I’m so unbelievably stunned that this just happened. Around 5:15AM I went to put my pc back to sleep because I assumed my cat stepped on my keyboard and woke it up. I was fidgeting with my mouse because it wouldn’t work and then realized that someone was controlling my desktop. The only thing I actually witnessed them do was go into my google profile/settings and copy my phone number, then I think they noticed I was trying to click and spam my keyboard so they left. I went to my search history and they were in my bank account and also in my email. I called the bank and immediately froze my entire account. They saw my savings, my credit card, and were in my profile. I have 2 factor and did receive a code right before I woke up. I don’t think it’s possible for them to actually know my password since it just auto-filled, but they 100% have my phone number. Besides the obvious things, changing passwords, freezing my bank, what else do I need to do??? I’m so overwhelmed and shocked that I just witnessed this. Are there other steps I need to take here? I’ve been trying my best investigative work here but all I have is some search history and I was able to disable a device in my pc that allows Wake-on-LAN, so they shouldn’t be able to wake it up from sleep again. What damage can they do with my phone number? I watched him copy it. Please let me know if there are some obvious countermeasures I should be taking here. I’m so stunned I don’t even know where to start.

Has anyone heard anything about ARTEX being abused to grab leaked GitHub secrets?

Info here from Microsoft: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

And GitGuardian: https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

I’m trying to get into the cybersecurity industry, and I’ve met a few people through networking who work multiple jobs in the field, which has always made me curious about how they manage their time and what their day to day lives actually look like.

For those of you working two, three, or even more cybersecurity jobs, how many hours are you actually putting into each job, and how demanding is the workload? Are you constantly busy throughout the day, or do you have enough downtime between tasks to make working multiple jobs manageable? I’m also curious how you handle situations where meetings, deadlines, or other responsibilities overlap, and whether managing multiple positions is as stressful as it sounds or if it really depends on the roles you’re working.

I’m especially curious about your work-life balance because I can’t imagine juggling that many responsibilities without sacrificing a good amount of personal time. Do you still have time to spend with friends and family, go to the gym, enjoy your hobbies, or even just have a day to yourself without worrying about work? I’d really like to hear what a typical day looks like for those of you doing this and how you manage to have a life outside of work.

Does anyone have experience with Black Hat trainings taking place during their gatherings? I am talking about these 2 or 4 day trainings happening during the event. Is it worth the money and time?

It’s been a horrible experience, right from subscriptions to exam scheduling. Seriously, they can’t even get a basic calendar and scheduling system right.

Hi everyone,

I have successfully cleared the CEH Theory exam and am now preparing for the CEH Practical exam.

I'm looking for suggestions from people who have already taken the practical exam or are currently preparing for it.

1. Which platforms or resources are best for practicing?

2. Are there any recommended mock tests or practice labs?

3. What tools and topics should I focus on?

4. How similar is the actual exam to the available practice tests?

5. Any tips or strategies to manage time during the exam?

Any guidance, resources, or personal experiences would be greatly appreciated.

Thanks in advance, bros!

Hey there! I'm new to this community, so I would appreciate it if you could share your opinion on this matter.

I'm currently a senior help desk technician that gets extensive experience in several aspects of cybersecurity.

To make the eventual jump into cyber, I've been working on a lab using GNS3 and Suricata fine-tuning. It currently has two offices using OPNsense firewalls connected via an IPsec tunnel, and Suricata running on the firewalls in IDS mode. There is also a simulated attacker host connected to the ISP router.

I wanted to get advice on some things you'd be impressed by if you were to see them in a lab. So far the only thing I've really done is establish least privilege ACLs and also a web server in one office, which is the only thing the other office can reach

Please let me know if this is not the right sub for this. I also know it's very vague, but to be honest I don't have a very clear goal for the lab yet. I want to focus more on network security engineering, but I am also interested in detection engineering.

I really need your help and guidance with something. Are there any forums or communities where cybersecurity is taught in a more hands-on or collaborative way?
I’m not referring to virtual labs like Hack The Box or similar platforms.
I mean communities more like Reddit, Discord servers, or groups where people share knowledge, work together on practical challenges, and learn from each other.
Could you point me in the right direction? I’d really appreciate your help!

​Hi everyone,

​Over the past few weeks, I’ve been working on an open-source defensive cybersecurity project called Zero-Day Radar.

​The goal is to build a high-performance network monitoring and threat detection framework. I decided to use a hybrid architecture:

​C++ Core Engine (88.1%): Handles the low-level heavy lifting — fast network packet capture, process monitoring, and minimal overhead execution.

