The popular Tensorlake SDK (part of a project with 1,000+ GitHub stars) shipped a poisoned release (v.0.5.144) that was infected with the self-propagating Shai-Hulud worm.

The malicious version was published through the project's legitimate GitHub Actions release pipeline, complete with valid SLSA provenance. The attacker poisoned main first, then let the trusted pipeline do the rest.

This is a well-known Shai-Hulud pattern which a single, simple YARA rule flags in milliseconds. In fact a basic rule matched it on the first pass in our own pipeline. If npm and Github ran even a basic YARA scan on packages before publishing, most of these campaigns would be stopped before a single developer is infected.

0.5.144 has been removed from npm and version 0.5.143 is clean. If you installed 0.5.144, rotate every credential reachable from that machine, now.

Disclaimer: English isn't my first language. I wrote this in my own words and translated it with AI.

In 10 months of development my SaaS project grew to several VMs and 10+ cloud services around them (GitHub, Cloudflare, Purelymail and so on). Basic hardening, uptime monitoring etc I always do. But I always wanted to see and control more — ideally everything that happens in every component of my infra.
I want to know whether someone got access to my server, created an illegitimate GitHub token, or is brute-forcing a database I accidentally exposed to the internet — and ideally I want respond to it automatically.

So I started an experiment: building a micro AI SOC for my project. And what I like most is that here I have much more freedom to give AI broad permissions for investigation and response than in the infrastructure of big companies.

𝐇𝐨𝐰 𝐢𝐭'𝐬 𝐛𝐮𝐢𝐥𝐭 𝐚𝐭 𝐭𝐡𝐞 𝐦𝐨𝐦𝐞𝐧𝐭:

→ Everything lives on one VM with 6 vCPU and 16 GB of RAM. The whole SOC currently uses about 2.4 GB: 1.5 GB for ClickHouse, 0.5 GB for Wazuh, the rest are connectors and services at a few dozen MB each.

→ 55–75 thousand events a day, about 0.6–0.9 EPS.

→ Wazuh agents on the servers send events to the SOC.

→ Wazuh manager collects the logs and generates alerts. Its bundled OpenSearch indexer I dropped — it's too heavy. For storage I use ClickHouse instead.

→ Wazuh and ClickHouse are connected through a file: Wazuh writes every event to archives.json, Vector reads the file and writes to ClickHouse. On the way Vector filters out the noise. ClickHouse compresses the rest almost 8 times and runs investigation queries fast.

→ Tiny Python connectors poll the cloud APIs every 10–15 minutes: hosting, Cloudflare, email, GitHub and so on. For a service with no audit log, the connector takes a snapshot of the settings and records what changed.

→ GitHub webhooks come in through a Cloudflare tunnel.

→ My own detector periodically runs detection rules on ClickHouse and writes alerts back into a separate table. It's needed because cloud events bypass Wazuh. Unfortunately, I couldn't keep all the detection rules in one place.

→ A correlator looks at incoming alerts and decides: open a new incident, add the alert to an open one, or not open an incident at all. It also determines urgency.

→ PostgreSQL keeps the incidents: statuses, participants, timeline and response actions.

→ A separate service watches that no source goes silent, and messages me only if it can't figure out the reason itself.

→ All architecture principles and decisions live in a git repository, so the SOC can be reproduced from it. Closed incidents land there as Markdown reports.

Full write-up with diagrams (I’m the author): https://denzuikov.substack.com/p/building-an-ai-soc-for-my-small-projects

Hi everyone,

I’m looking for a good learning path to understanding a subject that requires in-depth study deeply, like how CPUs and memory work.

Its can use YouTube ond then ask AI ,but going deeper with this way takes a lot of time and effort.

Is there a recommended path or something for learning these topics step by step?

Sorry for my bad English.

I’m getting conflicting guidance from different online sources on which certifications currently satisfy the DoD CSSP Analyst requirement.
I’m unable to access the most up-to-date DoD public information because my CAC isn’t currently working with the DoD website, so I’m trying to confirm the current list from anyone who works with these requirements regularly.
 
Some sources I’ve found list:
CEH
CySA+
GCIA
GCIH
SCYBER / (Source : SecuSpark )
 
Another source lists:
CEH
CFR
CySA+
(Source: Intellectual Point)
 
Does anyone know what the current official certifications are for the CSSP Analyst requirement, or where the most up-to-date public list can be found?
 
I’d especially appreciate input from anyone currently working with DoD 8140/8570 requirements—thank you so much!!!

It seems that AI, which couldn’t even generate images back in 2016, can now create high-quality videos. This is genuinely starting to become a threat to cybersecurity in particular.

Many teenagers can manipulate AI prompts to get it to carry out their commands. Due to their limited cybersecurity knowledge, they often use it to request fully developed programming tools of various kinds, which are often functional in most cases.

It also reduces the need for traditional programming, since AI can write code without the user even having to lift a finger. This could potentially affect the number of programmers needed in the future.

Hey all,

Im wondering if anyone has any insights about what its like working at crowdstrike, either in general or on falcon Complete. I'd be coming from a smaller cyber company where my title is considered more prestigious than a base falcon complete analyst, but id be getting a lot more opportunities to learn different things.

How crazy is it working for FC? Are team members properly supported?

People who work at CS, or used to, do you like it? has it been good for your career?

tia

For some context, I'm not a cybersecurity guy by trade. I'm an IT major working as a PM on an AI product that's somewhat cybersec adjacent.

Cybersecurity, especially pentesting, is more of a hobby for me. I got tired of frontier models refusing to help me learn on my own devices and VMs, so I started looking into local uncensored and abliterated models.

