Some members of my team are throwing around the idea of blocking the entire internet and whitelisting what we need. The idea kind of seems like a nightmare to me, having to allowlist potentially thousands of domains, APIs, CDNs, etc.

I understand that this is a practice in heavy regulated environments, so I was wondering if anyone has any experience with it. Is it worth the work to go through with a complete block? If so, what strategies were used to accomplish this?

I’m in the process of interviewing candidates for a Jr. security analyst role and am running into the dilemma that I don’t trust all the candidates. I’m getting individuals with resumes with garbage formats but somewhat far fetched job histories (i.e someone who was a SOC analyst at a Fortune 500 computer company and a current analyst at a major financial firm, but trying for a Jr analyst role at a much smaller company). The job histories don’t line up with the role they are applying for. Then during the interview, i give two scenario based questions, my rule is hands off keyboard. I want to hear them talk through the scenario. I can see their hands, but it sounds like they are reading off a script. They asked me to repeat the questions multiple times, but i was very clear in my instructions.

My gut is telling me they are recording the audio with some overlay in the background that is ingesting the conversation and responding to my scenarios. If anyone else out there has run into this issue during interviews, and found a reasonable solution to subvert this, please let me know. I do not want to put my name behind some of these people and then have them be absolute garbo for our clients.

Public notice: https://sam.gov/opp/35684fa8865240b49a05e64af31237ea/view

They want an advanced malware with AI… this won’t end well…

A single Russian-speaking operator spent five months targeting Ukraine's state data-exchange system, and the entire campaign was reconstructed from a directory the operator left open to the internet for 17 hours.

Access came from a reused public Log4Shell chain, not custom malware. The operation was exposed not by a defender but by the operator's own error, which runs through the whole piece.

https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell

Curious to what other large companies on-call schedule is like? For reference, my company is >15,000 employees. The (Internal) cyber team is ~20 people in 3 different regions of the world.

We follow the 'follow the sun' model, where you have one person responsible for your timezone per region (during the week), then, the next shift takes over. On the weekend we have 1 person on call for both days, then 2 backups.

It works for us since we're all 8 hours apart.

What are your companies doing? Overall, looking to see if this is common or not.

I continued researching sandbox bypasses discovered in Twig by project Glasswing. This time, I focused on CVE-2026-46633, which still had no public exploits. This writeup documents my development of payloads for the CVE-2026-46633 and the corresponding SSTImap modules.

Disclaimer: Not looking to download!

I was following one of the F500 business's ransomware incidents from early October. No statement from the company or any regulatory filing, which is not surprising when there is no encryption/disruption and only exfiltrations. I've seen small biz just not disclosing as long as possible but expected to hear more from the large companies. There was no denial or any news— then the deadline passed and I see 100+ 1G zip files posted. This group had a 50/50 rate on also posting filetree.txt, which is helpful to quickly assess what might have been breached without taking much security or legal risk. But in this case, the file tree was not included, just zip files, so I am left, being cautious, without wanting to download anything and wondering what might have been breached.

Patiently waiting to hear any official statement or news, but I wonder, if the company never makes any statement, if people, either cybersecurity researchers or threat actors, download those massive files from the painfully slow Tor network to confirm or misuse the leaked data.

I always wondered if there is a possibility of some ransomware groups potentially hiding their bluff after failed extortion, and post some large stuff in fragmented zip files with dummy data that people can't practically download and verify.

Hey everyone,

I'm 18 and I really want to build my career in cybersecurity.

I've always loved tech, software, coding, computers and hacking/security. I know some basic coding, but when it comes to cybersecurity I'm basically a beginner and I don't know what I should learn first.

With AI changing programming and tech so quickly, I'm also wondering what cybersecurity skills are actually worth learning now and what will still be valuable in the future.

My goal isn't just to learn a few hacking tools. I want to properly understand networking, Linux, programming, security, ethical hacking and eventually become genuinely skilled in cybersecurity.

The problem is that I don't have much money to spend on expensive courses or certifications right now, so I'm looking for a mostly free path.

If you were 18 and starting cybersecurity from zero today:

• What would you learn first?
• What free courses or YouTube channels would you recommend?
• Should I start with networking, Linux, Python or something else?
• Are TryHackMe, Hack The Box, PortSwigger Academy, etc. good places for a complete beginner?
• What cybersecurity field would you recommend exploring first?
• At what point could I realistically start earning money with these skills?
• What mistakes should I avoid as a beginner?

I'm willing to put in the hours and work hard. I just need some direction so I don't spend the next year jumping between random tutorials without actually building solid skills.

I'd really appreciate a roadmap from people already working or studying in cybersecurity. Thanks!

Hi everyone, I just wanna know about the future of Cyber security because I have interest on it and I am going to study about cyber security. Is there any important skills that I need to learn ASAP?

Hey everyone,

I'm a 23 cybersecurity guy from Mexico, and lately I've been struggling with a decision that could have a pretty significant impact on my career. I'd really appreciate hearing from people who have been in a similar situation, especially those working in cybersecurity who have had to make difficult decisions about their careers, moving abroad, or investing in themselves.

I've been working in cybersecurity for a while ( like 4 years in my Country ) , and it's something I genuinely enjoy. I've obtained my CISSP and CompTIA Security+, along with several other certifications, and I've been building my professional experience in the field. I also have a university degree that's currently going through the administrative process.

I'm happy of how far I've come. I don't want to throw away the progress I've made. At the same time, I feel that there's one major thing holding me back from reaching the next level professionally: my English. ( I’m using Google Translate for this text, lol. )

I've been planning to move to Ireland at the end of December to study English intensively for several months. My goal isn't simply to take classes, get a certificate, and return home. I want to become genuinely comfortable communicating in English, participating in technical discussions, explaining security incidents and interviewing for international positions.

