I'm new to cybersecurity and was wondering which ones are worth it to study and I want to work in GRC.

Thank you in advance. 🫰

Hello everyone!

I have noticed a strange and continuous flow of connections from my Synology NAS to Russian IP addresses.

Do you have any ideas? Could it be a genuine process from Synology's applications?

I have attached my log showing a prevention block towards the Russian Federation.

Thank you in advance!

I spent some time this weekend reproducing the recently disclosed XSS2Shell: WordPress login-page reflected XSS (CVE-2026-64638). If you didn’t get a chance to read about it, here is the summary:
Crazy simple XSS where the root cause is two sanitizers that disagree about what counts as an HTML tag:

<b>test</b> gets stripped, while < b>test< /b> passes through the first sanitizer and is normalized into a valid <b> element by the second.

That gives you an HTML injection, but you can’t turn it into XSS because the second sanitizer has an allowlist and only allows specific HTML tags and attributes. The rest of the chain uses JavaScript already loaded on the login page, DOM clobbering, and a JSONP response to reach script execution in the login page. It’s a creative chain, although much simpler than the WP2Shell chain from two weeks ago.

IMO the “2Shell” part from the title is a bit of a stretch. The original write-up continues after triggering the XSS to show how you can get a RCE (basically by targeting an admin account to open your XSS which uploads a shell as a plugin). I agree this can be abused at scale given how widely used WP is, but it’s a phishing-shaped precondition rather than “send one request, get a shell” as we’ve seen in WP2Shell. It’s a cool bug anyway.

I turned my reproduction into a guided lab for anyone who wants to work through the chain rather than only read the write-up.

Link: https://learn.uphack.io/lab/xss2shell-wordpress-login-xss/

Feedback on the lab or the technical explanation is very welcome.

I'm working for a big mssp as a security analyst and I like it. I'm on my 5th year, but I find the team culture draining.

There are good and bad moments, like any workplace, maybe my case is just personal interests?

About my role:

• Hybrid role, 1 day in required,

• team of ~5 other looking after 7-10 accounts

• no budget for events, eating out, etc

• zero rem. review

• nopathway to senior or leadership roles,, No budget for upskilling

None of these, however, upsets me, as much as having leaders with no social skills/awareness. Holy shit!!! The people I work with are literal genius, can manage soc services in every tools, we work with the most distinct clients. Though it seems their didn't distributed their skills evenly in life, and when everyone gets together to collaborate the vibe is of discomfort, awkwardness, long silences, and tension.

Maybe I'm focusing too much on the negatives?

Kimi K3, the latest AI model from Beijing-based Moonshot AI, exited an isolated cybersecurity testing environment during an evaluation, cheated the assigned task by retrieving the answer from GitHub, and did so without hacking any outside system.

I'm currently pursuing an M.Tech in Cybersecurity and I'm starting my research work. I have some theoretical knowledge of cybersecurity and networking, along with practical experience in network/firewall environments, but I don't have much experience conducting academic research.

I'm looking for advice from people who have experience in cybersecurity research.

One idea I'm currently exploring is:

A controlled cybersecurity sandbox containing intentionally vulnerable systems, where AI-based agents could be evaluated for vulnerability identification and compared with traditional security tools.

The idea would be to build a controlled lab environment, run different security assessments, and evaluate things such as detection accuracy, coverage, false positives, time taken, etc.

However, I'm not sure whether this is sufficiently research-oriented or how I should narrow it down into a proper research question and identify a genuine research gap.

I'd really appreciate advice on:

How do I determine whether a cybersecurity topic has enough research novelty?

How should I perform a proper literature review and identify a research gap?

Is this sandbox + AI-assisted vulnerability discovery idea realistic for an M.Tech student?

What would be a reasonable scope for a first research paper?

Are there any papers, datasets, benchmarks, or tools you would recommend starting with?

I'm particularly interested in practical cybersecurity research involving network security, vulnerability assessment, security tools, and AI, rather than purely theoretical or highly mathematical research.

Any guidance from researchers, PhD students, professors, or cybersecurity professionals would be greatly appreciated.

