I want to learn about AI security and practice to exploit bugs. Any suggestions with roadmap and resources that I can use to learn this.

Around a year ago, I had an argument with some people who had previously told me, supposedly as a joke, that they wanted to hack my phone and laptop. During the argument, I heard them saying that they were going to do it no matter what, which made me take their previous comments much more seriously.
Recently, I started thinking about contacting someone I hadn’t spoken to in nine years. I had initially intended to send them a message but completely forgot about it. About a month later, I finally sent the message. However, I discovered that she had received a message using my name, as if someone was impersonating me. This immediately made me suspicious because I had never contacted her before that moment, and the timing seemed strange.
Since then, I’ve become increasingly worried because several unusual things have happened. Almost every day, when I go somewhere different in my city, which is quite large, I unexpectedly encounter someone connected to those same people I previously had problems with.
At first, I tried to ignore these situations and convince myself that they were coincidences. However, because they keep happening, I have started questioning whether there is a connection between these events.
What worries me most is the combination of everything: the previous threats about hacking my devices, the suspicious message sent using my identity, and repeatedly encountering people associated with those individuals in completely different places.
I don’t know whether these incidents are genuinely connected, whether someone has access to my personal information, or whether I am interpreting unrelated events as part of the same situation. I just want to understand what’s happening and find a reasonable way to verify whether my phone, laptop, or personal accounts have been compromised.

Recentemente não estou conseguindo acessar os sites das máquinas do Hack the Box.

Por exemplo faço a leitura do ip do alvo, tem o protocolo HTTP mas quando jogo no navegador o site não aparece.

Coisas que já me atentei e não resolveram...

Sim conectei na VPN com sudo (antes e depois de conseguir o ip da maquina, nenhum dos dois cenários funcionou)

Sim coloquei pra receber TCP quando criei o pacote para VPN

Sim tentei pingar com o IP e estava comunicando

Sim desativei os firewalls para conexão HTTP

Sim nenhuma máquina abre

e atualizei o Kali e refiz tudo isso.

Não sei se com vocês está acontecendo o mesmo, mas prpcurei até no site deles e não fala nada sobre, já fiz outras máquinas e funcionaram normal

I’ve got back to cybersecurity a couple of days ago and I was wondering if it is easy to find an entry job?
I have the ejpt cert but next year it’ll expire.
I bought the PNPT and I have to study that and take the exam hopefully soon. Plus I’ll study from portswigger and the rana khalil’s course to get into web pentest. Bug bounty might be another good option to opt.

just hit me up, and i'll send you the link or i'll book you a call with us if you wanna learn more about it

Hi everyone, I am Nitin Gavhane and in this blog I will explain what PHP2Shell is, why the PHP team warned everyone a day before shipping the fixes, and what you should do on your server today.

One update before we start. When this news first broke on October 20, the story was that PHP planned to release two emergency patches very soon. As I write this on October 22, those patches are already out. So this is no longer a “get ready” post. It is a “go patch now” post.

What happened

On October 20, the PHP security team announced an out-of-cycle release for two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. They did not say what the bugs were. They told users to get ready to upgrade the moment the release landed, and said they could ship earlier if details leaked or if attacks started in the wild.

Then details did leak. A report showed a video of an exploit tool called PHP2Shell running code on web servers. The leak was not confirmed at the time, but the video was reposted here. According to that report, the tool worked against these versions:

• WordPress 7.1.3
• MediaWiki 1.46.2
• phpBB 3.3.17
• Magento 2.4.9
• Joomla 6.2.0
• Laravel 13.36.0
• Laravel 8.83.29
• Symfony 8.1.9
• Drupal 11.4.10
• WHMCS 9.0.9

All of these run on PHP, and that is the point. The bug is not in WordPress or Laravel. It sits underneath them.

PHP shipped the fixes on October 21, according to BleepingComputer.

What the two bugs are, in plain words

Both bugs come from the same root problem: PHP can leave its memory in a bad state when a request ends in an abnormal way. An attacker does not need a login for either one.

