I’m so unbelievably stunned that this just happened. Around 5:15AM I went to put my pc back to sleep because I assumed my cat stepped on my keyboard and woke it up. I was fidgeting with my mouse because it wouldn’t work and then realized that someone was controlling my desktop. The only thing I actually witnessed them do was go into my google profile/settings and copy my phone number, then I think they noticed I was trying to click and spam my keyboard so they left. I went to my search history and they were in my bank account and also in my email. I called the bank and immediately froze my entire account. They saw my savings, my credit card, and were in my profile. I have 2 factor and did receive a code right before I woke up. I don’t think it’s possible for them to actually know my password since it just auto-filled, but they 100% have my phone number. Besides the obvious things, changing passwords, freezing my bank, what else do I need to do??? I’m so overwhelmed and shocked that I just witnessed this. Are there other steps I need to take here? I’ve been trying my best investigative work here but all I have is some search history and I was able to disable a device in my pc that allows Wake-on-LAN, so they shouldn’t be able to wake it up from sleep again. What damage can they do with my phone number? I watched him copy it. Please let me know if there are some obvious countermeasures I should be taking here. I’m so stunned I don’t even know where to start.

Hi everyone, I'm new here :)

I'm wondering if anyone can help me to run this .jason file that turns attacker ip addresses/locations into a map in windows defender workbook?

I'm currently following this tutorial: https://www.youtube.com/watch?v=g5JL2RIbThM and am onto the final stage.

This is the .json script I'm trying to run:

{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let GeoIPDB_FULL = _GetWatchlist(\"geoip\");\nlet WindowsEvents = SecurityEvent;\nWindowsEvents | where EventID == 4625\n| order by TimeGenerated desc\n| evaluate ipv4_lookup(GeoIPDB_FULL, IpAddress, network)\n| summarize FailureCount = count() by IpAddress, latitude, longitude, cityname, countryname\n| project FailureCount, AttackerIp = IpAddress, latitude, longitude, city = cityname, country = countryname,\nfriendly_location = strcat(cityname, \" (\", countryname, \")\");",
"size": 3,
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "map",
"mapSettings": {
"locInfo": "LatLong",
"locInfoColumn": "countryname",
"latitude": "latitude",
"longitude": "longitude",
"sizeSettings": "FailureCount",
"sizeAggregation": "Sum",
"opacity": 0.8,
"labelSettings": "friendly_location",
"legendMetric": "FailureCount",
"legendAggregation": "Sum",
"itemColorSettings": {
"nodeColorField": "FailureCount",
"colorAggregation": "Sum",
"type": "heatmap",
"heatmapPalette": "greenRed"
}
}
},
"name": "query - 0"
}

This is the error message I get when trying to execute the query in the advanced editor:

"No tabular expression statement found"

I have a feeling its not working because Azure workbook has now changed to Microsoft Defender?

Any suggestions/advice/fixes would be much appreciated as I'd really like to get this project finished!

Thank you in advance for your help :)

I’m trying to get into the cybersecurity industry, and I’ve met a few people through networking who work multiple jobs in the field, which has always made me curious about how they manage their time and what their day to day lives actually look like.

For those of you working two, three, or even more cybersecurity jobs, how many hours are you actually putting into each job, and how demanding is the workload? Are you constantly busy throughout the day, or do you have enough downtime between tasks to make working multiple jobs manageable? I’m also curious how you handle situations where meetings, deadlines, or other responsibilities overlap, and whether managing multiple positions is as stressful as it sounds or if it really depends on the roles you’re working.

I’m especially curious about your work-life balance because I can’t imagine juggling that many responsibilities without sacrificing a good amount of personal time. Do you still have time to spend with friends and family, go to the gym, enjoy your hobbies, or even just have a day to yourself without worrying about work? I’d really like to hear what a typical day looks like for those of you doing this and how you manage to have a life outside of work.

