Hey everyone, used to work in cyber security as a penetration tester mainly for websites. Quit the job years ago but now I'm itching to get back and do this as a hobby. Need to refresh and relearn some stuff but starting with Linux then networks and some HTB stuff. Wondered if anyone else was up for learning together, or if there are any small groups of beginners. I'm UK based and an adult.

I've had quite a few people interested so rather than replying to each one with my discord, it's vxprpl so just add me.

So a little context about me I'm a web developer with 3 years of experience but I've never felt like it was my thing but I kept doing it because I had to pay college fees and all but with the AI and all i don't want to do it anymore so i want to switch into cyber security it has always interested me but I never had the money to actually commit to it so now my plan is I'll keep my job and learn side by side and save money for the certificate courses. I want a career thats safe from AI and can earn decent money. I cant quit my job because I need the money for my family so is this the right call? also any suggessions for how I should start as I'm complete begineer at this

Hi, i graduated 2 years ago and i have worked for 1 year and 6 month in corporate in two diff roles i am trying to entre into cyber security as its a growing field and has demand is is going to be relevant and remain too, wondering what is the best platform and which course is good, course should be hands on and have projects + a certificate as this will add value in my cv.

I have been checking courses on udemy, simpliearn, and coursera for the past 2 week and reading blogs, watcing content checkin professional experiences along with education of people in the field on linkedn

Hey everyone,

I dropped out of high school a few years ago, but I've had a strong interest in cybersecurity and ethical hacking for a long time. At that time, I couldn't pursue it because I didn't have the hardware or resources. Now I finally have a decent setup and want to learn cybersecurity seriously.

I'm requesting experienced people in this community to spare a few minutes and guide me. I don't just want a generic roadmap—I want to understand how professionals actually learn and build their skills.

A little about me:

• I know Python.

• I've done some data analysis work.

• Other than that, I'm starting from scratch in cybersecurity.

Here are the things I'd really appreciate your guidance on:

1. Roadmap

If you were starting from zero today, what roadmap would you follow? What topics should I learn, and in what order?

1. Learning Resources

This is where I'm most confused.

YouTube has a lot of content, but:

• Many creators don't go deep enough.

• Some information is outdated.

• Due to YouTube's policies, creators can't always demonstrate or explain real-world techniques.

• There are also many fake "cybersecurity" channels.

One channel I genuinely enjoyed is Null Byte, but I'd love more recommendations.

What resources do professionals actually use?

I'm looking for:

• Books (beginner → advanced)

• PDFs (I already have a large collection)

• Websites

• Blogs

• Official documentation

• GitHub repositories

• Labs

• Discord servers

• Forums

• Newsletters

• YouTube channels that are actually worth following

1. Communities

What communities do you follow to stay updated? Reddit, Discord, forums, blogs, or anywhere else?

1. Hands-on Practice

Where should I practice legally? Which labs, CTFs, or platforms would you recommend for beginners?

1. Home Lab & Hardware

What kind of hardware or home lab should I build? What tools and setups do professionals use while learning?

1. Career Advice

What are the biggest mistakes beginners make? If you could restart your cybersecurity journey today, what would you do differently?

Lastly, does anyone know of any legitimate way to get the latest EC-Council certifications (such as CEH) for free or at a significant discount through scholarships, student programs, or community initiatives?

If you have any roadmap, resource dump, GitHub repositories, book lists, websites, or personal advice, I'd really appreciate it. I'm ready to put in the effort—I just want to learn the right way.

Not feeling adequately paid

Hi all. I currently work for an MSP as a Tier 1 Security Analyst. I have a graduate certificate from a college in Cybersecurity Analytics, I have SC-900, Security+, as well as the ThreatLocker CyberHero (which my company requires), as well as the Google Process Cybersecurity Certificate. I currently lead the charge on many things such as assisting our clients in SOC 2 compliance and cyber insurance alignment, policy creation, etc. That being said... I currently am only being paid $24/hr. I have been working here for over 1 year, this is my first Cybersecurity job. Am I being underpaid?

