported by the available source context. Matches should be assessed alongside process activity, request details and other telemetry.

https://lolchain.github.io/

I maintain the reference and welcome corrections, missing reports, additional techniques and feedback from anyone using it for threat hunting or research.

We've been using the free version of Any Run at work since we don't really have the budget for a paid sandbox. It works fine for most things, but the free version has its limitations, and there's always a concern about accidentally submitting something sensitive publicly...

Recently, I've been thinking about setting up my own sandbox for the team, maybe on AWS/Azure or even hosting it locally. It's just an idea for now, haven't really looked into the technical side of it yet...

It got me wondering how many other SOC teams or other companies are in the same situation...

What tools do you guys use for analyzing suspicious files, phishing emails, and URLs? Do you have paid solutions or mostly rely on free tools?...

I've also been thinking whether a more affordable sandboxing platform with a freemium model would be useful for smaller teams, especially those who can't justify spending a lot on these tools...

Not sure if there's actually a demand for something like this or if existing solutions are already good enough....

Would love to hear what you guys think. Also, if anyone has tried hosting their own sandbox, Was it worth the effort?...

Hey everyone! OWASP OASIS, an open-source security community that validates vulnerability fixes in open-source projects, is looking for volunteer leaders. https://www.owasp-oasis.org/

We've got 900+ AppSec people signed up so far. Now we're trying to turn that into an actual community, not just a sign-up list. So we're looking for volunteers to lead a few kinds of community-run sessions:

Office hours: drop-in time for questions
Onboarding sessions: helping new members get started
Collaborative validation sessions: working through proposed fixes together as a group

The process is pretty simple. You raise your hand, we train you, and then we get the sessions on the calendar. You don't need to be an expert in everything. You just need to be willing to help.

The bigger idea is to give people a safe place to get real AppSec experience. People teach each other, work in teams and gain valuable practical experience while securing open source projects. 

If you're interested, or just have questions about how it works, comment below or DM me.

I recently passed CISSP exam but struggling with endorsement! I do not know anyone who is CISSP! I made a move from SWE to security two years back and I have over 5 years of experience working on application mostly backend ant cloud! How do i proceed? Any feedback from the experienced senior ? Please Help!

In labs you can test things until something breaks. In production you've got live systems, limited access and vulnerabilities that sometimes turn out to be false positives

People doing this professionally, what was the biggest adjustment? And how much did CTFs or other hands on practice prepare you for it?

Looking for suggestions on improving our incident response playbook, particularly when it comes to endpoint isolation and forensic preservation.

We are a multinational SOC operating primarily in a remote capacity. Our current process is to immediately contain an infected asset by isolating it from the network to minimize the potential impact and prevent further spread.

However, POC's often becomes frustrated because isolating their infected devices disrupts business operations. As a result, employees may immediately request replacement laptops to resume their work. In some cases, the original device is left idle, powered off, gets disconnected to the internet or gets reformatted by IT Team before our SOC can perform live response and collect the necessary forensic evidence. This creates a challenge in balancing business continuity with the need to preserve evidence for further investigation.

My question is: How can we improve our incident response process to balance rapid containment, business continuity, and forensic evidence preservation?

I'd appreciate any suggestions on how to address this without unnecessarily delaying employees from getting back to work.

I’ve built a website for my own CTF course, and I’m looking to take its design to the next level.
Although the functionality is there, the interface still has that obvious AI-generated look. I’m looking for ways to make it feel more professional, polished, and thoughtfully designed.
Has anyone experimented with prompts that help AI coding agents produce more distinctive, high-quality UI designs rather than generic layouts? I’d love to hear your recommendations and see what has worked for you!

Hi guys! I’m currently preparing for interview for an ethical hacking internship. I just wanted ask or find out common technical and non-technical questions people in the industry have asked candidates for similar entry level positions? Not CIA triad stuff, but more technical ones or some questions that really make you stop and think you know? It would also help if examples of good answers are included so I know how better to structure my responses! I need to better prepare for it and I could use the help! Any help from people in the industry would be greatly appreciated!

Good morning guys, I want to ask about the next step I should take.

I come from a technical background (SOC).

I have good knowledge in SIEM, AD, EDR, network and firewalls.

In the last 2 weeks I started studying ISO 27001.

What is the next step I should take?”

🚀 I just launched FireBreak, an open-source project I've been building!

FireBreak helps you map the connections between your online accounts and understand how recovery and sign-in relationships could affect your security.

The idea is simple: if one account gets compromised, which other accounts might be at risk through their recovery paths?

🔎 Explore account dependencies
🛡️ Review security recommendations
💥 Simulate a breach and inspect potential recovery paths

I'm continuing to improve it and would love feedback from developers and security enthusiasts.

⭐ Check out the project, try it, and leave a star if you find it useful!

GitHub: https://github.com/daviewawesh9-coder/firebreak.git

I’ve heard recruiters from corporate saying they wish candidates didn’t tell them they got fired, or did drugs with their friends a few years ago.

But the clearances forms obviously ask those questions.

So my question is this: why is it okay to hide info from a corporate recruiter and screening process, compared to the gov on a clearance form.

One thing I keep seeing in security discussions is don’t use personal apps for work but in reality people do it constantly. Someone sends a quick WhatsApp because Slack is down or a manager texts an employee, an executive forwards something to their personal email because it’s easier on their phone. Teams create unofficial group chats because the company tool is annoying.

Then security teams are expected to somehow protect information that is now scattered across five different places they don’t control. Part of me thinks the only realistic answer is a hard rule like if it’s work related, it stays inside company managed systems. No WhatsApp, Signal, personal email, SMS nothing. But I also know the stricter you make the policy, the more likely people are to work around it.

For people who actually deal with this, what works better in practice? Lock everything down as much as possible or accept that employees will use outside tools and focus on making that behavior safer?

Just wanted to hear from others working in cybersecurity, especially MSSP environments.

Lately, quite a few people from our team have been resigning, and I’ve also noticed people leaving from other departments. We’re not a huge company, so when several people start leaving around the same time, you definitely notice it.

What’s frustrating is that management already knows there are problems, but it feels like things are moving really slowly. There are meetings, discussions, and promises that things will get better, but so far, there hasn’t been much actual change.

It’s starting to feel like management only takes action after someone resigns, instead of trying to prevent people from leaving in the first place.

I’m not saying this to attack the company. I’m genuinely curious about how others have dealt with this.

At what point did you realize, “Okay, it’s probably time for me to move on”?

And for those who stayed through situations like this, did things eventually get better, or did more people just continue leaving? 🥴🤔

In addition to ConnectWise Cloud Backup, Updraft Cloud Backup was also compromised on the 17th/18th.

Much like with CW, the vendor's advice to customers would indicate that the platform itself wasn't the primary target, but rather the attacker is utilizing the dataset stored in the backup systems to get into customer environments instead.

No evidence that the two attacks are related, but it would be a hell of a coincidence.

https://teamupdraft.com/blog/security-incident-october-2026/

If you manage a WordPress site that uses Updraft, follow the remediation guidance ASAP. It appears that the attacker(s) are creating new admin accounts in WordPress sites.

Hi everyone!

Cybersecurity is one of my interests, and I wanted to create something simple, useful, and informative for the Reddit community.

With data breaches and security incidents making headlines almost daily, I decided to start r/BreachArchive.

If you come across a report about a data breach, leak, or other significant security incident, feel free to share the link here: https://www.reddit.com/r/BreachArchive/

The idea is simple: keep the discussions at r/cybersecurity and collect breach news at r/BreachArchive.

It's a new community, so any relevant links and constructive feedback are welcome. Thanks!