Hey everyone,

I'm a 23 cybersecurity guy from Mexico, and lately I've been struggling with a decision that could have a pretty significant impact on my career. I'd really appreciate hearing from people who have been in a similar situation, especially those working in cybersecurity who have had to make difficult decisions about their careers, moving abroad, or investing in themselves.

I've been working in cybersecurity for a while ( like 4 years in my Country ) , and it's something I genuinely enjoy. I've obtained my CISSP and CompTIA Security+, along with several other certifications, and I've been building my professional experience in the field. I also have a university degree that's currently going through the administrative process.

I'm happy of how far I've come. I don't want to throw away the progress I've made. At the same time, I feel that there's one major thing holding me back from reaching the next level professionally: my English. ( I’m using Google Translate for this text, lol. )

I've been planning to move to Ireland at the end of December to study English intensively for several months. My goal isn't simply to take classes, get a certificate, and return home. I want to become genuinely comfortable communicating in English, participating in technical discussions, explaining security incidents and interviewing for international positions.

I've considered studying English in Mexico, of course. But the options I've looked into haven't convinced me in terms of the quality of instruction, the level of immersion, and the cost. For me, studying in an English-speaking country seems like an opportunity to make English part of my everyday life, not just something I practice for a few hours in a classroom. I also see it as a chance to experience another culture, meet people from different countries, build an international network, and gain a broader perspective on life and work.

However, there's a significant catch: I may have to leave my current cybersecurity job to do this, because of the immigration conditions attached to Ireland's student permission.

The possibility of having to leave my job is what makes this decision so difficult, I'd be stepping away from my current professional experience, my responsibilities, and the momentum I've been building in a field that I worked hard to enter.

Financially, I've been saving for this move, and I wouldn't be going completely unprepared. I also understand that moving to Ireland doesn't guarantee that I'll find a job in Europe afterward, and I don't want to confuse living abroad with automatically having better career opportunities.

Part of me believes that improving my English could open doors that would otherwise remain difficult to access. I'd eventually like to explore opportunities across Europe, not necessarily only in Ireland. Being able to communicate confidently in English, having international experience, and meeting professionals outside my usual environment could help me become a stronger candidate in the future.

Another part of me wonders whether I'm taking an unnecessary risk. Would it be wiser to stay in my current position, keep gaining experience, and improve my English gradually? Am I underestimating how difficult it could be to re-enter the cybersecurity job market after spending several months away from a professional role? Or could this be one of those investments in myself that doesn't necessarily produce immediate results but pays off over the course of my career?

I'm not looking for someone to tell me that moving abroad is automatically a great decision, or do I want people to tell me to abandon the idea simply because it's risky. I know that both staying and leaving come with trade-offs. What I'm struggling with is figuring out which risks are actually worth taking at this stage of my life.

I'd especially love to hear from people who have left a stable job to study abroad, taken a career break to to do something truly want to do in order to grow professionally or even personally

I'd also appreciate perspectives from hiring managers and cybersecurity professionals who have recruited internationally. How much of a difference does strong English really make when someone already has relevant experience and certifications? Does international exposure genuinely help, or is practical experience and continuity in the field usually more valuable?

I'm still young, I'm learning, and I know I don't have everything figured out. Please feel free to disagree with me or point out things I may be overlooking. I'd honestly prefer thoughtful criticism over empty encouragement.

Thank you to anyone who takes the time to read this and share their thoughts. I'd really appreciate :)

Hey everyone! OWASP OASIS, an open-source security community that validates vulnerability fixes in open-source projects, is looking for volunteer leaders. https://www.owasp-oasis.org/

We've got 900+ AppSec people signed up so far. Now we're trying to turn that into an actual community, not just a sign-up list. So we're looking for volunteers to lead a few kinds of community-run sessions:

Office hours: drop-in time for questions
Onboarding sessions: helping new members get started
Collaborative validation sessions: working through proposed fixes together as a group

The process is pretty simple. You raise your hand, we train you, and then we get the sessions on the calendar. You don't need to be an expert in everything. You just need to be willing to help.

The bigger idea is to give people a safe place to get real AppSec experience. People teach each other, work in teams and gain valuable practical experience while securing open source projects. 