I was thinking of doing edition stuff bit im broke on money.

Our CISO said: every unpatched vulnerability sitting in your backlog is a known issue in a system that adversaries are scanning. The longer it sits more likely they find it before you fix it. A backlog is not a queue, it is a liability inventory with a countdown. The remediation timeline data makes it worse. Attackers are moving from disclosure to active exploitation. One can't close that gap by moving faster or tightening deadlines. Ai generated code is making this worse by expanding backlogs faster than any human led process can address. We are behind because the volume of code coming in has changed. How do teams tackle this not just prioritisation but how you stay anywhere close to the speed?

Most cybersecurity knowledge checks are just answer keys with extra steps.

You read a question. You read the answer. You feel like you learned something. You probably didn't.

The missing piece is pressure. Time limits. A score that compares you to someone else who actually works in security.

I built SecureMind Quiz around that gap. Timed rounds. Four difficulty levels from Cadet to Elite. A leaderboard that resets weekly and monthly so there's always a live ranking worth chasing.

1,000 questions across real cybersecurity categories. Guest play is open - no account needed. But your score only hits the leaderboard if you register.

That distinction matters. The leaderboard is for people who want to benchmark, not just practice.

What's the hardest category you consistently underperform in? Curious whether the community data matches what I'm seeing in early results.

Many beginners start with tools because they provide quick results.

That can be motivating, but it also creates confusion when a command fails or produces output they do not understand.

Before relying heavily on tools, learn the basics of:

1. Networking

Understand IP addresses, ports, protocols, DNS, routing, TCP, UDP, HTTP, and TLS.

2. Linux

Learn file permissions, processes, services, package management, logs, pipes, and basic shell commands.

3. Web applications

Understand requests, responses, cookies, sessions, authentication, APIs, databases, and browser security.

4. Scripting

Basic Python or Bash helps you automate repetitive tasks and understand how security tools work.

You do not need to master everything before touching a lab.

A better approach is:

1. Learn one concept.
2. Test it in a legal lab.
3. Document what happened.
4. Explain the risk.
5. Repeat with a slightly harder challenge.

Tools become far more useful when you understand the system behind them.

What helped you most as a beginner: networking, Linux, web security, or scripting?

Tired of hearing “it depends,” so I built a free tool that gives you an actual recommendation based on your experience and career goals.

No account, email, or credit-card ambush:

https://itcertfoundry.com/resources/security-plus-vs-ccna

ITCertFoundry also has free study plans, labs, cheat sheets, and command guides—with more being added almost daily.

Full disclosure: I built it. Feedback is welcome.

There's a pre-auth RCE (tracked as CVE-2026-63030, chained with CVE-2026-60137 — people are calling it "wp2shell") that hits stock WordPress installs. No plugins, no themes, no login needed. Affects 6.9.0–6.9.4 and 7.0.0–7.0.1.

Exploit code is already circulating publicly, so if you're on an affected version, patching to 7.0.2 (or 6.9.5 if you're staying on the 6.9 branch) should jump to the top of your list today, not this week.

One thing worth flagging: patching stops future exploitation, it doesn't tell you if you were already hit before you patched. If you want to check whether your instance was exposed during the window this was active, SOCRadar has a free checker tool up — no signup, nothing to install, just plug in your domain.

I want someone with a critical eye for threat modeling to take a look at this design and tell me where they see flaws. It's a project built on the Radix ledger that proposes an alternative model to cloud SaaS / PKI / PGP for signing documents and encrypting files.

The point is not the encryption itself (it uses AES-256-GCM, hashing with Blake2b-256, nothing exotic), but the trust model and attack surface:

• Identity: Proven by signing a challenge with a wallet (similar pattern to WebAuthn/passkey), without exposing private keys.
• Server Zero-Knowledge: All computing (hash, encryption, verification) is local (browser). There is no "upload file to server" step, eliminating the backend as a data attack surface.
• Key Management: The key is derived from a deterministic signature on a unique challenge per file (HKDF). There's no database of keys or passwords that can be leaked.
• Transport: P2P browser-to-browser (WebRTC/DTLS), E2EE, no intermediate storage.
• Audit log (Ledger): If required, only the document hash is anchored to the public ledger. Zero content, zero PII.