​Python Analytical Layer (11.9%): Parses telemetry data, aggregates log records, and integrates with threat intelligence feeds.

​Key components in the repo:

​radar_core.cpp - Low-level monitoring engine

​zeroday_radar.py - Log parser & analytical engine

​rules.txt & radar.conf - Custom detection logic

​The source code is available here:

https://github.com/aouamchawki-3A/zero-day-radar

​I would really appreciate any feedback from the community regarding the C++ performance, IPC mechanisms between C++ and Python, or suggestions for additional detection capabilities!

I'm a computer engineering student specializing in cybersecurity, currently exploring potential problems for a six-month engineering project.

Rather than inventing another generic security tool, I'd like to understand the real problems professionals encounter in their day-to-day work.

A few things I'd particularly like to understand:

• What tasks are unnecessarily manual or time-consuming?
• What security problems are difficult to detect, validate, or investigate?
• Where do existing tools fail or require complicated workarounds?
• What problem would you genuinely like to see solved?

I'm interested in specific, real-world experiences rather than generic project suggestions.

Thanks in advance!

Hello All, does anyone a good cyber deception masters program that is beneficial and has hands-on implementation as a focus?

Thank you!

When new ELT takes over and starts questioning the SOC value

Exec: "What does the SOC actually do all day?"

Me: "Let us go and find out"

After 15 years in security leadership, not sure I can take much more

I’m in a regulated sector and there’s little guidance on AI use. Because of that, we’ve really restricted use and advise no uploading of NPI/PII until we know what the expectations are on risk assessments, policies, etc. Basically, it’s great for research, some guidance, and drafting, but shouldn’t be run on sensitive data in any form. Any decisions that are made should be your decisions and not the decision of AI. Users are trained on this. They’ve accepted the terms in our Acceptable Use Policy. We have 1 approved AI platform.

Here’s the thing - We’ve got the tech enthusiasts that reach out to the IT department regularly - “look at this new setup from Anthropic! We can automate this. This would increase productivity! We’re going to get left behind!”

“We’re going to get left behind!”
Ugh.

There’s a user that told me he’s given AI full access to his personal laptop. He has told me he personally runs bots and uses multiple platforms to write and run scripts and automations. Full access makes me cringe. Although there’s no proof that there’s “shadow AI” going on (users using unapproved tools/circumventing protection) we suspect some is going on. Knowing that these users just throw all their personal documents at these platforms worries us that we’re opening a can of worms if we un restrict AI use internally - especially since AI tools continue to evolve and we still don’t have a set expectation from a regulatory body.

It’s like any way we approach it to provide a tool that meets their expectations, it just doesn’t work. The platform we use is constantly adjusting settings as well, so it’s like every time I turn around, a new setting is on by default that shouldn’t be. It feels impossible to control.

Also - these enthusiasts are like .04% of our organization, so is the work worth it is a question that has been brought up. Even upper management feels it’s more efficient to do the work yourself. By the time your verify AI’s output or fix its mistakes, you’d be just as good doing it yourself. Management doesn’t appreciate that the work is not understood when done with AI (e.g. can you explain this line on this document? And the person can’t).

Anyone else feeling bound in a situation like this?

Hey everyone I have been basically tasked with the impossible of trying to create an agentic soc for our environment that basically will triage alerts.

I work for a small business and was dabbling into some vendors that support this ask and from what I’ve seen it all looks the same type of slop that I just don’t see myself trusting yet. It looks like you have this product that the company promises can triage alerts for you yet you still have to be looking at alerts to make sure the ai is doing its job correctly. I’m not in the market to babysit ai as I don’t think that is feasible long term because I am simply just making the work being done faster but it is all benign work anyway.

But I stumbled up a an idea to the madness and wondering if it is possible to develop an agent that acts as the detection for our environment so there would no longer be a queue with several detections put in place and once users hit that risk threshold then the team investigates whatever it finds as borderline suspicious.

So instead of us having detections put in place to catch things the ai itself is the detection and will monitor everything that’s coming in and out of our environment and also alert us on just the important things that need to be investigated.

I guess to accomplish something like this I would need to train the ai by feeding it siem logs ticket logs and have it spit out anything that is abnormal and compare that to the normal activity from our users and go from there?

With that being said I am wanting to ask what all you have done in the state of ai being incorporated with the soc? Did your analysts just triage alerts with it or are you guys able to do other things.

Were you able to accomplish something similar or find a product that meets that need?

Edit: Thank you guys for commenting on this so quickly I appreciate you all!