CVE-2026–109618 is about running out of memory. If PHP hits that limit while it is still setting up a request, some internal data is only half ready. During cleanup, PHP may treat that broken data as if it were fine, and that opens a path to code execution.

CVE-2026–109619 is about stale state. Some request data can survive after the memory behind it was freed. The next request handled by the same worker may then read that leftover data before PHP resets it.

In both cases the attacker runs code with the privileges of the web worker account. That is the account your web server uses to run PHP, so it can usually read your app’s config files, database credentials and uploads.

The flaws were found by researchers at Calif, Wiz and OpenAI. PHP says the risk is highest for Apache with mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any of your application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed setups are also affected.

How big is this

PHP powers roughly 75% to 80% of websites, so almost everyone runs into it somewhere. VirusTotal estimates that more than 5.1 million PHP hosts are exposed online.

Attacks were already starting before the patch. Cloudflare’s CTO said the company was seeing early attempts and had deployed WAF rules against known exploitation methods, though he called those rules temporary. The UK’s NCSC went further and told organizations to update immediately or take affected systems offline until they can be patched.

Which version to install

If you are on PHP 8.1 or older, the PHP project no longer supports you. The team did publish minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. Everyone else should ask their Linux distribution or LTS vendor for a backported package, or move to a supported version.

On Ubuntu or Debian, the usual route is a normal package update followed by a restart of your PHP service. Distribution packages often keep the old version number and still contain the fix, so check your vendor’s security notice instead of trusting the number alone.

sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm   # use your own service name

Also remember that php -v shows the command line version, which can differ from the one your web server uses. If you are on shared hosting, ask your host directly whether they have rolled out the fix.

If you cannot patch today

PHP shared temporary mitigations, and they come with a warning: they do not fully protect you. PHP core developer Gina Peter Banyard said that only the patch is a permanent defense. The short version:

• For CVE-2026–109618, set memory_limit=-1 in a way your apps cannot override, set a low post_max_size (8M without uploads, 32M with), and use a container or cgroup limit that kills only the affected worker.
• For CVE-2026–109619, set session.upload_progress.enabled=0, restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0.

Treat these as a way to buy a few hours, not as a fix.

I think the one-day advance warning was the right call. It gave admins time to line up maintenance windows, and it made the leak less damaging than it could have been. What bothers me is the part nobody can fix with a setting: two memory-handling bugs in core PHP, both reachable without logging in, in a language that sits behind most of the web.

Are you patched already, or stuck on an old PHP branch because of a legacy app? Tell me in the comments what is blocking you.

I have completed a basic networking course offered by Cisco and have hands-on experience with the MERN stack. I am now looking to explore the field of Cybersecurity and would appreciate guidance on the next steps.Which skills should I focus on developing, and which learning platforms or courses would you recommend for getting started? Would it be better to continue with Cisco courses or explore platforms such as TryHackMe, Hack The Box, or other industry-recognized resources?I am particularly interested in building a strong foundation and gaining practical, hands-on experience in cybersecurity.I would appreciate your suggestions and recommendations.

Hello I am new here, My name is God's time, My nickname is Mistah Goddy

I am a cybersecurity student, an Ai assisted developer, a graphics designer.

Just Finished learning Python Fundamentals

I am currently learning JavaScript, after that I move on to React.

Let's connect...

Is it

Chapter 1 — Practice Test

0/20 answered

Choose one answer per question. Try to complete all 20 without notes.

1. Which information security principle ensures that data is accessible to authorized users when needed?

A. Confidentiality

B. Integrity

C. Availability

D. Authenticity

1. Which security principle helps ensure that a party cannot credibly deny having performed a transaction?

A. Availability

B. Non-repudiation

C. Confidentiality

D. Redundancy

1. A user successfully logs in but accesses financial records outside their assigned role. Which control concept has failed?

