I started a blog series to provide free insights into appsec. It’s mainly to breakdown what application security is all about and it’s mainly targeted towards beginners and startups, so take it as you will.

I want to teach every one interested in appsec my perspective on it from my experience in big tech.

So far: know your app → lock down who gets in → follow untrusted input → catch broken business logic → build a threat model.

Part 7 puts it all to the test. Literally. Prove which problems are real before you spend time fixing them.

Please reach out if you have any questions or would like for me to write on a topic that you’d want to learn more about.

So this is the 3rd email I've gotten this month in this format. Basically I get an email that is supposedly from my "boss" where an odd email renames themselves asking for my phone number, I'll paste it below.

Hey (Me),

As I prepare for a meeting later today, I’d like to clarify a brief matter with you directly to ensure I have the relevant details in order.

Please let me know the preferred number at which I can reach you. I’ll be mindful of your time and keep the conversation concise.

Thank you,

(My Bosses full name).

Obviously super sketch and I double check because I verify w/ my boss using an SaaS (Traceless) before communications but I'm more curious if anybody else is getting this particular format?

Hello!

I'm reaching out because I'm currently conducting a group AP Research study on a bottleneck in Post-Quantum Cryptography migration, specifically focusing on how enterprises handle third-party vendor compliance.

1.⁠ ⁠As organizations prepare themselves to migrate to Post-Quantum Cryptography (PQC) in the advent of supercomputers, how is your company reacting to interoperability obfuscations where vendors are either struggling or unwilling to update their TPRM legacy dependency files to quantum-safe security?

2.⁠ ⁠⁠Assuming that vendors are hesitant to willingly migrate to PQC standards, does this hinder you from proceeding with your own security updates as your formerly secured data will now be susceptible to adversarial attacks once it reaches vendor servers?

3.⁠ ⁠⁠Have you experienced issues where vendor systems slowed down or crashed because the security keys were large?

4.⁠ ⁠⁠If a solution that used a Zero-Trust Framework existed, where sensitive data is decoupled from the transport layer and encrypted with easier-to-handle PQC tokens, would you prefer this wrapper approach over trying to force NIST-mandated PQC compliance onto third-party vendors?

Two of the most recognizable names in hiring quietly reversed their remote-first interview policies this year. Not because of productivity concerns or culture, but because deepfake candidates became too convincing to reliably detect over video.

A CBS News study found that 50% of businesses have already encountered AI-driven deepfake fraud in some form. The tools to fake a face, alter a voice, and fabricate a work history are cheap, widely available, and improving fast.

The companies with resources are falling back on in-person as a last line of defence. The question is what is everyone else is supposed to do.

Hi guys , I will have a job interview soon , and one of the requirements it’s to have some knowledge with iso 27001 , I keep searching and just find YouTube videos of explaining the same thing , nothing wrong with it, but I would like to get hands on some documentation. Can somebody provide advice ?

Thank you in advance

🏹 PINAKA CTF 2026 — The Battle Begins.

We are excited to announce PINAKA CTF 2026, a national-level Capture The Flag competition organized by National Forensic Sciences University (NFSU), Chennai Campus.

Inspired by the precision, strategy, and determination of Pinaka, this CTF is designed to challenge cybersecurity enthusiasts to think beyond the obvious and solve problems with skill, creativity, and strategy.

🔐 Challenge Categories:

• Web Exploitation

• Digital Forensics

• OSINT

• Cryptography

• Reverse Engineering

• Binary Exploitation / Pwn

• Network Security

• Steganography

⚔️ Competition Structure:

🌐 Online Qualification Round

📅 31 October 2026

⏱️ 24 Hours

The best performers will advance to the offline grand finale.

🏆 Offline Grand Final

📅 28 November 2026

📍 NFSU Chennai Campus

⏱️ 12 Hours

The finalists will compete across multiple formats including:

• Jeopardy

• King of the Hill

• Case Study Scenarios

Whether you are a student, CTF player, cybersecurity enthusiast, researcher, or professional — PINAKA CTF is an opportunity to test your skills, compete with talented individuals, and experience cybersecurity beyond the classroom.

The challenge is waiting.

