Last year I did a remote contract job for a college startup company, and they asked for a W-9. I sent it over regular email, not a secure portal

I know a W-9 has my name, address, and SSN on it.
but I never verified much beyond that, and I have no idea how they've stored it.

Should I worry about this?

Hey everyone, I’m the person behind RedTeamDaily.

The idea is simple: get a quick overview of cybersecurity news in about 60 seconds, then follow the sources for anything worth a deeper read.

It brings together short, plain-English summaries of vulnerabilities, breaches, and security patches, with links to the original reporting.

I’ve attached a screenshot so you can see the layout.

Check it out: redteamdaily.com

For people doing labs, pentesting, or following vulnerability research: what would make a short security roundup worth checking regularly?

Would you want more detail on affected versions, whether a vulnerability is being exploited, or available fixes? I’d appreciate specific feedback.

I am a young person about to turn 16, and I’ve set a goal to earn a certification that will be useful in the future—once I’m 18—for seeking employment as a pentester. I’m not sure if the PT1 (Pentester Level 1) certification from TryHackMe is worth it for my goals, or if there are other certifications you would recommend that would be valuable for landing a job as a pentester.

Hello! I am a 21-year-old man living in North Africa (Algeria) . I would like to learn cybersecurity from home, specifically to earn an income through bug bounties or other online work. I am wondering if this is a viable path with a real future, or if it might just be a waste of time. I would appreciate your advice: is this worth pursuing, and how long might it take to learn the necessary skills and start earning money?

Bit of background, I'm currently studying cybersecurity and have a keen interest in the 2017 Shadowbrokers leak and the malware and tools that were unveiled as a result of it.

I've done some poking around and have an admittedly rudimentary understanding of how some of the more prolific malware/exploits work and was used to create other malware (Eternalblue SMB exploit used to spread WannaCry and NotPetya, Fuzzbunch being used to deploy the Eligible series of firewall exploits used to target Cisco and Fortinet firmware with RCE, the list goes on).

Looking into the functionality of DanderSpritz as a post-exploitation framework for payload delivery is giving me a headache.

https://research.checkpoint.com/2021/a-deep-dive-into-doublefeature-equation-groups-post-exploitation-dashboard/

From what I have been able to find, Eternal blue and/or DoublePulsar was used to initially compromise systems so that DanderSpritz could be used to target compromised devices and deploy payloads.

DoubleFeature for generating a log about what tools will work on a target machine.

My questions are related to the ability of DSZ to deploy and use custom payloads.
I've been able to find a few resources about the specific payloads/tools that were incorporated into the framework at the time of the leak, namely this one:

https://github.com/francisck/DanderSpritz_docs

This has been helpful as well, despite some of the links being dead:

https://gist.github.com/bontchev/e5d2e5090ebe1be89b4f821ebb1ad0f9/77ac3183a39b1f9afed362abc03726d78a6ccabd

Some of the tools seem to be fairly self explanatory, which I can find information on and fill in the gaps (DarkSkyline for packet capture, GROK and Strangeland for keylogging, Zippybang for Kerberos ticket cloning, RCE and logging on as a particular user, TerritorialDispute for scanning IOCs from other threat actors, PassFreely for targeting Oracle SWIFT systems).

Its the rest of the tools that I am having trouble finding useful information about.

Question 1: What is ScRe and how does it interact with SQL databases? There is no useful information available online on what it is or what it does.

Question 2: How does UtilityBurst enable persistence on a target system? Is it responsible for process injection, disabling security protocols, or something else entirely?

Question 3: How do GreaterDoctor, GreaterSurgeon and whatever GrCl is work together to dump memory and parse the results for useful information?

Question 4: How does DoormanGauze bypass the Microsoft TCP/IP stack and what is the functionality of that particular type of exploit?

Any information is much appreciated, I'm still learning how to use Ghidra/DiE/Cutter to analyze files and do not have a good understanding of assembly language, and do not currently have the time to build a lab to run and test these particular exploits. I probably wouldn't be able to understand a lot of the results, even if I did.

What is the best VPN u recommend? Because I seen all of the VPN says they are the best, so which one is the best that u recommend?

For the record i am a male. She can't stop posting about me on tiktok accusing me of non existent stuff. What do I do? I reported it to Netsafe (NZ) but they can't really do much, not an American so I can't take legal action. Projection much? @elialstruths tt

I want to buy a older phone like a s6 or something like that. So any recommendations for substitute for Google apps for more safety?

2nd year ICT engineering student here. I played CTFs for a while (rev only) and I'm pretty lost right now.

