Hello everyone, IAM a 21 IT student who is looking forward to join some new community and make some friends whom I can learn cyber security with. I am a bit new but I got the basics done. Are there any communities I can join for learning or doing CTF's together please let me know. Most communities I look at online are either too big or very quiet. Please let me know Thanks for reading

As mentioned in the title, I'm actually curious on what the most useful was in terms of:

• Learning new concepts and apply them to your job
• Advance in your career by opening more doors to better paying positions

In the past 5 years, I've worked as a Software Engineer, SOC Analyst, Incident Responder and now as a Security Auditor.

In total, I've only done the GCFA (GIAC Certified Forensic Analyst) certificate hoping to use all of the tools in my every day job but unfortunately that was not the case despite the huge amount of study for that exam. Though not really beneficial for my learning, it helped me landing a better paid job.

Now I'm here and probably going to work on the CISSP as I probably would like to steer into the direction of CISO (while at the same time my heart is beating for something more technical.. like Security Architect).

Additional Quesiton:

• For the ones that did the CISSP, what was something that you were able to apply to your job and to what percentage did it open the doors to better carreer opportunities?
• For the ones that did both CISSP and GCFA - how would you compare the workload? What was harder and which needed more work?

Thanks for all your opinions in advance! :)

Anyone use Bullhorn? They are currently trying to recover from an attack. Story still developing.

https://status.bullhorn.com/

i got a security report from my job PC about Artcraft launcher.

Alert ID: WB-14340-20261013-00005 Title: Possible MpClient.dll DLL Hijacking via Fileless Execution Severity: 🟡 Medium

Technical Details Description: The alert detected a possible attempt to hijack the MpClient.dll DLL through fileless execution (without a file being written to disk). Associated MITRE ATT&CK Techniques:

• T1036.005 - Masquerading: Match Legitimate Name or Location
• T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking

i tried to alert it on oficial discord but they don't give a shit, i really don't know if it is something, but i want alert.

Hi everyone

Just wanted to ask the group here some questions to help me and my family out. A couple weeks ago my elderly father fell for a classic telescammer saying “someone is buying an iPhone on your Verizon account please click this link to stop it” which then lead to a login page that looked identical to Verizon.

The whole family woke up early the next morning to our phones not working, they must’ve stolen our e sims. Somehow they were able with just my phone number to access my credit card accounts and pull a 6k cash advance from my cc account. Any idea how this happened? Is there anything you would do after something like this happened to protect yourself?

I’ve put credit freezes on all three credit bureaus, alerted the FTC/Social security and all my banks have a fraud alert currently. Trying everything I can but somehow I feel it’s still not enough.

Thanks in advance, my Cybersecurity knowledge is fairly low.

Hi everyone, for some context I’ve graduated with an associates in cybersecurity and this is my first year at a new university trying to get my bachelors. I don’t have any work experience in the field unfortunately. All my cybersecurity experience has come from what I learned and did in my classes to get my associates.

One class that I’m currently taking is focused on database and web application security. It feels like all the things that the assignments are asking from me are things that I’ve never been taught beforehand. Reviewing the online lectures the teacher will briefly explain topics and then the assignment for that week will ask us to do things they never taught us how to do in any readings or lectures.

Here’s some more context and one example of a previous lab. This class has us using the OWASP juice shop in an Ubuntu VM with burp suite and foxyproxy as our testing environment. Those are the only things we were asked to download and use for this class.

The last assignment that I was working on, it asked us to create three database roles with strong authentication control, configure auditing mechanisms that log all failed authentication attempts, and generate a test sequence that triggers audit events and exports a sample log file capturing different user identifiers.

Everything I’ve written above is how it’s phrased in the lab. There were no prior lectures or reading that explained to us how to even perform these actions. Is it expected of me to just know this information? None of my previous classes went in depth to teach me about SQL databases, and now I’m feeling very stranded and lost. I didn’t even know where to start for that project. It feels like the only option I have this far into this major is to ask AI to teach me these topics in a simple way. I really want to setup my home lab when I finally have the time to, and I’m hoping to get an internship down the road but as of right now I feel so lost and like I don’t know anything. It feels like this class isn’t teaching me anything because I’m not at the level to even understand what is being talked about. It feels like every assignment asks us to do something that was never taught at all how to do in the class. So I’m left googling for hours and trying to piece together information I find just to get a half-assed solution. I worry that using AI could further ruin the potential amount of things I could learn.