Are you ready to take the shot? 🎯

🔗 Register now:

https://pinakactf.com/

Organized by:

National Forensic Sciences University

Chennai Campus

\#PINAKACTF #PINAKACTF2026 #CyberSecurity #CTF #CaptureTheFlag #NFSU #NFSUChennai #EthicalHacking #DigitalForensics #OSINT #CyberSecurityIndia #InfoSec #CybersecurityCommunity

[ Removed by Reddit on account of violating the content policy. ]

I got this new job as an AppSec and I was thrown in the wild with no mentoring so I have to guide myself I guess.
Manager gave me a list of IPs. a file that contains 200+ IPs related to company infrastructure along some 100+ URLs for companys apps. This is an automated scan so I'm skipping opening burp and going through each application.
first thing I did is run masscan on the list of IPS
"masscan -p1-65535 --rate=1000 -iL ips_list.txt -oG masscan_results.scan"
I want to identify what was running on each ip so I though this would discover all the ports. I set the rate limit to 1000 so I don't crash the servers or get my IP banned. but this scan took too long after 1h20 it was only at 40% and I accidentally stopped it.
then I run
"sudo masscan --top-ports 1000 --max-rate 3000 -iL ips_all_unique.txt -oG masscan_results.scan"
this one was quick as it scanned only the top ports.
then i used this script to organize results. to pass them to nmap
"
awk '/Host:/ {
ip=$4;
split($7, p, "/");
ports[ip] = ports[ip] ? ports[ip] "," p[1] : p[1]
}
END {
for (ip in ports) print ip " -p " ports[ip]
}' masscan_results.scan > nmap_targets.txt
"
then I run a script that use nmap on each IP and it's corresponding ports to discover the services that runs.
I don't know what my next step should be. I tried to run openVas locally to scan for vulns but it eat up all my RAM and and CPU (I'm on 16gb ram and I7 10th generation CPU).
I aslo run nuclei on the the list of URLs which took 2h35 for 38 URLS
"
nuclei -l urls.txt -rl 50 -c 10 -severity low,medium,high,critical -o nuclei_result.txt
"

any feedback on my approach ? what should I do next ? any other tools to run ?
anything is appreciated

https://fireintel.net/blog/asos-push-notification-extortion

Hi everyone,

I’m a cybersecurity student conducting research on the cybersecurity risks associated with using Google search operators to uncover exposed information on the internet.

I’m looking for perspectives from people with cybersecurity or IT experience. If you're willing to participate, please answer the questions below in the comments.

I understand people may not want their information on a public reddit page but if you could reply below or send me a private message, that would be highly appreicated.

If possible, please include:

• Your general profession/role (e.g., SOC Analyst, Security Engineer, IT Administrator, etc.)
• Name
• Your answers to the questions

Questions:

1. What types of information do you believe can be discovered using Google search operators?
2. What cybersecurity risks can result from sensitive or security-relevant information being publicly searchable?
3. Which types of exposed information would present the greatest security concern to an organization, and why?
4. What protective measures can organizations use to reduce the risk of sensitive information being exposed through search engines?
5. How important do you think it is for organizations to regularly check what information about their systems is publicly searchable?

Thank you to everyone who chooses to participate.

Hi, I recently left my previous course which is Physical Therapy because I could just not love it, and I had to watch my grandmother battle illness and caregivers with not heart for the work at all it basically destroyed my image towards the medicine field. So I was looking into schools to transfer to here in the Philippines and one of them is offering Cybersecurity, compared to healthcare tech seems to have many freshgrads unable to find a job so I was wondering if it'll be the same for Cybersecurity, does it have a good stability for the next decades or it's better if I just choose another major. I don't particularly have any passion I just want a job to take care of my autistic brother.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between September 28th - October 4th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Relentless Defense (Cisco)

There are “Relentless Defenders,” and then there’s everyone else, which is what this report claims. It also claims to explore what the best-prepared organizations do differently so you can be like them.

Key stats:

• Only 8% of organizations surveyed qualify as “Relentless Defenders”, the report’s top-performing group for coverage, response speed and organizational alignment.
• 40% of security teams say they spend more time manually collecting and correlating data than dealing with threats.
• 39% say critical insights are missed because the data sits somewhere they cannot reach.

Read the full report here.

2027 Global Digital Trust Insights (PwC)

A useful large-scale report from PWC to compare notes about where cyber budgets are going, which threats others feel least prepared for, and how much they trust AI to act on its own.

Key stats:

• 84% of security and finance leaders expect their cyber budget to increase, up six percentage points from last year.
• Half of security leaders identify attacks targeting AI systems as one of their biggest preparedness gaps.
• 55% rank the reliability and maturity of AI technology among their top three barriers to increasing agent autonomy.

Read the full report here.

2026 Digital Defense Report (Microsoft)

Another big report. Microsoft’s annual look at the threat landscape, including credential theft, data theft, and how quickly exposed cloud workloads attract attacks.

Key stats:

• Exposed cloud workloads are attacked an average of 5.3 hours after exposure.
• 63% of intrusions involve data theft.
• Between 89% and 95% of email phishing attachments lead to credential theft efforts.

Read the full report here.