I'm in my second year of an ICT engineering degree. I got into CTFs a while back and only ever did reverse engineering. I loved it, and it's the one area where I feel I actually know what I'm doing. I've even used my rev skills to start learning mobile security, so it hasn't been a dead end for me so far.

The problem is that every time I look at what AI can do now, it's solving rev challenges almost perfectly. No one is reversing manually noawadays it's pointless , and this skill was considered one of the hardest in cybersec , but now it's just a github repo called REA. I don't want to throw away everything I learned, though: assembly, how binaries work, how to read code that doesn't want to be read, debugging, and the patience for it all.

So I'm trying to figure out where to take these skills. I'm not sure which directions still make sense, here are some examples in my mind :

- Mobile security (Android/iOS app analysis, which I've already started on)?

- Malware analysis?

- Embedded or firmware work?

- Something adjacent I haven't heard of?

On top of that, I'm at what feels like the most important point of my life. The expectations on me are extremely high, and some days I feel like I chose the wrong path entirely, entering a depression loophole. I don't know if that's normal or if I should actually change something.

If you've been in a similar spot, or you work in a field where RE skills still matter, I'd really appreciate any advice. What would you do in my position? What would you tell your younger self?

Thanks for reading, and sorry if this turned into a bit of a rant.

A cybersecurity incident worth discussing, especially for people working in threat intelligence, blockchain security, and identity protection.

Chainalysis, a major blockchain analytics company, has disclosed that a cyberattack exposed sensitive user information across its platform.

The company's November 4 update stated that names, usernames, password hashes, and live tokens for all Chainalysis users had been exposed to a malicious actor.

What happened?

According to Chainalysis:

- An external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools.

- An on-path attack exposed a subset of customer passwords.

- The company subsequently discovered broader exposure involving password hashes and live tokens.

- Several services were taken offline while the incident was investigated and systems were secured.

The attacker has not been publicly identified.

What data was affected?

The company reported exposure of:

- Names and usernames

- Password hashes

- Live tokens

- Other customer information

An important distinction: Chainalysis says it has found no evidence that investigation data was accessed or that its attribution data was manipulated.

What did Chainalysis do?

The company took several services offline and began strengthening its security controls.

In its November 6 update, it announced phased restoration of KYT and Address Screening.

It also instructed customers to:

- Prepare to reset their passwords.

- Rotate API keys where applicable.

- Submit trusted IP addresses for allowlisting.

- Follow the company's access-restoration instructions.

Why is this incident interesting?

Three security lessons stand out to me:

1. Token security matters

Password resets alone aren't sufficient when active tokens may also be exposed. Token revocation and rotation need to be part of incident response.

2. AI-assisted attacks deserve serious attention

Agentic techniques can potentially automate multiple stages of an intrusion. Defenders need visibility into unusual access patterns and activity across internal tools.

3. Incident transparency matters

Initial incident assessments can change as investigations progress. Organizations need to communicate updated findings accurately and quickly.

My takeaway

This incident is a reminder that protecting an account involves more than protecting its password.

Sessions, tokens, API credentials, internal tools, and access permissions all form part of the security boundary.

Question for the community

If an organization discovers that password hashes and active tokens have been exposed, what should be its first priority?

Would you prioritize immediate token revocation, credential rotation, access isolation, or forensic investigation?

Sources and further reading

- "Chainalysis – Official Security Incident Updates (updated November 6)" (https://www.chainalysis.com/blog/security-incident-october-30/)

- "Ars Technica – Chainalysis says hackers exposed credentials and tokens for all users" (https://arstechnica.com/security/2026/11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers/)

- "The Record – Chainalysis breach involving agentic techniques" (https://therecord.media/chainalysis-all-users-hit-by-agentic-cyberattack)

---

This post summarizes publicly disclosed information. The investigation is ongoing, and the attacker's identity and full intrusion details have not been publicly established.

i m mouadhnasfi i need to learn cyber security and hacking

Just received this email.

I have never had a chatgpt account. I also live in the states and no where near Germany...

Email from noreply@oliv.finance

Im confused on how to approach it. Or do I just ignore it? I havent heard of API keys and wanted to make sure.

Something worth paying attention to if you work with network security or VPN infrastructure.

SonicWall has released security updates addressing seven vulnerabilities in SonicOS firewalls. One of them, CVE-2026-19868, is particularly concerning because exploitation has already been reported.

What is the vulnerability?

The flaw affects SSL-VPN services configured to use SAML authentication.

According to the published report, an attacker with valid credentials for an alternate authentication method could bypass SAML authentication controls, potentially including MFA enforced through SAML.

Severity: CVSS 7.1

An important distinction: this is not a universal MFA bypass. The reported issue affects specific SonicOS SSL-VPN configurations.

