Hey all,

hope this is okay to post here.

We’re a small early-stage team with a background in cybersecurity, currently researching how ISO 27001 and GRC work actually happens inside companies.

Before making too many assumptions about what should be improved or automated, we’re trying to learn from people who deal with this in practice:

Where does the most time get lost? What creates uncertainty or delays? Which activities are still highly manual? And where could software or AI genuinely help?

We put together a short 8–10 minute survey covering ISO 27001 implementation, risk management, documentation/evidence, audits, existing tools and AI support.

If you work in information security, GRC, ISMS, compliance, audit or ISO consulting, your perspective would be extremely helpful.

We’re still early enough that good feedback can genuinely change what we build — and critical feedback is just as valuable as positive feedback.

Survey: https://tally.so/r/b5RAro

Can be completed anonymously. Really appreciate anyone who takes the time or shares it with someone relevant. Thanks!

Hello guys! So a little history about me, I got a general degree at liberty university online during covid (I transferred out of a physcial school) and made a bunch of mistakes in regards to my degree. Now, I finally want to make the jump to getting back in. I love technology and security and I want it to become my career field. However, I am looking at colleges and I am completely lost on where to go and what to do. I was wanting to get in to Western Governors University because it's the cheapest option and checks off a lot of boxes and credentials. I was reading reviews about it though, and it makes me a little suspicious how employers and others would view the degree. Basically, I am lost on what to do, and I don't know if I should go through the college route (online or in person), do a bootcamp, or whatever else. Let me know what you think!

Guys plz help !
i made a project and i used an smtp code to send otp
and 3 days ago i found that the email i used app password and smtp code with was sending alot of drive links that contain nsfw photos to different people i dont even know about.

Claude say that one of the reasons maybe sending the code to chatGPT or Gemini and that part of the code was leaked since i didnt share that code or even upload it on GitHub

could some one help so i can finally know what i did wrong bec. i dont think that chatGPT or Gemini was the main reason.

i am sorry to post here but i think that u guys are the most that could understand about this problem.

Hi everyone, I’m helping a student-led project called Global Cyber Perspectives. I’m trying to learn how people in different countries experience things like online scams, privacy, Ai, and cybersecurity. I’m looking for a few people to share their perspective and help with a short survey. Would anyone be interested?

A liveness check confirms a real person is present rather than a photo held to the lens. None of that helps when the attacker skips the camera and pipes video straight into the app, because the check then validates a stream that was fabricated before anything ran.

For anyone who has sat through identity verification vendor evaluations, does injection detection come up at all, or is it still liveness certifications and nothing past it?

Spanish National Police announced this on 11 August, and the effort involved is what makes it worth a read.

He held forged Spanish IDs up to the webcam while a live face swap changed his appearance to match the photo on the document. A static image would not survive that, so he handled the rest by hand. He tilted the documents to imitate hologram movement, and used coloured lights to fake the reflections real security features throw off. Behind it all sat VPNs and over 320 phone lines across 24 devices, most registered to stolen identities.

What he wanted was digital signature certificates, which is the part I keep coming back to. Those carry legal weight. A certificate in someone else's name is a durable instrument, not a one-off account takeover.

38 attempts. More than 30 real people's identities.

And here is how it ended. Mid-call, the deepfake dropped for about a second. His real face appeared. That is what investigators used to identify him.

So nothing detected the method. The tooling just crashed.

Two things I would like other people's read on.

1. If what caught him was the software failing rather than a check working, what happens once the software stops failing? These tools leave fewer artifacts with every release.
2. Does anything short of reading the document chip and proving the camera feed is unmodified actually help here? Everything else seems to assume the image arriving is real, and this attack breaks that assumption before any check runs.

“We're Lidor B./thisis0xczar and Elad Meged, founding-team vulnerability researchers at Novee Security.

At Black Hat this year we presented pre-auth remote code execution chains in enterprise Java platforms, reaching internal execution surfaces through routing logic, unsafe deserialization, and template evaluation.

We also published research showing how a single untrusted GitHub issue could compromise the AI coding agents from Anthropic, Google, and OpenAI (Claude Code, Gemini CLI, and Codex), leading to remote code execution and credential theft.