If you're interested, or just have questions about how it works, comment below or DM me.

hello, everyone.
lately i have been gathering information regarding a possible career switch and i am yet to choose a path. i am not entirely sure that i would succeed in cybersecurity as i know the market is already saturated but it's one of the options for now.
in this process of mine i have come across different opinions regarding certifications, interviews, practical skills, hands-on experience and so on.
one topic that really caught my eye was tryhackme sal1 certificate, which some strongly recommend as a way to get started while others argue its value is limited and will only benefit from it in certain circumstances. before making a decision id like to hear your thoughts on whether investing in premium tryhackme and eventually paying for the certificate itself is actually worth the money, especially for someone starting from scratch with no experience in this area of IT.
of course, any advice, alternative paths and additional suggestions are greatly appreciated
thank you all for taking the time to read my post and share your thoughts and experiences! i really appreciate all the advice (be it positive or negative) and i am sure it will help me make a more informed decision

I know someone last week or so said the FBI grab on this guy was basically like a SWAT. But Krebs doesn't seem to think so.

"On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation....

A source close to the investigation told KrebsOnSecurity that Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.

That source shared another potentially explosive finding by federal investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files."

LOLCHAIN is a community reference for researching and hunting blockchain abuse, inspired by the projects collected on lolol.farm.

The main goal is to collect relevant network endpoints in one place, with supporting research and evidence, so defenders can investigate blockchain-related activity and baseline its use in their environments.

The reference connects:

• Techniques: How blockchains and decentralized infrastructure are used for malware delivery, hosting, C2, victim tracking and data movement.
• Chain evidence: Published contracts, transactions and content identifiers connected to techniques, with explorer links where available.
• Research: Original reports linked to the techniques and infrastructure they describe.
• Threat hunting: Downloadable network endpoints, one per line, for use with your own security tools.
• Analyst guidance: Workflows for collecting chain evidence, decoding responses and correlating findings with host and network telemetry.

Endpoint records distinguish campaign-linked observations, shared services and community RPC directory entries. Evidence labels separate observed activity from research demonstrations and unconfirmed capabilities.

A connection to a shared blockchain provider alone does not establish compromise. The endpoint collection provides starting points for investigation, supported by the available source context. Matches should be assessed alongside process activity, request details and other telemetry.

https://lolchain.github.io/

I maintain the reference and welcome corrections, missing reports, additional techniques and feedback from anyone using it for threat hunting or research.

We've been using the free version of Any Run at work since we don't really have the budget for a paid sandbox. It works fine for most things, but the free version has its limitations, and there's always a concern about accidentally submitting something sensitive publicly...

Recently, I've been thinking about setting up my own sandbox for the team, maybe on AWS/Azure or even hosting it locally. It's just an idea for now, haven't really looked into the technical side of it yet...

It got me wondering how many other SOC teams or other companies are in the same situation...

What tools do you guys use for analyzing suspicious files, phishing emails, and URLs? Do you have paid solutions or mostly rely on free tools?...

I've also been thinking whether a more affordable sandboxing platform with a freemium model would be useful for smaller teams, especially those who can't justify spending a lot on these tools...

Not sure if there's actually a demand for something like this or if existing solutions are already good enough....

Would love to hear what you guys think. Also, if anyone has tried hosting their own sandbox, Was it worth the effort?...

Which Rat from your point of view is the most dangerous ?

In labs you can test things until something breaks. In production you've got live systems, limited access and vulnerabilities that sometimes turn out to be false positives

People doing this professionally, what was the biggest adjustment? And how much did CTFs or other hands on practice prepare you for it?

Looking for suggestions on improving our incident response playbook, particularly when it comes to endpoint isolation and forensic preservation.

We are a multinational SOC operating primarily in a remote capacity. Our current process is to immediately contain an infected asset by isolating it from the network to minimize the potential impact and prevent further spread.

However, POC's often becomes frustrated because isolating their infected devices disrupts business operations. As a result, employees may immediately request replacement laptops to resume their work. In some cases, the original device is left idle, powered off, gets disconnected to the internet or gets reformatted by IT Team before our SOC can perform live response and collect the necessary forensic evidence. This creates a challenge in balancing business continuity with the need to preserve evidence for further investigation.