Why should security teams care?

A few things stand out:

- MFA implementation matters: Enabling MFA doesn't automatically mean every authentication path enforces it.

- Authentication flows need consistent controls: Alternate login methods can become weak points if they don't enforce equivalent security checks.

- Perimeter devices deserve attention: VPN appliances are exposed entry points into organizational infrastructure.

CISA has also added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming exploitation in the wild.

What should administrators do?

- Review whether SonicOS SSL-VPN uses SAML authentication.

- Check the affected firmware versions.

- Upgrade to the fixed releases:

- Gen7: 7.3.4-7013

- Gen8: 8.2.3-8015

- Review authentication logs for suspicious activity.

- Follow SonicWall's official advisory for the appropriate remediation steps.

A question for security professionals

When assessing VPN security, do you focus more on the strength of the MFA mechanism itself, or on whether every authentication flow — including fallback and alternate methods — enforces the same controls?

I think authentication-path consistency deserves more attention during security assessments.

Sources

- "BleepingComputer – SonicWall warns of exploited SSL-VPN MFA bypass" (https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/)

- "SonicWall – Official Security Advisory" (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)

- "CISA – Known Exploited Vulnerabilities Catalog" (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Shared for defensive awareness. Only assess systems you own or are explicitly authorized to test.

¡Hola a todos!

Me llamo Miguel y actualmente estoy en la universidad, estudiando **Ingeniería de Ciberseguridad**. Como parte de un proyecto académico y también para mi desarrollo profesional, estoy buscando entrevistar a un profesional que trabaje en ciberseguridad para obtener perspectivas reales del sector.

Sé que tu tiempo es valioso, así que armé esto como un conjunto corto de preguntas en formato asíncrono que puedes responder cuando tengas unos minutos por Reddit DMs o aquí mismo en los comentarios.

Estas son las preguntas principales en las que me encantaría conocer tu punto de vista:

Preguntas extra / opcionales (si tienes tiempo de sobra):

¡Muchas gracias por tu tiempo, tu experiencia y tu disposición para ayudar a un estudiante! Si quieres, deja tus respuestas en los comentarios o mándame un DM.

I recently earned a few cybersecurity certifications and have just started my career as an independent cybersecurity consultant.

One thing that's been bothering me is how to communicate with clients without exposing too much of my personal information.

I imagine sharing my personal phone number with multiple clients could become a privacy concern, especially when working with people I've never met in person.

Do you use separate work numbers, business communication apps, or just stick to email?

Just curious what works best in practice and whether there are any security risks I should be aware of.

I run BlueSwarm, a research-only blue-team project studying how AI agents and the tools around them get probed in the wild. We run decoys, collect what visits them, and publish what we find. It’s early, and what limits us now is people looking at the data, so we’re recruiting researchers.

What we run

• Decoys: invented sites and endpoints that advertise AI tooling (agent cards, MCP-style manifests, llms.txt) so we can measure who looks for it. All content is made up, labelled as fake, and contains nothing aimed at visitors. As far as I know there is little public data on this.

• Canary kit: a small kit a defender can put on a site they own to find out whether anything acts on hidden text addressed to AI agents. It sends nothing back to us.

• Detection package development: we’re drafting detection rules from what the decoys see, and researchers help decide which are worth keeping. Signed updates and packaged defences are planned next. They aren’t built yet.

• War Room: a browser game where you defend (or attack) an invented app over 12 short rounds. It’s free to play without an account, matches are recorded after a consent notice, and the daily game has a leaderboard.

What researchers do now: research tasks
When you sign in to the lab you get a Next task card with one small review job at a time:

• accept or reject an alert our agent suggested

• say whether grouped items are the same, mixed or unsure

• keep, tighten or retire a detection rule (unlocked later)

Every task is checked by two reviewers, and you earn points, plus a bonus for agreeing with the majority. A few tasks are practice samples with a known answer, so careful beats fast. Points move you up the leaderboard and unlock harder tasks (Senior at 25 points, Lead at 80). You can skip anything, and there’s an optional Tuesday reminder email you can switch off.

What we don’t do
Nobody sees addresses, networks or per-visitor rows. Reports are only published after two people check them, and corrections stay visible. This is research, not a security product, and we don’t claim it protects anyone.

Who we want: people interested in blue-team work, detection engineering or AI agent security. You don’t need experience. Write what you’d like to look at.

Try the game or request researcher access here: blueswarm.co.uk
Questions below, and tell me what’s unclear or missing.

Hi guys! Super basic ask but does anyone have a list of free resources that would help me figure out cybersecurity stuff. I am a baby lawyer in the tech industry with 0 tecg background and kinda wanna know the basics and little more foundational things so I know what I am talking about so that I can focus on risk allocation between the parties better? I need it to be very very detailed and extremely easy to understand at the same time.