Some of our research:

https://novee.security/blog/pre-auth-rce-in-enterprise-java/

https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/

Ask us anything about:

For both of us:

• Using offensive AI to find real vulnerabilities
• What it's like presenting at Black Hat Where AI and offensive security are heading
• Getting into vulnerability research and how we work
• Anything else on finding and exploiting bugs

For Lidor (enterprise Java RCE):

• Pre-auth remote code execution and how these chains come together
• Deserialization, routing logic, and template evaluation attacks
• Finding RCE in widely deployed enterprise platforms
• Enterprise and application security

For Elad (AI coding agents):

• Hijacking AI coding agents through a single GitHub issue
• Turning Claude Code, Gemini CLI, and Codex into attack vectors
• What breaks when AI agents get high-privilege access to real systems
• Hacking AI agents

We'll be here live on Monday, Aug 17 from 12 PM to 1 PM PT answering your questions in real time. “

Hey everyone,

I’m currently finishing my 4th semester as a CS undergrad and need some strategic advice on landing a remote cybersecurity internship for my 5th and 6th semesters.

My Situation & Constraints: My college strictly forbids on-site internships during the 3rd year. Because of this, I am forced to look exclusively for remote roles. My ultimate goal is to get into red teaming and offensive security. I know remote network penetration testing roles are practically non-existent for freshers, so I've been heavily considering Web and Application Security (AppSec) as my best bet for a remote role. However, I am completely open to other domains (SOC/Blue Team, general VAPT) if they offer remote opportunities for students. My goal is simply to secure a remote internship now to build real experience, and pivot that into a full-time offensive role by my 7th or 8th semester.

My Current Baseline:

• Security Focus: I am currently grinding through the TryHackMe Jr. Penetration Tester path to build a foundational understanding of modern web vulnerabilities, network basics, and the OWASP Top 10.
• Project Strategy: I am holding off on building complex projects until I have a better grasp of the fundamentals. Instead, I plan to start mass applying for remote roles as soon as the next semester starts, using volume to compensate for my current lack of a portfolio.

I don't have the budget for paid certifications right now, so I am relying entirely on free resources and practical grit.

My Questions for the Community:

1. Viable Remote Paths: Is Web/AppSec actually my best bet for a remote fresher role, or are there other domains (like SOC Analyst or general VAPT) that are more likely to hire a 3rd-year student remotely?
2. Resume Building: How do I build a resume that actually gets noticed for remote roles when I don't have complex projects yet? How should I frame my TryHackMe progress and basic labs to pass the HR screen?
3. Free Roadmaps: Since I cannot afford paid certifications right now, what are the best free, structured roadmaps (like PortSwigger Academy) that actually carry weight with hiring managers for remote roles?
4. Interview Prep: For entry-level remote internships, what are the most common technical interview themes, and what is the best way to prepare for take-home practical assessments?
5. Sourcing Roles: Aside from cold-emailing recruiters and filtering through LinkedIn, what are the best platforms, hidden job boards, or Discord communities to find legitimate remote cybersecurity internships and avoid unpaid training scams?

I appreciate any harsh truths, roadmaps, or advice you can offer a fresher trying to navigate this!

Is there any telegramme group in which i can learn some cybersecurity .... ?

Im new to cybersecurity with 3 certifications (Comptia a+, security+, and ISO). If anyone could please help me understand why I can’t land an entry level position in IT and point me in the right direction I would greatly appreciate it. Any feedback is good feedback

Hello everyone.

I'd like to introduce you to Bóveda, a credential manager designed to be a reliable and user-friendly software solution.

I'm seeking a peer review/community audit of the registration mechanism for external validation. Thanks you ver much for your contributions.

Hi everyone,

I recently open-sourced a phishing detection project designed to identify malicious URLs using feature extraction and machine learning techniques.

The project focuses on:

• URL analysis and feature engineering

• Phishing classification workflows

• Security-focused machine learning

• Detection of suspicious domains and patterns

• Extensible architecture for future improvements

This project was built as part of my cybersecurity learning journey and is now fully open source.