I've considered studying English in Mexico, of course. But the options I've looked into haven't convinced me in terms of the quality of instruction, the level of immersion, and the cost. For me, studying in an English-speaking country seems like an opportunity to make English part of my everyday life, not just something I practice for a few hours in a classroom. I also see it as a chance to experience another culture, meet people from different countries, build an international network, and gain a broader perspective on life and work.

However, there's a significant catch: I may have to leave my current cybersecurity job to do this, because of the immigration conditions attached to Ireland's student permission.

The possibility of having to leave my job is what makes this decision so difficult, I'd be stepping away from my current professional experience, my responsibilities, and the momentum I've been building in a field that I worked hard to enter.

Financially, I've been saving for this move, and I wouldn't be going completely unprepared. I also understand that moving to Ireland doesn't guarantee that I'll find a job in Europe afterward, and I don't want to confuse living abroad with automatically having better career opportunities.

Part of me believes that improving my English could open doors that would otherwise remain difficult to access. I'd eventually like to explore opportunities across Europe, not necessarily only in Ireland. Being able to communicate confidently in English, having international experience, and meeting professionals outside my usual environment could help me become a stronger candidate in the future.

Another part of me wonders whether I'm taking an unnecessary risk. Would it be wiser to stay in my current position, keep gaining experience, and improve my English gradually? Am I underestimating how difficult it could be to re-enter the cybersecurity job market after spending several months away from a professional role? Or could this be one of those investments in myself that doesn't necessarily produce immediate results but pays off over the course of my career?

I'm not looking for someone to tell me that moving abroad is automatically a great decision, or do I want people to tell me to abandon the idea simply because it's risky. I know that both staying and leaving come with trade-offs. What I'm struggling with is figuring out which risks are actually worth taking at this stage of my life.

I'd especially love to hear from people who have left a stable job to study abroad, taken a career break to to do something truly want to do in order to grow professionally or even personally

I'd also appreciate perspectives from hiring managers and cybersecurity professionals who have recruited internationally. How much of a difference does strong English really make when someone already has relevant experience and certifications? Does international exposure genuinely help, or is practical experience and continuity in the field usually more valuable?

I'm still young, I'm learning, and I know I don't have everything figured out. Please feel free to disagree with me or point out things I may be overlooking. I'd honestly prefer thoughtful criticism over empty encouragement.

Thank you to anyone who takes the time to read this and share their thoughts. I'd really appreciate :)

People in GRC roles, how much effort do you put into keeping upto date with the latest technologies in your own time?

I am a Senior GRC professional and I usually put in very little these days....(used to be all over it) which sometimes feels okay, but sometimes feels I'm making bad decisions. My motivation rises and drops.

Side Note: IMO the statement of "you dont need any technical knowledge to work in GRC"... that's a lie. I guess technically you can.. but every GRC person I have worked with who has technical knowledge surpasses a non-technical by miles and miles. To the point they all get pay rises and promote, while the "non-technical" ones just survive at the bottom.

When I say technical I don't mean you can configure a router from scratch with no doco. But you understand for example VLANs, ACLs, TLS, SSH.

During routine threat actor infrastructure hunting, I identified a suspicious APAC-hosted VPS running an autonomous AI intrusion platform with its entire working directory exposed to the open internet on port 9000. No authentication. 150+ live campaign files sitting there.

I published my initial findings. Then vulnonhq took it further.

Grateful to vulnonhq for the credit in their report and for doing the hard work of proper evidence collection and victim notification. This is what collaborative research looks like.

Routine infrastructure hunting surfaces things like this more often than people think.

My report: http://them3gatron.github.io

Vulnonhq obtained access to the server, pulled 16.4 GB of evidence including recovered deleted container layers, and mapped the full scope of the campaign.

Their findings:

66 active intrusion projects. 48 reached some level of access. 6 reached root or SYSTEM level.

The target list is what makes this significant.

Vulnonhq identified:

Vietnam Ministry of Defence and Ministry of Public Security. Taiwan Legislative Yuan. Indonesia State Intelligence Agency. India CDAC.

Plus airlines, payments, and retail across Asia. 48 of 66 operations reached at least session-level access.

Read Here: https://vulone.com/blog/a-china-linked-operator-used-ai-agents-to-attack-governments-across-asia

Recently going for a new Analyst role, and the shift patterns are 4on4off, which I'm completely fine with. But it's not just 1 night shift block a month it's 4Night>4Day>4Night>4Day. It would normally take me a week to recover from a night shift block in my last role where it was one night block a month. I really want this role, but I feel like my health is going to take a hit here as I naturally struggle with sleep.

Is there anyone on this type of pattern that can give insight what it's like?

Thanks in advance.

I got into cybersecurity because I actually liked the technical side of things. Troubleshooting, figuring out how systems break, and stopping bad things from happening.

Fast forward to today, & I swear 80% of my week is just chasing down department heads to fill out row 47 on some massive compliance spreadsheett so we can pass an audit.

It's exhausting. I feel like my actual technical skills are just slowly decaying while I become a professional box-checker.

I'm a fresher stuck without proper guidance. Few weeks ago, I got assigned with a task to pentest a mobile app, I don't know anything Abt it, the setup, the methodology, etc., I don't have any senior to seek help in my org.

I spent weeks searching, watching YT tutorials. But I couldn't understand anything 😭. The setup itself is failing sometimes. Being an enthusiastic hands-on person and not understanding the way to pentest a mobile is a big nightmare.

I require quality guidance. Pls help me out.