The authorization flow

The flow to share an encrypted file is as follows:

1. The sender encrypts and sends the ciphertext via WebRTC. The receiver has the ciphertext, but not the key.
2. (Optional) The sender mints an on-chain invitation beforehand for each authorized account, linked to the file's hash.
3. The receiver requests the key by signing with their wallet a challenge derived from blake2b256(headerHash || roomId || networkId). This mitigates replay attacks outside that exact session.
4. That proof is verified against an endpoint (/api/cipher/authorize), which checks against the public network: (a) that the signature is valid, and (b) that the account holds the on-chain invitation. The endpoint is stateless and only returns authorized: true/false.
5. Only if it passes validation, the sender sees the request and has to approve it manually.
6. Upon approval, the sender re-signs the challenge, re-derives the AES-256 key, and sends it once over the established WebRTC channel.

Trust Models Comparison

• vs SaaS signing: You eliminate the provider as custodian of documents/keys.
• vs Traditional PKI: You eliminate dependence on hierarchical CAs and CRL/OCSP. The anchor is the cryptographic consensus of the network.
• vs PGP: You add "live approval". In PGP, if the receiver has the ciphertext and their key, they decrypt without the sender interacting. Here, real-time authorization is required.
• vs MPC Networks (e.g., Lit Protocol): Lit uses threshold nodes to reconstruct keys and improve availability (you decrypt even if the sender is offline), in exchange for trusting the committee. Here, zero third parties touch the key, but if the sender doesn't connect to approve, there's no decryption.

Link to the project documentation: https://radix-community.genkipool.com/en/seal

Here I will be posting my learning that I will learn throughout this journey. I am here to record my growth and will be taking help from the strangers and trying to correct the things which I will be messing up with and correct those mistakes.

Here I will post the context regarding DSA with Cpp and Cybersecurity from very beginning to advanced level.

My current status:

1) Knows the basics of Linux

2) bit of cpp like on a scale 1 to 100 it will be 3.

Hi everyone, I need a hands-on roadmap for breaking into cybersecurity.

I have some experience in SW Development and some knowledge in Linux and Networking.

Thanks.

**Building BugHawk — looking for collaborators 🦅**

BugHawk is an open-source, local-first bug bounty recon workspace — no backend, no accounts, everything in your browser. You paste tool output (httpx, subfinder, nmap, katana) and it organizes, analyzes, and cross-links it into a proper recon dashboard.

Features already in:

→ Subdomain table with status/tech/CNAME/audit tracking

→ JS Recon engine (260+ secret detection rules, AST endpoint recovery)

→ Port scan diffing with CVE hints

→ 350+ Google & GitHub dork templates

→ HTTP header/CORS/cookie analyzer

→ Attack surface graph

→ Findings tracker

What I'm building next — and where I need help:

**A subdomain collection script** that runs recon tools and pushes results directly into the BugHawk dashboard, so you don't have to manually copy/paste anything. Fully automated pipeline from recon → dashboard.

This is a vibe-coded project — built fast, shipped in the open. I want people who like to build and break things, not sit in meetings.

Looking for people with:

- Security / bug bounty background

- Python, Node.js, or bash scripting skills

- Interest in recon tooling, CLI tools, or frontend (React)

If this sounds like your thing, reply or DM me.

🏛️ For years, there’s been a bizarre kind of "shame" in the enterprise software world around Delphi. Companies running massive, highly profitable, and rock-solid systems (especially in Retail POS, ERP, and Banking) often hid their code stack under the rug to look more "modern" to investors and new hire.

🏛️ But the European Cyber Resilience Act (CRA) and DORA are about to change the game entirely.

🏛️ You can’t hide a monolith when the regulator demands a comprehensive SBOM (Software Bill of Materials).