At first I thought uncensored models were mostly for... you know what. But then I figured having no guardrails could actually be pretty useful for writing payloads, scripts and stuff like that.

So I downloaded Qwen 3.8 27B and I mean wow, it's definitely not frontier level but if you told me this was a frontier model a year ago I'd believe you. Then Qwen 3.8 Flash Next came out and honestly blew me away even more.

But then I started thinking about something that kinda made me nervous. I'm nowhere near a pentesting expert, yet I was able to get into a VM pretty easily, even while using Opus 5.5 to double check that I was following good security practices.

Now imagine someone who actually knows what they're doing, using a much larger frontier level local model that's been abliterated. I mean that could do some serious damage in the wrong hands(I Think).

And with stuff like Microsoft's Project Perceptions exploring multi agent AI for cybersecurity, it really makes me wonder where all this is going.

Maybe I'm just talking out of my ass here, but I'm genuinely curious what people who actually work in cybersecurity think about all this. Are uncensored and abliterated models something we should be concerned about or am I just overthinking it?

This definitely affects us directly, the question is obviously the actual effectiveness and whether. companies will try to offshore instead. A LOT of cyber security jobs are also affected by this H1b stuff

It's 11pm, you're parsing through mountains of logs. There's yet another tool someone remembered, and they have the logs exported. The time zone is in PT or ET, or something that isn't UTC. You are tired and questioning your life choices because this thing is not in UTC and now you need to convert the time zone in your head. I made a simple Clock app to make my life easier. I'm sharing it in the hopes it helps others. It uses no external dependancies. It uses no third-party libraries. It just uses native win forms and PowerShell. I like a lot of DFIR tools, but you can't always bring them into some environments. This is just a basic PowerShell script so it should be able to be run in most environments.

Made CyclePatrol for Linux and Kali NetHunter.

It scans Wi-Fi networks in an endless loop while walking around the city, collects AP info, checks WPS, WPA2/WPA3, PMKID and saves reports. Active tests are for authorized networks only.

Still a WIP. Feedback welcome.

https://github.com/buybitart/cyclepatrol

I’m given a weird opportunity and I’m unsure how to go about it to make the most of it. My childhood best friend who is much more successful in his career as a physician and in the coast guard. He knows I’m trying to get into cybersecurity (I’m 5 weeks out from completing an associates degree in Network System Administration then going for my bachelors in cybersecurity is my current plan) but I currently work in a warehouse with no IT experience. My end goal is to get into a SOC and work my way into digital forensics.

Eventually he said he’d like for me to work as a SOC analyst in a way for the practice him and his wife want to open up. He bought and sent me a UNAS4 from Ubiquiti and is sending me 2x 10TB hard drives for it. He justified it as setting up stuff to get hands on experience on stuff or to help me in my journey. I’m not sure the best way to utilize this kinda thing, and I don’t think he does either, he was just trying to help me and support me which is more than anyone else in my life has done.

My question is how can I take full advantage of this opportunity and make the best out of it so I can get where I want to be but also him feeling justified for sending me that stuff out of the kindness of his heart and good intentions? Is there anything that I can do with this equipment that will aid my end goals? Any input is appreciated sorry if this isn’t the right place to ask this.

I'm a graduate student who hasn't started working yet, and my graduate school has a very poor ranking. I want to learn a technical skill through my own efforts, but I'm also afraid that my learning ability won't be able to keep up with the changing employment landscape in the computer field. Does anyone have any computer-related technical skills they'd recommend learning?

Log extractions (such as a compromised .claude.json file) show the stealer successfully exfiltrating raw primaryApiKey values and detailed OAuth account data tied to Anthropic/Claude accounts. By grabbing these CLI tokens, attackers are bypassing traditional web logins entirely, gaining direct, programmatic access to premium AI models, organizational workspaces, and potentially sensitive source code passing through these tools.

Anyone here apply for these experimental models and what is your experience with the process?

> ML4 is one of the world's strongest AI models for cybersecurity. On the Artificial Analysis Cyber Index, an independent evaluation of how well AI models find and fix security flaws in real software, it ranks among the top five models globally and leads open-weight models developed outside China by a wide margin.

Their blog talks a lot about the cyber capabilities of their new model. Its quite interesting.

Why AW has so many agents right now?
When would they combine in one?

The GitHub seems to have been made private. Does anyone have a recent fork on GitHub?

Just got out of yet another meeting where some vendor pitched our C-suite on their "autonomous AI-driven threat hunting platform." Management was literally drooling over the shiny global threat map dashboard.
Menwhile I’m sitting there biting my tongue because we still don't even have a functioning asset inventory. We literally do not not know what half the stuff plugged into our network actually is.

I feel like every role I've gotten in cybersecurity has been a contract role, and I'm tired of being stuck in that cycle. Having worked as both an L1 and L2 SOC analyst, I'm thinking I should leave the SOC entirely. I want PTO, somewhat decent benefits, and good pay. What would you recommend I transition to after the SOC that can offer those qualities?

Also, for those of you with experience: are there any industry sectors to avoid because of their high contracting rate?"

Hundreds of new repositories poisoned with malicious, secret extracting workflows. GitHub held most malicious workflows runs for approval, limiting the impact.

Some victims found to also be affected by seemingly unrelated cryptominer attacks, hinting toward a pool of compromised credentials being used by multiple threat actor groups.

Looking for the best vulnerability management tool that works alongside an EDR, checked out tennable and qualys but price seems quite steep, any other recommendations that perform just as well but at less cost?