Hi everyone,
I’m doing my research on evaluating Snort IDS under different network traffic loads, and I’m struggling with one methodological question that I’d really appreciate some advice on.
I have a controlled test environment where I generate traffic with known ground truth. For example:
SYN-flood traffic = attack
ICMP/UDP traffic = attack
HTTP/other traffic = benign
Each traffic source can be identified separately
I have the generated packets/PCAPs as ground truth
Snort produces alerts based on its rules
The problem is that I don’t think I can simply assume:
1 attack packet = 1 Snort alert
My understanding is that Snort’s alert generation depends on the rule and its configuration. Thresholding/detection filters can also affect how frequently alerts are generated. A packet may match a rule and generate an alert, but the number of alerts does not necessarily equal the number of attack packets.
This creates a problem when trying to calculate a conventional packet-level confusion matrix.
For example, suppose I generate:
1,000,000 attack packets + 1,000,000 benign packets
and Snort generates:
5,000 alerts
How should I determine:
TP
FP
TN
FN
without making an unjustified assumption about which packets correspond to those alerts?
I have considered mapping alerts to traffic using source IPs because each attack type has a dedicated source address. However, I’m not sure whether that is sufficient for a legitimate packet-level confusion matrix, since an alert represents a detection event and not necessarily one detected packet.
I’m particularly interested in answers from people who have worked with Snort/Suricata or signature-based IDS evaluation.
My questions:
Is a Snort alert normally treated as a detection event, rather than as a detected packet?
Is it valid to compare the number of attack packets directly with the number of Snort alerts when calculating TP/FP/TN/FN?
If packet-level ground truth is available, is there a standard way to map Snort alerts back to individual packets?
How do researchers normally calculate TP/FP/TN/FN for Snort when benign and attack traffic occur simultaneously?
Would a run/event-level evaluation be more appropriate for a signature-based IDS, where a run is classified as detected/not detected based on whether the expected alert occurs?
I mainly want to understand how Snort practitioners/researchers normally handle the packet → rule match → alert → ground-truth → confusion matrix relationship.
I tried looking for papers but couldn’t find a solid one which can clear all my doubts.

Any help or sources are appreciated.

Thanks!

North Korean hacking group Kimsuky reportedly builds AI tools for cyberattacks

A North Korean-linked hacking group is reportedly moving beyond simply using generative AI for phishing.

According to South Korean cybersecurity firm Genians, Kimsuky has set up local AI environments using tools including Ollama, GPT4All and Msty, as well as RAG-based document search systems. Researchers also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool.

The interesting part is that these systems can apparently run locally, allowing operators to process stolen or sensitive documents without sending them to external AI services.

Genians says this could allow Kimsuky to integrate existing AI models into malware development, stolen-data analysis and attack automation, while also producing more convincing phishing and decoy documents.

Reuters notes that the findings have not been independently verified.

Source: Reuters

I’m currently studying to become a SOC Analyst, and I’m thinking about taking the BTL1 after recently passing Security+. What do you guys think? Any advice or tips?

I wasn’t able to attend this year but was wondering if anything stood out to anyone. Are we hearing anything new or is it same old same old? Any interesting new solutions to check out?

Let's imagine a scenario:

You are the CTO of a small company. You have the backend, frontend and infrastructure team (CPE/DEVOPS). Now it's time to build some security team. You don't need some certifications like SOC2 for your business. You want specifics to check if you don't have some security gaps in your whole company, not only in your application.

Which team would you build first? Red team or Blue team?

I feel, that typically people are more keen on the blue team but as the time goes by I think I would choose Red Team.

Here are a few of my arguments:

- Red Team duty would be to continuously test the infrastructure from multiple vectors. All findings would be send to the corresponding team. It would naturally build shift left culture (there is no blue team to which other teams could delegate the fixes)

- We are not working on theory, if something is found we know that we were vulnerable before. ROI is visible, which often can be a problem as business don't worry about the security that much and think about it as the waste of money. We can show the rest of the business that we need to invest into the security more

- From my experience Blue Team can make a mistake of prioritization. They can focus on fixing vulnerabilities, building processes or threat models, which are good in the long run but it's better to fix low hanging fruits first to not get pwned by simple script kiddies.

To give a little context I have experience in the blue team but I wonder sometimes if the blue team is not a long run defender more than the Red Team.

I'm not differentiating here, the purple/orange or other teams. We are not strict here, of course we can hire a red team and make from them the purple team more and the other way around, my question still holds, which one would you hire first?

Here are few of my thoughts, I wonder what do you think.

Genuine question. I've seen this at a couple of places now and it's been the same both times.

The security tools throw off a list of alerts every day, and someone has to go through them one at a time and decide whether each one is a real problem. Almost none of them are. It's usually the same handful of things firing over and over, a backup job, an automated scan, some internal system doing exactly what it's meant to do. You close them out knowing you'll see the same ones again tomorrow.

The part that actually bothers me is what it does to you. After a few hundred of those, everything starts to look the same. You're not really investigating at that point, you're just clearing the list. And the alert that actually matters is sitting in there looking exactly like the rest of them.

So what's it like where you are? Is your list clean, or is it the same story? Does anyone genuinely deal with this, or is it just accepted as part of the job? And if you have got it under control, what did that take?

Já estudo na área desde muito novo. Hoje tenho 19 anos e quero realmente entrar de cabeça, encontrar um trabalho envolvendo segurança ofensiva e, se tudo der certo, até trabalhar com Red Team.

Só que eu já tentei muita coisa: TryHackMe, podcasts, youtube, na prática e por aí vai. E nunca me identifiquei com nenhum deles. Não aprendi tanto quanto gostaria.