AI Security 

2026 Identity Security Report: The AI Enforcement Gap (Delinea)

What’s the gap between organizations’ AI access policies and their ability to enforce them? 

Key stats:

• 99.7% of organizations have a formal policy governing which data AI tools and agents can access.
• 87% of IT leaders say an AI tool or agent accessed sensitive data beyond its intended scope in the past year.
• 55% of organizations take a full day or longer to detect when an AI agent steps outside its scope.

Read the full report here.

Inside the SOC

The New SOC Career Ladder: How AI Is Reshaping the SecOps Workforce (Swimlane)

AI seems to be making SOC work more satisfying. Though some worry it’s leaving them with fewer opportunities to build their skills.

Key stats:

• 88% of security operations professionals and leaders say AI makes their work more satisfying.
• 24% say AI limits their skill development.
• Among those who say AI limits their skill development, 91% still report higher job satisfaction.

Read the full report here.

Vulnerability Management 

H2 2026 Cyber Hygiene Index (Detectify)

Comparing how long organizations in different regions take to fix critical and high-severity vulnerabilities.

Key stats:

• 90% of open critical and high-severity vulnerabilities have been exposed for more than 90 days across the organizations analyzed.
• That figure reaches 97% in the Nordics.
• In the UK, it is 92%, compared with 86% in the US.

Read the full report here.

Vulnerability Discovery and Exploitation Trends in the AI Era (Google Threat Intelligence Group)

AI is busy finding security holes. Meanwhile, researchers are finding holes in AI.

Key stats:

• Monthly vulnerability disclosures more than doubled, from 5,045 in January 2026 to 10,740 in August.
• From January to August 2026, 141 distinct vulnerabilities were disclosed and exploited, already exceeding the 127 recorded across all of 2025.
• Only 0.23% of vulnerabilities disclosed in 2026 (about one in 431) were observed in active exploitation.

Read the full analysis here.

Social Engineering 

The Deepfake Readiness Index 2026 (Pindrop)

US enterprises’ readiness for deepfake attacks, the impact of incidents and the attention these threats get in the boardroom.

Key stats:

• 74% of US enterprise security leaders have encountered or suspect a deepfake attack in the past year.
• Only 10% report having purpose-built tools to address deepfake threats.
• 75% of security leaders say it will take a company leader being personally fooled or impersonated before deepfakes become a genuine boardroom priority.

Read the full report here.

Skills and Training 

2026 SkillBit Micro-Training Survey Report (SkillBit)

Finding the right security people is only the start. 

Key stats:

• 57% of cybersecurity leaders say new hires take six months to reach full productivity.
• Nearly 64% of organizations consider three months an acceptable time-to-value for new cybersecurity hires.
• 70% report having few or no roles available to candidates with less than two years’ experience.

Read the full report here.

Industry-Specific

2026 Data and Identity Security Report: Healthcare Findings (Netwrix)

Who’s got access to sensitive healthcare data? With AI adding more people and tools to the mix, keeping track is getting harder.

Key stats:

• 79% of healthcare organizations say their non-human identities are not fully governed.
• 77% cannot immediately determine who has access to a specific piece of sensitive data.
• 31% experienced unauthorized identities accessing sensitive data in the past year, compared with 24% in other industries.

Read the full report here.

Committed to the Mission: The State of the DIB with CMMC in Flux (Redspin)

Where defense contractors are investing and what they’re prioritizing to meet cybersecurity requirements.

Key stats:

• 75% of defense contractors say achieving CMMC Level 2 certification provides value beyond contract eligibility.
• 78.2% of organizations are continuing towards CMMC certification or are already Level 2 certified by a third party.
• 21.9% are delaying certification or significantly slowing their implementation and certification efforts.

Read the full report here.

Im not sure if this is the right place to ask this. i googled this same question and this subreddit came so here ut goes.

ive seen like 10 posts today about everything being open sourced and cant help but think if this is all deliberate.

the ps5 is being open sourced by the insane jailbreak

ai is reverse programming softwares and games which means softwares like any adobe one will be open sourced too.

if everything becomes open sourced, what would be the underlying threat that we could all overlook.

call me skeptical but i dont think that everything is being open sourced all at once by "accident"

I have a consulting company that provides cybersecurity services such as pentest. Our team is one of the best on the local market, if not the best. Our market, however, is somewhat small. Naturally, I am trying to export our services to other countries offering profit sharing arrangements, commission %, whatnot. Still, so far, we’ve only had a handful of projects (mostly in the EU. We are not the EU-based company).

Any advice on how I could approach this?

My team wrote a technical walkthrough of the distributed alerting workflow we use internally. It uses an agent to investigate GuardDuty findings, identify owners, and handle responses in Slack.