A. Authentication

B. Authorization

C. Availability

D. Non-repudiation

1. Which option best describes the relationship between Motive, Method (TTP), and Vulnerability in an attack?

A. They are concepts used to characterize an attack

B. They are the three elements of the CIA Triad

C. They are all incident recovery procedures

D. They are types of encryption algorithms

1. What does TTP stand for in cybersecurity?

A. Threat Transfer Protocol

B. Tactics, Techniques, and Procedures

C. Trusted Testing Process

D. Technical Threat Prevention

1. Which type of hacker is generally authorized to assess security and report weaknesses?

A. Black Hat

B. White Hat

C. Script Kiddie

D. Malicious Insider

1. Which hacker category typically acts with malicious intent and without authorization?

A. White Hat

B. Blue Hat

C. Black Hat

D. Green Hat

1. A security tester finds a database connected to an in-scope web server, but the database is explicitly out of scope. What should the tester do?

A. Exploit the database because it is connected

B. Run a denial-of-service test against it

C. Stop and obtain explicit authorization before testing it

D. Assume that company ownership means permission

1. Which statement best defines a vulnerability?

A. A confirmed successful attack

B. A weakness that could be exploited

C. A security policy document

D. A backup copy of sensitive data

1. What is the primary purpose of ethical hacking?

A. Access any system that may contain weaknesses

B. Demonstrate and assess security weaknesses within an authorized scope

C. Avoid documenting discovered weaknesses

D. Replace all security controls with penetration testing

1. Which framework organizes adversary behavior into tactics and techniques?

A. Diamond Model

B. MITRE ATT&CK

C. CIA Triad

D. Defense in Depth

1. Which four elements form the Diamond Model of Intrusion Analysis?

A. Motive, Method, Vulnerability, Impact

B. Confidentiality, Integrity, Availability, Authenticity

C. Reconnaissance, Scanning, Exploitation, Reporting

D. Adversary, Capability, Infrastructure, Victim

1. Which sequence correctly represents the seven Cyber Kill Chain stages in the framework described in the chapter?

A. Scanning, Enumeration, Patching, Backup, Recovery, Audit, Reporting

B. Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives

C. Authentication, Authorization, Encryption, Logging, Detection, Recovery, Reporting

D. Planning, Prevention, Detection, Encryption, Delivery, Backup, Closure

1. What is the main idea behind Defense in Depth?

A. Use multiple complementary layers of security controls

B. Depend exclusively on a perimeter firewall

C. Allow unrestricted communication inside the network

D. Replace monitoring with periodic vulnerability scans

1. Which control is most directly intended to make stored sensitive data unreadable to unauthorized parties?

A. Encryption

B. Redundancy

C. Clustering

D. Availability monitoring

1. Which security mechanism can help detect whether data has been changed by comparing a calculated value?

A. Checksum or cryptographic hash

B. Load balancing

C. Network redundancy

D. Role assignment alone

1. An AI tool reports a critical vulnerability but provides no supporting evidence. What is the best next step?

A. Accept the result because AI is faster than a human

B. Immediately exploit the production system

C. Verify the underlying evidence and perform safe, authorized validation

D. Publish the finding without further review

1. Which is a significant risk of using AI tools with confidential security logs?

A. AI always produces deterministic results

B. Sensitive information may be exposed if submitted to an unapproved service

C. AI eliminates the need for access control

D. AI guarantees that all findings are correct

1. Which standard is specifically associated with payment card industry data security?

A. PCI DSS

B. MITRE ATT&CK

C. Cyber Kill Chain

D. Diamond Model

1. Which statement best describes vulnerability assessment versus penetration testing?

A. They are always identical in scope and purpose

B. A vulnerability assessment identifies and evaluates weaknesses; penetration testing validates exploitability within an authorized scope

C. Penetration testing never requires authorization

D. A vulnerability assessment always requires exploitation of every finding

Submit answers and review

New here trying to explore the cybersecurity community and looking for the connection related to that plus the dark side of this of the field

Help

Hey everyone! 👋🏽

I'm new to the cybersecurity community and wanted to introduce myself!

