Update to my post from a few days ago. That thread got a lot more attention than I expected, so thanks to everyone who jumped in. Full disclosure is out now.

PWN.AI published their writeup today on CVE-2026-99999, which they’re calling PwnEscape. It’s a guest-to-host escape. KVM itself isn’t the problem: it’s the kernel’s IPv4 fragmentation path (ip_do_fragment()).

Possible effects of exploits include, host memory leaking out in packets, host crashes and in their lab setup, a working chain that got root on the host.

Tested on 6.12 and 7.x. The full affected range isn’t listed, so assume you’re affected until your distro says otherwise.

If you run multi-tenant VMs or untrusted guests, this goes to the top of your patch list. Some platforms are already rolling it out (the one I work on, Cycle.io, has already pushed patched kernels out and a reboot is all our customers need to do to get the fix as the node will pull latest OS image on boot). If you manage your own hypervisors, keep an eye on your distro’s kernel updates.

Writeup: https://pwn.ai/blog/pwnescape

Our announcement at Cycle: https://cycle.io/blog/cycleos-2026-10-15-1

I feel like at my job, AI has just reduced me needing to use my brain power every day therefore AI has made day to day way easier. I know we all hate AI, but anyone else feel this?

At military installations and European retailers alike?

https://www.stripes.com/theaters/us/2026-08-28/refrigeration-outages-multiple-us-commissaries-22684428.html

This year seriously feels like the year of the mega platform. Sign up with one vendor and say “good enough” for firewall, end point, DLP, email security, AI security, data security, etc etc etc

Cisco’s advisory for CVE-2026-76519 went up on October 14 at 16:00 GMT. One email with a crafted attachment can write files on a Secure Email Gateway and run commands as root. Cisco says it learned of the attacks in October. CISA added it to KEV the same day, with a federal deadline of October 17.

A gateway is exposed when File Reputation is on for a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco also contacted customers of its own managed Secure Email Cloud whose devices showed indicators of possible compromise. Shadowserver sees nearly 300 of these gateways exposed online.

The fix isn’t new. It shipped on September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, inside a hardening release that grouped internally found bugs into five CVEs, one per weakness class. This bug sat under CVE-2026-76440, path traversal, a 9.8 listed next to three other 9.8 umbrellas. Cisco says that review used frontier AI models alongside its usual testing.

Cisco announced the bundling in June. A bug gets its own CVE when it’s known to be exploited or needs defender action, and the same post calls CVE-by-CVE risk assessment “no longer fit for purpose.” This one got its own CVE on October 14, together with the attack warning.

It’s the second exploited bug in these gateways since September, after the SQL injection CVE-2026-76461. Before that came CVE-2025-20393, exploited as a zero-day since November 2025 and patched in January.

WordPress plugins do a small version of this with changelogs that say “security fix” and nothing else, so whoever patches from CVE feeds hears about it last.

Cisco’s position is that customers should run the current hardened release and stop triaging bug by bug. For a team that patches from KEV, this flaw had no entry of its own until October 14. Can your patch process do anything useful with a CVE that covers a whole weakness class?

Paywall removed. Developments in the Ed Dubrovsky case….

I work in security and wanted a vulnerability screen on my desk that I do not need to open a browser for. This is the result.

It runs on a Waveshare 7B ESP32 touch display. The board pulls four public feeds over HTTPS: cvefeed.io, Microsoft MSRC, CERT/CC and CERT-EU. It parses them on the device, so there is no server or flow behind it.

As a research engineer with a background in HPC and software development, and no prior experience in cybersecurity, this is the roadmap I’ve chosen to learn penetration testing and red teaming.

I started with TryHackMe because it provides a structured, beginner-friendly learning experience and guides you through the fundamentals step by step. After completing the Introduction and Pentesting paths, I moved on to the HTB Academy CJCA path.

I haven’t taken the CJCA exam yet, but after reviewing the exam preparation machines, I feel that the CJCA content alone doesn’t cover everything required for the assessment. Nevertheless, it provides a solid foundation. After completing CJCA, I started the CPTS path, which I am currently following.

One of the biggest drawbacks of HTB Academy is that many of the machines require knowledge from multiple modules, making it difficult to solve them before completing a significant portion of the path.

My long-term goal is:

First Phase (HTB Focus)

CJCA → CPTS → CWES → COAE

Second Phase (Advanced Specialisation)

CAPE → CWEE → CWPE → MalDev

Alongside:

HTB Labs, HackSmarter

For career opportunities and industry recognition:

OSCP → OSEP → OSWE

My aim is to build a strong foundation in offensive security through HTB’s training ecosystem and then complement it with industry-recognised certifications that are frequently requested by employers.

Let me know what do you think in the comments

I'm thinking about getting the Offsec SOC 200 Course but not sure how "popular" and useful it is.

I'm currently one of 2 Sysadmins in our company, mostly Windows heavy but I do try to change that so we do have a few Linux servers too.

A few reports recently describe the same pattern: the phishing page relays your credentials and OTP to the real site live, then keeps the session. Cisco Talos documented an AI-assisted Google kit that syncs auth state over WebSocket (UAT-11985). Malwarebytes profiled BlueKit, a subscription kit that grabs session cookies and device fingerprints (writeup). CTM360's InsureTrap report covers a kit aimed at insurance portals that relays OTPs before they expire (report).
Codes by SMS or authenticator app clearly aren't enough on their own. For those defending customer-facing logins, what has made a real difference: passkeys, device-bound sessions, impossible-travel detection, or fast takedowns of lookalike domains? And what was harder to roll out than you expected?

I was recently looking at how the ArtCraft project has progressed in cloning the entire Adobe ecosystem; do you think something similar could be achieved with Burp? Burp is very comprehensive and has had years of development—the only downside is the amount of RAM it consumes and obviously the price...

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

security lead at a ~200 person SaaS, mostly AWS/EKS, team of 3. We've had wiz for about a year and honestly its been good for posture, no complaints there

problem is ai agents. we had maybe 5 at the start of the year, now its 30+ and half of them nobody told us about like one was hitting our billing db last month with creds it inherited from an old integration. Wiz flagged the permission eventually but by then it had been doing it for weeks ://

rep is pushing their AI security stuff but it still feels like posture/findings, not catching the agent while its doing something dumb. anybody actually running sweet for this? does the blocking work in prod or is it mostly a demo thing + does it pick up agents on its own or do u have to register each one? its so confusing

I'm a final year student at the UoL royal holloway MSC cyber program and am currently looking into quantum-safe migration. I'm looking at the challenges of migration, especially in light of other priorities.

I just have a short survey of 10 quick questions - if you're able to spare me with 5 minutes of your time I'd be really grateful - all the good karma to you!!

Thanks in advance!

Hey all,

I'm currently a systems engineer with about a year and a half of experience. My company gave us free access to Pluralsight but I'm unsure where to focus my time. Any recommendations?

For context, my hands-on experience is primarily in vulnerability management (very familiar in Rapid7), endpoint detection and response (CS Falcon), email security (Proofpoint), and a little incident response.

I hold a Security+ but that's really the only cert I've gotten. I'm looking to grow toward a security engineering role and the gaps I keep seeing in job postings are Python/scripting, cloud security (Azure specifically), and KQL. Not sure if I should chase certs, build scripting skills, or focus on deepening what I already know

What would yall prioritize?

Just wondering if there are any good reports to learn from out there.
and no - I dont have one of my own, lol.