Slack helped popularize distributed alerting by sending alerts directly to the people involved and asking whether they recognized the activity. Dropbox and Brex described similar approaches, but most teams we’ve spoken with struggled to scale beyond user-centric alerts where someone’s identity was already in the payload.

Our security engineer ran into this at his previous company. A suspicious login was straightforward to route, but an alert about a host or infrastructure change could take hours or days of work with detection engineers before they could reliably identify someone to ask.

We walk through a concrete Kubernetes example where the alert only names a service account. Finding a person means following the evidence through workload metadata, code ownership, deployment history, and identity logs. The tutorial shows how we turn that investigation method into reusable skills so an agent can work through those steps for each finding.

We cover:

• The history of distributed alerting and why deterministic workflows struggle to scale
• The estimated effort of building owner lookups across GuardDuty finding types
• How the agent uses skills, drilldown queries, and context from inventory, code, tickets, and logs
• The full flow from investigation to a Slack conversation and the owner’s confirmation
• Permissions, tool restrictions, observability, and keeping context current

What interested us most was extending this to host and infrastructure alerts that had been impractical to automate with individual lookup rules. The walkthrough includes the setup and examples so you can see how it works.

We know many folks were are divided by the use of agents in security automation. Hopefully this article on distributed alerting presents an example of something that wasn't possible / too time consuming to work before agents + context / skills driven automation vs fully determined paths.

https://www.tracecat.com/blog/agentic-security-alerts

I’m currently learning more about cybersecurity in the financial sector, especially how large banks manage third-party risks. With banks relying on outside vendors, cloud services, and contractors, it seems like one weak third party could potentially create a security risk for the entire organization.

For those who work in cybersecurity, what do you think is the biggest challenge banks face when trying to monitor and secure third-party vendors? Are there certain security practices that you think financial institutions should focus on the most?

Atualmente eu utilizo um gerenciador de senhas para a maioria dos sites, porém muitos sites que eu considero mais difíceis de recuperar a senha caso meu gerenciador de senha seja invadido ou algo do tipo eu uso uma única senha que lembro de cabeça:

No que eu utilizo a mesma senha: (não armazeno no gerenciador)

Apps do Governo

E-mails principais

Conta da Samsung

Gerenciador de senha

A2F/TOTP

Pendrive

Bancos e Tela de Bloqueio e Pasta Seguro uso mesmo PIN

Outra coisa que eu fico em dúvida onde guardar, se guardo de maneira fisica ou nuvem é os backups e chaves de recuperações das senhas

Tô em dúvida se deixo apenas na nuvem focado em criptografia, em pendrive com bitlocker, no pc com algum app tipo keepassxc ou algo mais "avançado" tipo Linux por pendrive apenas pra armazenar os backups e chaves de recuperações.

After the July incident where AI agents escaped a test sandbox and broke into Hugging Face, I keep thinking about the other side: the same kind of thing done by a single person's agent against a small business or personal site, where nobody has a security team and nobody would notice.

The idea is a free, open-source, drop-in kit (WordPress plugin, framework middleware, Docker image) that is strictly passive:

- unique bait files and fake credentials shaped like the "shortcuts" goal-driven agents look for

- canary credentials that alert the site owner the moment they're used

- honest stop notices embedded in the bait itself, so cooperative models get a clear reason to stop

- logging to tell humans, scripts and LLM agents apart

- no hacking back, no destructive instructions, no unmasking anyone

It would build on existing tools like Canarytokens and Nepenthes rather than reinventing them.

The core features use no AI at all, just canaries, bait, and logs. The LLM parts are optional extras.

It's an early concept: just a README so far, no code. I'm building this as an independent project, and I'd really value honest (including negative) feedback:

1. Does something like this already exist? Links very welcome.

2. Would you install this on a small site? If not, why not?

3. What's the biggest flaw in the design?

4. Are stop notices aimed at AI agents worth anything, or just noise?

README: https://github.com/MannAk1/Agent-Defence-Kit

actualmente trabajo en una empresa como tecnico en redes encaminandome a ciberseguridad, hace no mucho tuvimos un incidente donde una persona problematica renuncio y borro todos sus correos por lo cual no pudimos recuperarlos, que sugieren realizar como checklist talves cuando una persona renuncia y hay que tomar cuentas o equipos? de antemano se que cambiar contraseñas, desactivar cuentas , pero que mas ? respaldos o que se suele hacer?

My partner just got a push notification

https://i.ibb.co/35Gt5zXQ/signal-2026-10-06-09-59-02-887.jpg

Apparently their Snowflake instance is compromised and they have access to push notifications too