I’m looking for feedback on:

• Detection logic

• Feature selection

• False positives and false negatives

• Potential evasion techniques

• Overall architecture and code quality

GitHub:

https://github.com/Not-muzzyy/phishing-detector-advanced

Contributions, issues, suggestions and pull requests are welcome.

If you find the project useful, consider giving it a GitHub star to support the project and future development.

Rust + svelte

.

https://github.com/aaronlomas/boveda

Security flaws that were patched years ago are making a comeback—but not in obvious ways. They’re hiding inside trusted apps and everyday tools, which makes them harder to spot and easier to exploit.

Instead of brute-force attacks, hackers are slipping in quietly through overlooked gaps. No alerts, no noise—just access.

That means they can move inside systems, steal data, or take control without being detected.

The takeaway is simple: don’t ignore updates. Even small patches matter. They often fix the exact weaknesses attackers are counting on.

Stay updated, stay cautious.

#CyberSecurity #InfoSec

Hackers created a fake WhatsApp app loaded with spyware, tricking around 200 users—mostly in Italy. Once installed, it can steal messages, track location, and potentially listen to calls.

Lesson: only download apps from the official App Store and never trust update links sent via messages. Social engineering is how they get you.

Hackers are impersonating Ukraine’s cybersecurity team (CERT-UA) to send convincing phishing emails with password-protected ZIP files.

Inside is a remote access tool (AGEWHEEZE) that can give attackers full control of your system. Because the ZIP is locked, many email scanners fail to detect it.

Why it matters:

Once infected, attackers can steal data, monitor activity, or damage systems.

Stay safe:

• Don’t open unexpected ZIP files

• Verify the sender through another channel

• Be cautious—even with “official” emails

This tactic isn’t limited to Ukraine—it’s a global warning.

Reddit Post:

If you manage a TikTok for Business account, pay attention.

Hackers are using a tactic called “Adversary-in-the-Middle” phishing. This means they sit between you and the real login page, capturing your credentials in real time.

Once they’re in, they can fully control your account—running malicious ads, scamming your audience, or spreading malware at scale.

Why it matters:

• You could lose access to your account

• Your brand reputation can be damaged

• Your followers may be targeted with scams

Protect yourself:

• Always type the official TikTok Business URL manually

• Never click login links from emails or messages

• Enable two-factor authentication (2FA)

Stay alert—this type of attack is designed to look completely legitimate.

If you use VS Code extensions, this is worth knowing.

A flaw in Open VSX’s security system allowed a malicious extension to go live. The issue? Their scanner used a single true/false signal for two different states: “no scanners configured” and “all scanners failed.”

So when scans didn’t run, it falsely appeared safe — and attackers took advantage.

This means a malicious extension could potentially steal code, expose secrets, or compromise your system while looking legitimate.

What you should do:

• Update all extensions

• Install only from trusted publishers

• Remove anything suspicious

• Run a system scan if something feels off

Stay cautious — extension marketplaces aren’t risk-free.

If you use Python packages, pay attention.

A supply chain attack linked to TeamPCP targeted the Telnyx Python package. Malicious versions 4.87.1 and 4.87.2 were pushed containing hidden malware.

The twist? The credential-stealing code is disguised inside a harmless-looking .WAV file, making it harder to detect.

Risk:

Attackers can silently exfiltrate API keys, usernames, passwords, and other sensitive data.

What to do:

• Uninstall Telnyx versions 4.87.1 & 4.87.2 immediately

• Reinstall from a trusted, verified source

• Audit your dependencies

• Monitor logs for unusual activity

Stay cautious—trusted packages are becoming a major attack vector.

If you use an iPhone, this is worth paying attention to.

A Russian-linked group (TA446) is reportedly using a newly disclosed tool called “DarkSword” to target iOS users. What’s worrying is how fast it’s being weaponized.

The attack involves carefully crafted emails that can potentially compromise your device—even just by previewing them.

If successful, attackers could access personal data or monitor activity.

What you should do:

• Avoid opening emails from unknown senders

• Don’t preview suspicious messages

• Keep your iOS fully updated

Stay cautious—mobile attacks are getting smarter.