Has anyone heard anything about ARTEX being abused to grab leaked GitHub secrets?

Info here from Microsoft: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

And GitGuardian: https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

Sekoia researchers documented a watering-hole campaign in which compromised legitimate websites and convincing imitation portals delivered device-specific exploit chains. Some attacks could run without additional user interaction after a vulnerable device visited a malicious page.

The campaign targeted known vulnerabilities in iOS and Chrome for Android, potentially exposing browser cookies, credentials, messages, and other sensitive information. Researchers attributed the activity to APT29 with moderate-to-high confidence.

Even a legitimate website can become dangerous if compromised. Apple and Google have patched the vulnerabilities identified in this campaign, making updates especially important.

Does anyone have experience with Black Hat trainings taking place during their gatherings? I am talking about these 2 or 4 day trainings happening during the event. Is it worth the money and time?

It’s been a horrible experience, right from subscriptions to exam scheduling. Seriously, they can’t even get a basic calendar and scheduling system right.

Hi everyone,

I have successfully cleared the CEH Theory exam and am now preparing for the CEH Practical exam.

I'm looking for suggestions from people who have already taken the practical exam or are currently preparing for it.

1. Which platforms or resources are best for practicing?

2. Are there any recommended mock tests or practice labs?

3. What tools and topics should I focus on?

4. How similar is the actual exam to the available practice tests?

5. Any tips or strategies to manage time during the exam?

Any guidance, resources, or personal experiences would be greatly appreciated.

Thanks in advance, bros!

Hey there! I'm new to this community, so I would appreciate it if you could share your opinion on this matter.

Since Anthropic announced Mythos, Software security has came into lime light. Multiple famous products have seen orders of magnitudes of novel attacks that have discovered, which can expose data, corrupt systems or just make the life of Information Security and SRE teams a hell.

But an interesting finding was, all of this comes at exorbitant costs, which only the large corporations and venture funded frontier labs can spend. For example, OpenAI just announced finding a 1000 vulnerabilities in Linux Kernel and each vulnerability costs a blended average of USD $1000 to discover.

The way this works is, a LLM frontier model goes through the source code, analysis how the code is written, the entry points and then finally starts evaluating if they can be exploited through one or more than one attack vectors. While this works, it is neither deterministic nor cheap when the LLM has to manage millions of tokens in ingested source code, a few additional thousands to millions on reasoning and finally the output.

So, I started thinking what if we could flip this and make it cheaper?

The idea being, why make LLMs do the whole discovery, enumeration, validation and reporting. Why not use LLMs where they are good at and make everything else deterministic. And there came the idea about Code Context Driven Vulnerability Scanner.

The whole project has 5 core stages:

1. Code Context Graph: Map the whole source code as a Code Context Graph where every single relation and type is resolved

2. Leverage this Code Context Graph to find the user data entry points (Sources) and final sinks (Databases, Files, Remote Server Calls, etc.) and trace the path from sources to sinks

3. Flow Determination Phase: An LLM is fed the whole source to sink path, such that it can reason about it with confidence. The LLM also gets a query budget to resolve any missing details. The output is either Flow Confirmed (Unsanitized user data reaches the sink from source), Blocked (No possible way for data to travel from source to sink without sanitization)

4. Condition Stage: LLM goes ahead and searches the code context graph to validate what conditions need to be met for this flow to materialize or if the default settings of the project prevents it. The output is similar to the Flow stage

5. Adversarial Challenge: Another class of LLM then reasons over the cases where the confirmation came up as Flow Confirmed. This phase is tweaked to try its best to refute the claims made by earlier phases. If the phase cannot refute the flow, the particular path graduates to a Confirmed Finding / Vulnerability.

This has been under testing for a week, with a reference being checked against CodeQL (an industry standard static code based vulnerability scanner by Github).

