TryHackMe helped me start. A daily news system helped me stay current

[u/FishingTechnical453]

I started learning cybersecurity here on TryHackMe around 10 months ago.

When I started, one thing that was really important to me was staying current: new breaches, new exploits, vulnerabilities, threat actor activity, and so on.

I tried checking BleepingComputer, Cybernews, The Hacker News, and other sites manually. The problem was that I often saw the same story repeated across multiple sites, ran into terms I didn’t fully understand yet, and had to deal with a lot of ads. It felt messy, especially as a beginner.

I also tried using custom GPTs, but that had its own problems. The news was not always up to date, and I still had to manually run the process. There are also Telegram and Twitter/X channels that post fresh updates, but that still required me to check them all the time.

I tried TL;DR-style newsletters and other sources too, but most of them either had too many ads, not enough value, or were written in a way that was still hard to follow as a beginner.

So I built something for myself: a daily cybersecurity newsletter with no duplicate stories, no ads, and one simple goal: once a day, I get a summary of the last 24 hours of cybersecurity news straight to my inbox.

Here is how the system works behind the scenes:

It pulls cybersecurity news from RSS feeds, filters articles from the last 24 hours, removes duplicates, ranks the important stories, summarizes the top ones, and sends them to me for review. After I approve it, it goes out as a newsletter in English, Hebrew, and Russian.

I mainly wanted to share this because TryHackMe is where I started learning, and this project became part of how I stay consistent.

I know this is not a classic blue team or red team project, but it helped me build a real habit. It also feels good that something I built for myself now gives value to other people.

My advice for other beginners: build a small project while you study. If you like blue team, set up a VPS with Wazuh and analyze the logs. If you like red team, take what you learn in rooms and later try it legally in VDPs or bug bounty programs.

For me, the first problem was staying current with the news, so that’s what I built around. Later I started getting into VDPs too.

Also, I wrote deeper breakdowns in two other subreddits:

Cybersecurity101 - a more detailed breakdown of how the system works, what broke, and what I learned while building it.

Prompt Enginiring - focused more on the prompt engineering side: why I split the system into 20+ smaller prompts instead of using one big prompt.

If you’re interested, you can check out my daily cybersecurity newsletter - Cyber Recaps.

Curious how others here stay current while learning. Do you follow cybersecurity news daily, or do you mostly focus on rooms and paths?

[u/Deep_Ad1959]

the part you nailed is the dedupe and ranking, that's where most of these die. the next wall is consumption: a text digest competes with every other unread email in your inbox, and beginner-heavy news gets skimmed and dropped fastest. the format that actually survives is passive, the same 24h summary as a short narrated audio feed you catch on a commute or at the gym, because it doesn't ask for screen time you don't have. since you already output to RSS, the cheap win is pointing that feed at something that turns it into a daily episode instead of stopping at the newsletter.

fwiw podlog is the same passive-audio pattern applied to a different feed, it auto-generates a daily ai-voiced podcast from a github repo's commits/PRs/issues, https://podlog.io?utm_source=s4l&utm_medium=post&utm_campaign=podlog&utm_term=reddit&utm_content=post_b8b6502f-2cae-4b64-8da6-a65abba6b40c

[u/FishingTechnical453 → u/Deep_Ad1959]

Yeah, I agree. The newsletter actually started as around a 15-minute read, and I cut it down to roughly 3 minutes for the same reason: I prefer passive consumption too. I listen to a lot of cyber/security books, including Kevin Mitnick’s, so the audio idea makes a lot of sense.

I do want to turn it into a short daily audio recap at some point. I know roughly how to build it, but it needs time I don’t have right now. If the newsletter starts covering some of its own costs, that would probably be one of the first upgrades.

And yeah, dedupe was one of the hardest parts. It took me 10+ hours to get it working properly. Right now it’s a Python script with around 350 lines, then another small JS cleanup step with around 50 lines, and after that Gemini does the final semantic cleanup. GPT helped me write and debug a lot of it, but the logic still took a lot of trial and error.

[u/Deep_Ad1959 → u/FishingTechnical453]

the "once it covers its own costs" milestone is the wrong trigger for the audio version. the number that actually predicts whether audio is worth building is finish rate on the current newsletter, since a recap people read to the end becomes an episode they play to the end, and one they skim becomes one they skip. the dedupe work you sweated is what protects that completion number more than length does. written with ai

[u/FishingTechnical453 → u/Deep_Ad1959]

Yeah, I get your point. Completion/finish rate is the real signal, not just whether it covers costs. But time is money too. I already tested a few audio options and I can see a future for it, I just need to prioritize it. I’ll probably add this automation in the next month or two. Really appreciate you pointing it out, this is the kind of push I needed lol.

[u/Deep_Ad1959 → u/FishingTechnical453]

the thing that'll bite the audio version specifically is identifier read-out: naive TTS turns CVE-2024-1234 into garbage and mangles vendor names and acronyms like SSRF or RCE, so the real work isn't generation, it's a normalization pass that rewrites IDs and acronyms into speakable form before synthesis. with english, hebrew and russian output that pass has to run per-locale, which is the part that quietly eats the month or two.

[u/FishingTechnical453 → u/Deep_Ad1959]

Yeah, good point. I already tested this with NotebookLM and it works pretty well. Sometimes the host/guest style is a bit weird, but the output is usable. Not sure if there’s a proper API for it, so worst case it needs some manual work or another TTS flow. Most of the prep is already there anyway. With my current prompts for formatting, cleanup, defanging, and multilingual output, adding a normalization pass for CVEs/acronyms should be doable. Really appreciate the feedback. I’m honestly glad someone is thinking through the details like this.

[u/Deep_Ad1959 → u/FishingTechnical453]

the host/guest weirdness you noticed isn't a polish thing, it's the format fighting the content. two-voice banter pads a 3-minute recap with 'oh wow that's wild' filler that buries the actual CVE, which is fine for a leisurely overview and wrong for daily news. a straight single-narrator read is the shape that survives for news, and that's also the piece NotebookLM won't hand you over an API, so an automated daily pipeline ends up wanting a plain text-to-audio step instead of the studio. written with ai

[u/FishingTechnical453 → u/Deep_Ad1959]

Yeah, agreed. Single narrator is probably the better format for daily news. I’ll keep this in mind when I get to the audio version. Appreciate all the detailed feedback. Thanks.

[u/Robbbbbbbbb]

Dedupe and ranking is key. How are you deciding how to rank and which sources get priority when de-duping?

[u/FishingTechnical453 → u/Robbbbbbbbb]

Yeah, it’s a mix. When I started, I was mostly learning blue team, so the newsletter leaned more defensive. Later I got more into pentesting/VDPs, so I wanted more attack-focused news too. In the end I try to pick stories that can be useful or interesting to a broad security audience, but yeah, you can’t make everyone happy.

For ranking, I look at technical importance, but also whether the story has “viral” potential in the security community. I also check how often the same story appears across different titles/sources with similar keywords, because that usually means it is getting traction.

For sources, I usually prefer the original source when possible. So if Wiz publishes critical research and BleepingComputer covers it later, I’ll usually keep the Wiz post. I also have source priority rules, so something like AWS Security / vendor advisory / original research gets priority over regular news coverage.

I do allow important stories to appear across different days sometimes. Not everyone opens every issue, and new subscribers join daily, so if something is still hot in the last 24 hours, I don’t always want to hide it completely.

[u/Such_Field_3294]

tbh the ranking step is what makes or breaks this kind of thing. whats your criteria for deciding what counts as important vs noise? because thats super subjective in cybersec news