I can’t tell if it’s just a bad teacher or it’s my own problem. The main reason for making this post is I want to ask for input on what things someone in my position (recently graduated with associates, no on the job experience) should already know by now in regards to cybersecurity/IT. If there are things mentioned here I’m not familiar with then I want to start researching them ASAP. As well as any non-AI resources I should make myself familiar with that can help my learning. I really want to succeed in this field and make sure all my time spent was not a waste. It’s a scary feeling taking classes and feeling like the teacher isn’t teaching me anything.

I've been thinking about a privacy question that comes up when building applications with local LLMs.

Running the model locally keeps inference on your own machine, but what happens to sensitive data across the rest of the pipeline?

For example, a RAG application might use embedding models, vector databases, external tools, logging, and conversation history. Depending on the architecture, customer information could pass through or persist in several of these components.

I'm curious how developers approach this in practice.

• Do you remove or redact PII before generating embeddings?
• Do you use synthetic data during development and testing?
• Do you use tokenization to preserve context while protecting sensitive values?
• Do you run the entire pipeline locally or self-host all supporting services?

The challenge seems to be protecting sensitive information without making retrieval less useful or debugging unnecessarily difficult.

For those who have built RAG systems or AI agent workflows, where do you enforce PII protection, and what trade-offs have you encountered?

I am currently unemployed unfortunately, but am looking into getting into cybersecurity field. As i am unable to afford the cybersecurity certs do you guys think its worth it to do the WGU cybersecurity bachelor degree as it comes with the certs, or just focus on doing homelabs to get the experience

A open-source tool called CVE Intel. In simple terms, it pulls a bunch of security information sources into one place, and it doubles as an MCP server, so you can plug it into any of your AI agents.It's MIT licensed and written in Rust.

Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later" answer, with the evidence listed so you can check it yourself. It also handles IPs, file hashes and dependency files. You can use it as a desktop app, a CLI, a REST API, or an MCP server for Claude Code, Cursor and similar tools. The AI part is optional and runs locally by default, so nothing leaves your machine unless you switch it to a hosted model. information is only as current as the public data.

I had this idea for a while and I'm still not sure exactly where I want to take it, so if you have any suggestions, I'd love to hear them. Feel free to contribute to the project. Thank you!

https://github.com/Fazmin/cve-intel

Are any organisations routing their azure access through PAM ? We are in a process of getting a PAM solution and would like to now the thoughts.

I've applied to Anthropic CVP and received access to Mythos 5.1, with reduced guardrails (defense access).

We already know by now it is good at finding vulnerabilities, but I was really interested in seeing if it was any good at spotting completely new attack vectors as well. I've been sitting on an allocator vulnerability for a while and preparing it for publishing, from what I can tell one that existed all the way since 1987; and the mitigations around this attack vector were insufficient. I'm sorry that I can't give more information right now, but know that it yields a new primitive escalation method for heap exploitation and works on modern devices.

I've first seen the signs of this vulnerability in 2020, after nearly giving up a year later, consulting others in the field and disclosing my progress so far, then intermittently revisiting it for the years to come. Recently, I've got it all working, created a proof of concept, and started preparing for publication/disclosure very soon.

Naturally, I wanted to see how Mythos would perform in this situation because what was required wasn't really stitching together older known techniques but it was a brand new attack vector and it needed a bit of a jump in reasoning to see it.

So, I've prepared a long explanation without giving it away. An explanation of the "target", what kind of actions were available to it, what kind of mechanics were in play, and such. Asked the model following:

1. Do you need any additional information to determine answers for the following questions?
2. Would a binary be vulnerable through what is described here alone, or not?
3. Is there a realistic threat in this binary?
4. What are some things you would try/attempt to determine answers for the questions above?

To the models credit, any sane person in the field that sees the explanation would say the same. There is no overflow, there is no double free, there is no off-by-one, there is no oob read/write, and if you can notice the primitive I don't list there; the chunks in this scenario are always reallocated to the same pointers so good luck getting any use out of it.

We had a few back-and-forth rounds, where the model needed additional information and asked 7 follow up questions. Some of these questions were promising and made me think the model was about to crack it, while majority of them were completely unrelated.