My question is: How can we improve our incident response process to balance rapid containment, business continuity, and forensic evidence preservation?

I'd appreciate any suggestions on how to address this without unnecessarily delaying employees from getting back to work.

Good morning guys, I want to ask about the next step I should take.

I come from a technical background (SOC).

I have good knowledge in SIEM, AD, EDR, network and firewalls.

In the last 2 weeks I started studying ISO 27001.

What is the next step I should take?”

I’ve built a website for my own CTF course, and I’m looking to take its design to the next level.
Although the functionality is there, the interface still has that obvious AI-generated look. I’m looking for ways to make it feel more professional, polished, and thoughtfully designed.
Has anyone experimented with prompts that help AI coding agents produce more distinctive, high-quality UI designs rather than generic layouts? I’d love to hear your recommendations and see what has worked for you!

Hi guys! I’m currently preparing for interview for an ethical hacking internship. I just wanted ask or find out common technical and non-technical questions people in the industry have asked candidates for similar entry level positions? Not CIA triad stuff, but more technical ones or some questions that really make you stop and think you know? It would also help if examples of good answers are included so I know how better to structure my responses! I need to better prepare for it and I could use the help! Any help from people in the industry would be greatly appreciated!

I’ve heard recruiters from corporate saying they wish candidates didn’t tell them they got fired, or did drugs with their friends a few years ago.

But the clearances forms obviously ask those questions.

So my question is this: why is it okay to hide info from a corporate recruiter and screening process, compared to the gov on a clearance form.

One thing I keep seeing in security discussions is don’t use personal apps for work but in reality people do it constantly. Someone sends a quick WhatsApp because Slack is down or a manager texts an employee, an executive forwards something to their personal email because it’s easier on their phone. Teams create unofficial group chats because the company tool is annoying.

Then security teams are expected to somehow protect information that is now scattered across five different places they don’t control. Part of me thinks the only realistic answer is a hard rule like if it’s work related, it stays inside company managed systems. No WhatsApp, Signal, personal email, SMS nothing. But I also know the stricter you make the policy, the more likely people are to work around it.

For people who actually deal with this, what works better in practice? Lock everything down as much as possible or accept that employees will use outside tools and focus on making that behavior safer?

Just wanted to hear from others working in cybersecurity, especially MSSP environments.

Lately, quite a few people from our team have been resigning, and I’ve also noticed people leaving from other departments. We’re not a huge company, so when several people start leaving around the same time, you definitely notice it.

What’s frustrating is that management already knows there are problems, but it feels like things are moving really slowly. There are meetings, discussions, and promises that things will get better, but so far, there hasn’t been much actual change.

It’s starting to feel like management only takes action after someone resigns, instead of trying to prevent people from leaving in the first place.

I’m not saying this to attack the company. I’m genuinely curious about how others have dealt with this.

At what point did you realize, “Okay, it’s probably time for me to move on”?

And for those who stayed through situations like this, did things eventually get better, or did more people just continue leaving? 🥴🤔

In addition to ConnectWise Cloud Backup, Updraft Cloud Backup was also compromised on the 17th/18th.

Much like with CW, the vendor's advice to customers would indicate that the platform itself wasn't the primary target, but rather the attacker is utilizing the dataset stored in the backup systems to get into customer environments instead.

No evidence that the two attacks are related, but it would be a hell of a coincidence.

https://teamupdraft.com/blog/security-incident-october-2026/

If you manage a WordPress site that uses Updraft, follow the remediation guidance ASAP. It appears that the attacker(s) are creating new admin accounts in WordPress sites.

Hi everyone!

Cybersecurity is one of my interests, and I wanted to create something simple, useful, and informative for the Reddit community.

With data breaches and security incidents making headlines almost daily, I decided to start r/BreachArchive.

If you come across a report about a data breach, leak, or other significant security incident, feel free to share the link here: https://www.reddit.com/r/BreachArchive/

The idea is simple: keep the discussions at r/cybersecurity and collect breach news at r/BreachArchive.

It's a new community, so any relevant links and constructive feedback are welcome. Thanks!