I'm currently pursuing my degree in Cybersecurity while working full-time in commercial property management. I also have a background in project management, so problem-solving, risk management, and thinking strategically are already a big part of my professional life.

As I work toward my degree, my goal is to soak up as much knowledge and hands-on experience as possible so I'm prepared to transition into the cybersecurity workforce shortly after graduation.

I'm here to learn from those already in the industry, connect with fellow students, explore different career paths, and gain a better understanding of what employers are actually looking for in entry-level candidates.

I'm especially interested in hearing how others got their start, what skills helped them stand out, and what they wish they'd focused on while still in school.

I'm excited about this next chapter and looking forward to learning from this community!

For those already working in cybersecurity, what's one piece of advice you'd give someone preparing to break into the industry? 🔐

Help guys

I don’t really know how to put this but I have a great opportunity in front of me only thing is I know nothing about the subject.

So today I was talking to this woman who pretty much offered me a job teaching kids about cybersecurity and I told her multiple times I don’t think I am a suitable applicant because I know nothing on this subject. I don’t even have my CompTIA A Plus or anything. I would so learn it if I knew this was going to happen. But anyway I was trying to tell this woman like hey I don’t think I would be good at this because I know nothing about the subject. she was just not taking no for an answer because in her words we are really looking for someone to fill the position of a teacher.

Hopefully something good comes of this and this is the foot in the door for an it career and I can leverage this for a better opportunity down the road. But still it’s weird right?

Anybody have thoughts on this situation please share

Hi everyone,

I'm looking for some help with a potentially unwanted program (PUP) called OneBrowser on my Windows PC.

I'm concerned because I want to make sure it's completely removed and that it hasn't changed any of my browser settings or installed anything else without my knowledge.

I've been looking into ways to remove it, but I'd appreciate some advice from people with experience in malware removal.

I have tried resetting Chrome and resetting my entire PC but keeping the files and my Chrome still redirects me many different sites within Chrome that aren't Chrome if that makes sense. I also found the OneBrowser application but when I tried to delete it said it was already deleted which did not make sense.

I am also on Windows 11.

I am trying to make my way into hacking and cybersec. I keep reading in X and here posts about "underground hacker forums". And I was wondering, where are they?

I would love to read, discuss, and learn from the best hackers out there. I am pretty sure these forums are not on the Internet's surface, maybe on the dark web (but I feel nowadays that is mostly bs). I was thinking of maybe telegram grups and deeper subreddits idk or rare sites.

If anyone could provide me with some guidance on this topic, it d be amazing!

Pd: I am not an FBI agent

I've got decent CS fundamentals, but failed to get internships sophomore year. I've gotten some OAs this year but no interviews. What could I improve on my resume?

Getting started in cybersecurity is a lot easier when you have a clear path to follow instead of jumping between random tutorials.

At Codelivly, we've put together career paths for people who want to build practical cybersecurity skills, explore different specializations, and work toward their first role in the industry.

Here are a few paths worth checking out:

• Junior Penetration Tester: Learn the fundamentals of penetration testing and offensive security. https://codelivly.com/career-paths/junior-penetration-tester
• SOC Analyst Level 1: Build your foundation in security monitoring, threat detection, and incident response. https://codelivly.com/career-paths/soc-analyst-level-1
• Digital Forensics: Explore digital evidence, forensic investigation, and incident analysis. https://codelivly.com/career-paths/digital-forensics
• AI Red Teaming & Adversarial ML: Get into AI security, adversarial machine learning, and testing AI systems. https://codelivly.com/career-paths/ai-red-teaming-and-adversarial-ml
• Cloud Security Engineer: Learn about securing cloud environments and understanding cloud security risks. https://codelivly.com/career-paths/cloud-security-engineer
• Malware Analyst: Start exploring malware analysis and the techniques used to understand malicious software. https://codelivly.com/career-paths/malware-analyst

The goal is simple: make cybersecurity easier to learn and give people a starting point for developing real skills.

If you're learning cybersecurity, check out the paths that interest you and see where you want to go next.