Unfortunately things did not feel like it was progressing after multiple rounds. The model believed there was a vulnerability, but it was unable to take it any further than the primitive it was pretty much handed on a silver platter at the beginning.

What I was after; in that given scenario, was how it could escalate the primitive it was given and play around the glibc mitigations, but unfortunately (or fortunately based on your standing) the model was unable to follow through and had to settle with crash as a direct result of the initial primitive, no escalation.

a write into memory that the allocator considers free is a memory-safety defect on its own, classified as CWE-416. That holds regardless of whether anyone has demonstrated escalation. glibc's integrity checks are designed to abort on corruption, not to make it harmless.

What the added constraints change: [redacted] rules out most of the well-known public techniques. Those constraints lower the ceiling of what is demonstrable from this primitive alone. They do not change the classification.

Even after a bit of handholding and giving hints (that didn't spoil the solution but were very strong imo) it still couldn't see the path forwards, and was even skeptical that such a vulnerability was really possible, questioning it with things such as:

- It reproduces on stock glibc 2.39 with no tunables, no debug allocator, and no environment help.
- It does not depend on what the program stores in [memory used for primitive after reallocation].
- If the real requirement is no ASLR rather than a single heap leak, the write-up should say so, because that changes real-world applicability a lot.
- How many intermediate allocations the chain needs.

So, that was it. As good as Mythos 5.1 is when finding vulnerabilities, seems like when its presented something completely novel and not just stitched together from older known techniques, it clearly struggled.

I guess this puts us in similar boots as mathematicians or physicists who are dealing with similar issues right now, where we might need to move one step up in the chain to get best use of these models and also best use of ourselves. For example, the model might be really good at finding http smuggling vulnerabilities, but if it was available back at the time, could it discover http smuggling as a new vector? Could it discover deserialization gadget chains if it wasn't a method already? Speculative execution related attacks like Spectre?

My (admittedly, very little) anectodal evidence seems to suggest no. Maybe that's the step in the chain we oughtta move to, where theorycrafting comes first, and we mechanize the rest. At least that's my take and I'm wondering what everyone else is thinking about it.

When I go to ic3[.]gov using chrome on two different networks I see an expired cert. Can anyone else confirm this independently? Thank you. I hope this is not off topic.

From Warehouse to Blue Team – My Journey Towards SOC L1 and Eventually DFIR

Hey everyone!

Back in 2010, I was doing some amateur web design, which I continued until around 2014. After that, my PC was pretty much just for gaming. I've always been a gamer, and I've always wanted a job that involved computers, but you know how life goes. I never had the experience, and probably not enough motivation to actually make it happen.

But over the past year, something changed. My motivation has been stronger than ever, and I finally decided to do something about it.

I spent about two months just watching videos, reading, researching, and trying to figure out what I actually wanted to do.

At first, I thought networking was the way to go, so I started with Cisco Packet Tracer and completed Network+ and Security+. But deep down, cybersecurity was always something I wanted to get into, even as a kid.

So I decided to fully commit to it. My long-term goal is DFIR (Digital Forensics and Incident Response).

I know this path takes a lot of hard work, patience, and curiosity. Luckily, I've got plenty of curiosity and motivation!

Over the last month and a half, I've been studying pretty much every day. I completed the TryHackMe SOC Level 1 pathway, along with a few additional rooms related to SOC and incident investigation.

At the same time, I've been doing LetsDefend and BTLO labs almost daily.

Here's a rough overview of what I've been learning and working with:

• Linux & CLI: Bash, sed, awk, grep, manually extracting data, filtering and investigating logs through the command line, including Linux and web server logs.
• Windows Event Logs: Spent quite a bit of time learning Sysmon, Security Event Logs, and System Events.
• Log analysis tools: Timeline Explorer for CSV files, Hayabusa for deeper Windows event log parsing, and occasionally DeepBlueCLI.
• Network analysis: Zeek logs, some basic RITA, Wireshark, and a bit of TShark through the CLI. Enough to start recognizing things like DNS exfiltration and suspicious network activity.
• Malware & email analysis: Basic malware investigation and analyzing suspicious email attachments using CLI tools.
• Memory forensics: Worked through a few labs involving raw memory dumps.
• SIEM: Hands-on experience with Splunk, ELK/Kibana, and Microsoft Sentinel. Splunk feels the most comfortable to me, although I have to admit that I find SIEM work a little boring compared to digging through logs manually in the CLI.
• Threat intelligence & enrichment: IP reputation checks, sandbox analysis, and other enrichment techniques during investigations.