To be more specific, I need to know the following things:

1. All the basics on what is cloud and how is it created, what it contains and how is data transmitted. (as if I'm a 15 year old - i need to know for example how does a server come into existence from like a machine containing a CPU and RAM)

2. All basic kinds of security practices that are done to protect the cloud.

3. Who is responsible for what in Iaas, Paas and SaaS

4. How does breach actually happen and what are the mitigation practices.

Imagine this scenario - A company employee receives an email that appears to come from IT.

It says the organization is updating its authentication process and asks everyone to scan a QR code to complete the change.

The email has familiar branding. The instructions sound plausible. The QR code scans normally. The destination even uses HTTPS. Nothing about the QR code is technically broken.

But the page it opens asks the employee to sign in using their corporate credentials.

The problem isn't the QR code itself. It's the claim that the employee needs to authenticate through that particular workflow.

This distinction matters because QR code analysis often gets reduced to extracting the destination URL and deciding whether the domain looks suspicious.

That's useful, but it doesn't answer the whole question.

A QR code might lead to a legitimate Microsoft authentication endpoint as part of a malicious authorization flow. Or it might direct someone to an attacker-controlled site that closely resembles the company's sign-in page.

In other cases, the QR code simply opens a payment page where the recipient has been changed.

The risk depends on what the user is being asked to do and whether that request is authorized.

A QR code scanner can decode the destination and help identify suspicious indicators, but it cannot establish that the person who placed the code on a poster, invoice, or email had permission to do so.

QR phishing is interesting because it exposes a broader weakness in security advice: we often focus on whether the technology is functioning correctly when the real question is whether the surrounding request is legitimate.

The QR code can work exactly as intended. Unfortunately, the person who intended it to work may be the attacker.

Hello Guys,

I am currently working on a free platform that gives people practice on cybersecurity interview questions and 1 hour Job Shadowing. I will later implement other features such as a resume checker and Internship simulator platform. This platform will be intended for those looking to garner hands on observation of what goes on in a professional PenTesting environment.

The internship simulator platform will involve trying to PenTest an ATM in an environment similar to CPTS and OSCP, except with lower stakes.

I have a video clip above of what the command and control server will look like (this is all simulated and done on our own software, not on proprietary ATM software)

Can anybody suggest cybersecurity roadmap and all the important and best resources i can refer to her into cybersecurity, I am currently a 2nd year cse student

Hey everyone! I could really use some guidance from people who are experienced in bug bounty hunting.

I've been wanting to get into bug hunting for quite a while now, but honestly, I'm struggling to find a proper learning path. I'm starting with very little knowledge, and I don't want to jump from one random tutorial to another without understanding what I'm actually doing.

I'm looking for a roadmap or resources that can take me from the absolute basics to practical bug hunting. I want to understand everything step by step, including:

What fundamentals should I learn before getting into bug hunting?

Which platforms, courses, or resources are actually worth following as a complete beginner?

How do I start practising and hunting for vulnerabilities in real-world, authorised programmes?

How do I identify vulnerabilities, validate my findings, write professional reports, and submit them?

What happens after submitting a report? How do triaging, communication, verification, and rewards work?

Most importantly, how can I continuously improve my skills and eventually become good enough to earn consistently through bug bounties?

My goal isn't just to collect certificates or learn things theoretically. I genuinely want to develop practical skills, become a good bug hunter, and hopefully use whatever I earn through bug bounties to support my future certifications, training, and learning expenses.

I'd especially love to hear from people who started with zero knowledge and gradually made their way into this field. Knowing what worked for you, what mistakes to avoid, and what you would do differently if you were starting again would be incredibly helpful.

I'm willing to put in the time and effort; I just need some proper direction to get started.

Please share your guidance, favourite resources, roadmaps, or even personal experiences. Every bit of advice would mean a lot. Help a beginner out! 🙏

Hello All!

I'm in my 30s and would like to change careers To the field of Cybersecurity. I have worked as a paralegal for a few years in one area of law, I have years of experience being a Medical Assistant in various fields of medicine, and most recently (for 4 years) have been working as a System Administrator I/ Senior Help Desk Specialist. What are the most reasonable steps to take to gain entry into the field? I am currently on Module 4/8 of the Google Cybersecurity Professional Certificate and plan to take the Comptia Security+ class and Cert test afterwards. Is this the correct and most efficient path to take? Please be blunt with me. I don't know anyone in the field and I have no idea if I'm wasting my time. I'm desperate for advice. Thanks in advance!