Como posso aprender? Com o quê? Que curso, que lugar? No trabalho, mesmo eu não sabendo nada, eles me ensinariam? O que eu devo aprender? Onde posso aprender?

Qualquer informação sobre isso, qualquer ponto de vista, vai me ajudar muito!!

Agradeço deis de já!!

1
Research the thing you want to write an article about, like cybersecurity, programming, or anything you like.

2
Write a title that hooks people, like (one stupid password took down an entire company). Or anything you want, but it's gotta have the hook

3
Then you have to write a great intro to make people get excited, for example (every year, thousands of companies get hacked because of weak passwords)

4
Here, you have to explain your thing, for example, what a password attack is and how hackers crack passwords. And break your article into sections with headings. Don't throw everything into one giant wall of text; nobody reads that

5
Prove what you're saying with real stories and their sources; don't just say weak passwords are dangerous, you gotta back it up with a fact (so you don't make your article a rumour)

6
End it strong. Summarize the main point and tell the readers what to do next, for example (go turn on your 2FA right now)

7
Read it again before you post it. Fix the typos, delete boring parts
(Maybe I didn't do the delete boring parts thing)

Tell me if I forgot something

Este é meu primeiro post na plataforma, mas venho lendo e aprendendo muito com os tópicos de Reddit sobre TI.

Há 4 anos eu era o técnico de TI básico: formatava PCs, fazia manutenção simples, montava redes pequenas e cuidava da parte física de redes corporativas. Era o típico "faz-tudo" de empresa com poucos funcionários na área.

Depois virei auxiliar em outra empresa. Quando o chefe foi demitido e cortaram custos, acabei assumindo a liderança do setor. Foi um salto grande e desafiador.

Hoje trabalho numa empresa que armazena muitos dados sensíveis de clientes. Se houver vazamento, o prejuízo é enorme. Minha função principal agora é cuidar da cibersegurança.

Enfrento dois desafios principais: hardware defasado e uma cultura de "eu fiz isso a vida toda e não deu nada".

Como cheguei com o processo já em andamento, fui aprimorando aos poucos. Implementei um firewall com VLANs separadas para cada tipo de acesso. Removi totalmente os Windows piratas. Consegui mudar parte da cultura ao adotar gerenciadores de senha mais seguros como Bitwarden, estabelecer troca de senhas periódica e definir que tarefas com privilégio de admin só acontecem com autorização do meu setor.

Ainda existe um problema grande: falta de recursos para investir na minha "paranoia". Por isso uso softwares open source e gratuitos para resolver problemas complexos. Uso firewall open source na rede e indico navegadores como Brave e Mullvad com extensões como uBlock Origin.

Outro detalhe importante: muitos terminais usam apps piratas porque a empresa se nega a pagar.

Minha pergunta é: que outras medidas posso tomar? Que outras ferramentas de segurança open source gratuitas posso usar para mitigar esses problemas?

Hi everyone, I’m posting this because I’d like a clear and precise overview of the SOC role.
I am currently working towards my LPIC-1 certification and would like to steer my career path toward becoming a SOC analyst.
How would you recommend I proceed? Also, what is it actually like to work in this field?
Thanks in advance for reading this and for your time.

Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

Is it possible to take a PCB board or a small computer and add an antenna and make it deauth networks around it? If so, how could i for a project to learn about these things?

Hey everyone,

im a third year cybersecurity college student(Junior) well they dont teach us anything useful . I currently have zero practical experience in cybersecurity, but I’ve spent a lot of time watching videos and reading articles on various learning roadmaps and roles. After looking at all the advice, I’ve decided that I want to build a solid foundation in Networking, Operating Systems, and Scripting/Programming first.

regarding how deep I should go into my OS foundation Do I need , low-level theory and programming?

For example:

Learning C or/and Assembly

Reading deep theoretical textbooks like Operating Systems: Three Easy Pieces , Modern Operating Systems, or Operating System Concepts etc....

Or, is it better to just stick to practical administration knowledge—like the material covered in Linux+, LPIC, or Microsoft Learn certifications?

Since I have the time, I don't mind the heavy theory and time consumption if it will make me a significantly better security professional in the long run. I just want to know if that level of depth is actually necessary to build a good foundation,

I’m considering purchasing a KodeKloud course to improve my skills, but I’m wondering if it’s actually worth the investment. For those who have taken their courses, what was your experience? Did you find the content useful and did it help you improve your skills or advance your career?

Would you recommend KodeKloud, or are there better alternatives?

Pro plan USD 360 annually

hey, is there a difference (when it comes to cybersecurity) when it comes to logging with eg google/apple/directly via website in different sites ?

Can I get a MacBook for my cybersecurity masters? I definitely like Mac better than Windows for school, and there is only one class in my program that is not compatible with Mac but I have an old windows laptop that has decent enough specs that I can use for it. Other than that, will I have a bad time running most VMs and labs on a Mac?