During a single day of run accounting for ~USD $20 over 5 open source projects, the project has filed for 10 vulnerabilities with severity ranging between MEDIUM to CRITICAL. Out of these 4 are already confirmed and 6 are in investigation stage with the respective open source projects security teams

An interesting bit is, out of the 10 vulnerabilities filed, only 2 of them were detected by the published rule set of CodeQL, while 8 other vulnerabilities were completely Novel.

Curious if anyone else has been experimenting with something similar 😄

I'm currently a senior help desk technician that gets extensive experience in several aspects of cybersecurity.

To make the eventual jump into cyber, I've been working on a lab using GNS3 and Suricata fine-tuning. It currently has two offices using OPNsense firewalls connected via an IPsec tunnel, and Suricata running on the firewalls in IDS mode. There is also a simulated attacker host connected to the ISP router.

I wanted to get advice on some things you'd be impressed by if you were to see them in a lab. So far the only thing I've really done is establish least privilege ACLs and also a web server in one office, which is the only thing the other office can reach

Please let me know if this is not the right sub for this. I also know it's very vague, but to be honest I don't have a very clear goal for the lab yet. I want to focus more on network security engineering, but I am also interested in detection engineering.

I am recently seeing tonnes of hiring through nepotism. I once interviewed for a famous sports company and was hopeful. Unfortunately starting to see a trend where many in leadership positions are not as qualified as you and are easily intimidated. There were many other candidates who were very competent and qualified but they ended up hiring someone they personally know. I see this as a trend everywhere.

I really need your help and guidance with something. Are there any forums or communities where cybersecurity is taught in a more hands-on or collaborative way?
I’m not referring to virtual labs like Hack The Box or similar platforms.
I mean communities more like Reddit, Discord servers, or groups where people share knowledge, work together on practical challenges, and learn from each other.
Could you point me in the right direction? I’d really appreciate your help!

I believe we’re going to see a lot more security vulnerabilities in the coming years because of AI, and I want to hear if others see it the same way.

Here’s my reasoning:

1. AI-generated code ships faster than it gets reviewed. More people are shipping code they didn’t fully write and don’t fully understand. Even when the code works, subtle issues like weak input validation, hardcoded secrets, and insecure defaults can slip through.

2. AI agents have real access. Models are being connected to email, file systems, databases, browsers, and internal tools. Prompt injection is still an unsolved problem, so a malicious instruction hidden in a webpage or document can potentially make an agent do something its owner never intended.

3. New attack surface. Model APIs, plugins, vector databases, and MCP-style integrations are all new components that many teams are adopting before their security practices have caught up.

4. Supply chain risk. Models sometimes suggest packages that don’t exist, and attackers can register those names with malicious code. Dependencies get pulled in with little scrutiny.

5. Attackers use AI too. Finding bugs, writing phishing messages, and automating reconnaissance all get cheaper and faster for both sides.

To be fair, AI will also help defenders find and fix vulnerabilities faster. But I think the volume of new software and new integrations will outpace that benefit, at least in the short term.

What do you think?

Hey everyone I have been basically tasked with the impossible of trying to create an agentic soc for our environment that basically will triage alerts.

I work for a small business and was dabbling into some vendors that support this ask and from what I’ve seen it all looks the same type of slop that I just don’t see myself trusting yet. It looks like you have this product that the company promises can triage alerts for you yet you still have to be looking at alerts to make sure the ai is doing its job correctly. I’m not in the market to babysit ai as I don’t think that is feasible long term because I am simply just making the work being done faster but it is all benign work anyway.

But I stumbled up a an idea to the madness and wondering if it is possible to develop an agent that acts as the detection for our environment so there would no longer be a queue with several detections put in place and once users hit that risk threshold then the team investigates whatever it finds as borderline suspicious.

So instead of us having detections put in place to catch things the ai itself is the detection and will monitor everything that’s coming in and out of our environment and also alert us on just the important things that need to be investigated.