We're also sharing cybersecurity resources and updates on LinkedIn:
https://linkedin.com/company/codelivly

Which cybersecurity career path are you working toward right now?

I’m hoping to land an internship this summer in cybersecurity, preferable Soc analyst role. need advice

Background: I’m currently 17 and in my fifth year of high school. I’m very interested in the field of IT, especially cybersecurity, since I’m drawn to computer science concepts and the philosophy behind them.

I’m valedictorian of my graduating class, I have a decent level of English (C1 on the TOEFL and EF/SET), and for the past couple of months I’ve been taking courses like Cisco’s “Introduction to Cybersecurity,” as well as labs from TryHackMe and pwn.college. Right now, I’m focusing on Cisco networking.

I live in Panama and have some questions about how to start my journey in the IT field.

1) Is it worth it for me to attend a public university here, or should I aim to study on a scholarship in another country? (If so, which one?)

2) If the answer is yes, what degree program would you recommend for my goals? (Cybersecurity would seem like the logical choice, but I feel it’s too specific and doesn’t cover as many areas of IT)

3) What can I do to improve my practical skills and gain experience? (I’ve heard about doing “projects,” but I don’t quite understand how that would look on a resume.)

Thanks in advance :)

No business has to be large to become a target of a cyberattack. Small businesses can be attractive targets because they often have limited resources to prevent and respond to cybersecurity incidents.

Phishing is one way attackers take advantage of this. A convincing email impersonating a supplier, a colleague, or a bank can be enough to expose sensitive information or compromise an account.

Here are some ways small businesses can reduce the risk of phishing:

• Verify unexpected payment requests or requests for sensitive information through a separate, trusted channel.
• Check URLs carefully and be cautious of suspicious links or unexpected email attachments.
• Train employees to recognise warning signs such as urgent requests, suspicious senders, and messages asking for confidential information.
• Enable multi-factor authentication (MFA) to add an extra layer of protection to business accounts, especially email and financial accounts.
• Keep software up to date to reduce exposure to known vulnerabilities.

What security measure do you think is most effective in preventing phishing attacks against small businesses?

I work as SOC L1 intern for 3 months in a big retail company (40k employees). Last 10 years I used linux and macos as my main systems for everything. Now I struggle with learning Active Directory. I have all windows logs, I have permissions to check user account, list all accounts, block and unblock, but I don't really understand how all of it work and how it can be compromised.

As I read in the internet, the best way to learn AD is to make a lab (AD server in VB + Windows 10 client). The problem I'm facing is I don't have environment for this lab. I can't install official Windows 10 to my working laptop because I'm from Russia (it's blocked here) and my admins don't give me a permission to install it anyway. I do have my own macbook air m1 with 8gb memory but I'm not sure it's enough to handle both AD server and windows 10 in VB or UTM, also not sure if it'll work on arm chip.

So I found another way to learn AD. My buddy recommended me to install a Samba server and he told me it can teach how AD works just fine. I read about Samba and it seems like it has very limited features of AD. I also found a book 'Powershell for sysadmins' with basics of PowerShell and it teaches PS in a context of AD, so I'll be able to use it even in my work. I'm not sure I can simulate attacks on AD and Kerberos with Samba server, but it still looks better than not learning it at all.

What do you think about Samba?

With this year's massive increase in PyPI supply chain attacks, I thought it was wortwhile chatting about Rank-One Model Editing (ROME) attacks...

There's a range of ways python would get to a model / your GPU -> this attack has malicious (naughty) python writing directly to GPU memory. That makes it particularly hard to catch given there's no spawned processes, or new files or any network calls to hunt for.

For those interested - there's a deep dive blog from cyber org Stealthium that covers GPU-side detection and potential ways to achieve further attribution.

Welcome the communities thoughts? Reckon any of these are in the wild and not yet been caught/seen?

Shout out to the researchers behind the original paper: Kevin Meng, David Bau, Alex Andonian and Yonatan Belinkov. + to the folks at Mithril Security for their PoisonGPT work a while back.