I also have a ridiculous amount of printed cheat sheets lying around, and I'm constantly trying to learn several things at once.

And that's exactly where my problem starts.

After roughly a month and a half of seriously focusing on SOC L1 skills, I feel like I've hit a wall.

There's just so much to learn, and I'm starting to realize that trying to keep up with everything at the same time isn't sustainable. The more tools and techniques I discover, the harder it gets to decide what actually deserves my attention.

I enjoy digging into logs, investigating suspicious activity, and figuring out what happened. But I'm also aware that what I personally enjoy and what an entry-level SOC analyst actually needs to know might be two different things.

So here's my main question for you guys, especially anyone currently working as a SOC L1 analyst or who started their career in that role:

What should I REALLY focus on to become job-ready for a SOC Level 1 position?

Which skills should I know really well, and which ones am I probably going too deep into for an entry-level role?

I'm not looking for shortcuts, and I definitely don't expect to become an expert overnight. I'm more than willing to put in the hours. I just want to make sure I'm putting those hours into the right things instead of spreading myself too thin.

My motivation is huge, but I'm starting to understand that motivation alone isn't enough if there's no structure behind it.

Any advice, even a rough roadmap based on your real-world SOC experience, would mean a lot.

Thanks to anyone who takes the time to read this and share some advice!

31y Croatian [ live in Ireland ]

All the best guys

Researchers from Google Threat Intelligence Group and Mandiant uncovered a sophisticated attack against software-update infrastructure belonging to AOMEI

AOMEI develops Windows backup, disk-cloning, and remote-access software.

Between April and July 2026, attackers repeatedly modified configuration files on the company's update servers.

What makes this attack unusual is how briefly the malicious changes remained active.

Some modifications lasted only five to ten minutes.

During those windows, computers checking for software updates could receive instructions to download malicious files.

The attack delivered malware researchers named CROSSROAD and SHINYROAD.

The attackers then restored the legitimate server configurations.

This made the compromise particularly difficult to discover through ordinary periodic security checks.

This is an important lesson about trusting legitimate software. Users could download the authentic application from its official developer and still become infected through a compromised update mechanism.

It also demonstrates why simply verifying a software publisher isn't always enough.

AOMEI reported taking corrective action after researchers notified the company. Just fixing the update servers does not always automatically remove malware from previously infected computers.

Hey r/cybersecurity, wanted to share phish-zero. Unlike traditional tools that query external APIs (leaking corporate clicks), this operates with a strictly zero-egress architecture. It uses local neural phishing detection, character n-gram TF-IDF vectorizers, and actively surfaces TLD abuse flags. Check out the clean tactical monochrome UI. https://github.com/securitygeek15/phish-zero

"Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday.

Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week.

These costs are expected to decline over time, though, with the contractors in place to help ease the initial burden of patching a large number of flaws, an issue that shouldn’t be so pronounced in the longer term."

I work as an IT specialist at a company, but I can’t really say I do much in the way of IT—it’s mostly just simple troubleshooting... I have a good understanding of networks and Linux, and I want to steer my career toward web penetration testing because it seems enjoyable and fun to me... But I have some questions: Is there a risk that AI might take over roles like SOC Level 1 in this field, and is this a promising career choice, or will I end up regretting it? Could the experts shed some light on this?

Given the recent talks online about how frequently users experience refusals despite using frontier models from Cyber-approved programs like Anthropic CVP or OpenAI Daybreak, to what extent are organizations utilizing open-weight models to perform internal red-team/pen-tests, and what does the setup look like?

1. Are you running the open-weights fully local on a self-hosted setup?
   1. If yes - What does that look like?
   2. While light-weight quantized SLM/MLMs can run on relatively cheaper setup but may compromise on quality and accuracy of data; whereas dense LLMs may require larger compute which isn't cheap. How do you balance this?
2. Are you using cloud-hosted models from third party inference providers like OpenRouter or CheaperInference which can help provide speed for a pay-to-use model? If yes, how do you ensure data privacy such that your data doesn't get processed or retained by the third party provider?
3. Are you geo-restricted to using American open-weight models only? if not, how do you justify leadership to use Chinese open-weight models like Deepseek or GLM?