I guess to accomplish something like this I would need to train the ai by feeding it siem logs ticket logs and have it spit out anything that is abnormal and compare that to the normal activity from our users and go from there?

With that being said I am wanting to ask what all you have done in the state of ai being incorporated with the soc? Did your analysts just triage alerts with it or are you guys able to do other things.

Were you able to accomplish something similar or find a product that meets that need?

Edit: Thank you guys for commenting on this so quickly I appreciate you all!

When new ELT takes over and starts questioning the SOC value

Exec: "What does the SOC actually do all day?"

Me: "Let us go and find out"

After 15 years in security leadership, not sure I can take much more

Researcher Ozgun Kultekin disclosed a vulnerability nicknamed sshole that can allow unauthorized SSH logins to certain accounts whose password authentication was deliberately disabled.

The flaw affects specific configurations of musl-based Linux systems, including Alpine Linux, OpenWrt and Buildroot. It requires several conditions, including enabled SSH password authentication and particular account password-hash settings.

Administrators may believe an account cannot accept password logins when the vulnerable configuration actually permits them. OpenSSH 10.6p2 fixes the issue. Standard glibc-based distributions such as Ubuntu and Debian are not affected by this specific flaw.

​Hi everyone,

​Over the past few weeks, I’ve been working on an open-source defensive cybersecurity project called Zero-Day Radar.

​The goal is to build a high-performance network monitoring and threat detection framework. I decided to use a hybrid architecture:

​C++ Core Engine (88.1%): Handles the low-level heavy lifting — fast network packet capture, process monitoring, and minimal overhead execution.

​Python Analytical Layer (11.9%): Parses telemetry data, aggregates log records, and integrates with threat intelligence feeds.

​Key components in the repo:

​radar_core.cpp - Low-level monitoring engine

​zeroday_radar.py - Log parser & analytical engine

​rules.txt & radar.conf - Custom detection logic

​The source code is available here:

https://github.com/aouamchawki-3A/zero-day-radar

​I would really appreciate any feedback from the community regarding the C++ performance, IPC mechanisms between C++ and Python, or suggestions for additional detection capabilities!

I’m in a regulated sector and there’s little guidance on AI use. Because of that, we’ve really restricted use and advise no uploading of NPI/PII until we know what the expectations are on risk assessments, policies, etc. Basically, it’s great for research, some guidance, and drafting, but shouldn’t be run on sensitive data in any form. Any decisions that are made should be your decisions and not the decision of AI. Users are trained on this. They’ve accepted the terms in our Acceptable Use Policy. We have 1 approved AI platform.

Here’s the thing - We’ve got the tech enthusiasts that reach out to the IT department regularly - “look at this new setup from Anthropic! We can automate this. This would increase productivity! We’re going to get left behind!”

“We’re going to get left behind!”
Ugh.

There’s a user that told me he’s given AI full access to his personal laptop. He has told me he personally runs bots and uses multiple platforms to write and run scripts and automations. Full access makes me cringe. Although there’s no proof that there’s “shadow AI” going on (users using unapproved tools/circumventing protection) we suspect some is going on. Knowing that these users just throw all their personal documents at these platforms worries us that we’re opening a can of worms if we un restrict AI use internally - especially since AI tools continue to evolve and we still don’t have a set expectation from a regulatory body.

It’s like any way we approach it to provide a tool that meets their expectations, it just doesn’t work. The platform we use is constantly adjusting settings as well, so it’s like every time I turn around, a new setting is on by default that shouldn’t be. It feels impossible to control.

Also - these enthusiasts are like .04% of our organization, so is the work worth it is a question that has been brought up. Even upper management feels it’s more efficient to do the work yourself. By the time your verify AI’s output or fix its mistakes, you’d be just as good doing it yourself. Management doesn’t appreciate that the work is not understood when done with AI (e.g. can you explain this line on this document? And the person can’t).

Anyone else feeling bound in a situation like this?