🏛️ Pretty soon, Europe is going to experience the biggest outing of Delphi-based applications in history. As Billions of lines of code get scanned and mapped, regulatory desks will be absolutely flooded with SBOMs proudly displaying legacy Delphi framework, legacy VCL components, BPLs, and legacy 3rd party libraries that have been quietly running the backbone of the economy since 1995...

🏛️ The regulator won't be able to stop it. They’ll just have to look at the sheer volume of the market and say: "OK, I get it. It works, it's alive, just scan your code and hand me the SBOM report (I will file it somewhere...) - and BTW make sure it's secure."

🏛️ It's time for Delphi developers to step out of the shadows. The "FDA of software" isn't killing legacy tech - it's giving it a passport to the modern regulatory compliance era.

Cheer up! The CRA & DORA are the best news for the Delphi community that ever happened.

Hey everyone,
How many of you got into cybersecurity because you genuinely wanted to make a difference, but ended up feeling boxed in by corporate bureaucracy, endless compliance checklists, or gatekeeping?
The industry talks a lot about "defending the world," but day-to-day work often feels disconnected from that mission. We wanted to change that.
That is why we built NullSec.
We aren't just another casual chat room or a standard study group. NullSec is a collective of builders, breakers, and thinkers who are tired of just talking about cybersecurity challenges and are actively working on changing the landscape.
What We Focus On:
Real-World Impact: Moving beyond theory to tackle actual security problems and research that matters.
Collaborative Growth: Whether you are an experienced operator or someone pivoting into the field with a passion to learn, we believe in lifting each other up through hands-on projects.
A Culture of Action: Less ego, more execution. We value curiosity, grit, and a genuine drive to secure the digital world.
Who We Are Looking For:
We are opening our doors to people who want to take that chance and step up. You don't need to know everything on day one, but you do need:
A strong ethical compass and a passion for security.
The dedication to contribute actively to group projects and research.
A willingness to learn, collaborate, and push past your comfort zone.
How to Join:
If you are ready to stop watching from the sidelines and want to be part of a group that is actively making a change, drop a comment below or send a DM telling us a bit about your background, what area of cybersecurity excites you most, and why you want to join NullSec.
Let’s build something better.

​

I expected a technical lesson. Instead, I got one of the most valuable lessons about learning itself.

Today's lesson explained the four traps that make most people quit cybersecurity—not because it's too difficult, but because they approach it the wrong way.

I immediately recognized myself in tutorial hell. Spending too much time watching and too little time practicing has slowed my progress more than I realized.

The one insight that stayed with me:Small, consistent progress every day will always outperform occasional bursts of motivation.

Consistency beats intensity. Every time. For the next 90 days, I'm committed to showing up, learning, and improving—one day at a time.

#MyFirstHack #CyberSecurity #LearningInPublic #90DaysChallenge #InfoSec #TechLearning #Consistency #CareerGrowth

As someone who is looking to try out capture the flag competitions and eager to learn and compete, I am occupied by the thought of AI's role in the skill aspect of competitions, so I want to know the role of AI in CTF, is it still mostly the player's skill and knowledge that matters the most or just how long they work and how many questions they ask AI.

When people hear "Data Loss," they usually think about hackers

But that's only one possibility.

- A failed hard drive.

- Accidentally deleting a folder.

- A ransomware attack.

- Even dropping your laptop.

Any of those can make years of work disappear.

That's why backups aren't just for companies.

They're for anyone who has files they don't want to lose.

What's the worst data loss you've ever experienced?

22 years old. I'm torn on what certification path to take into Cybersecurity and could really use advice from people already in the field.

The biggest reason I'm asking is because I recently had a conversation with our IT Security Director about how to break into cybersecurity.

I asked him what he thought I should study first, expecting him to recommend Security+ or CySA+. Instead, he told me to pursue CCNA or CISSP. I asked him if CCNA was really an acceptable path into cybersecurity since it's primarily a networking certification, and he said absolutely. He explained that he started his own career in a Network Operations Center (NOC) before transitioning into cybersecurity, and that building a strong networking foundation was one of the best decisions he made.

Now I'm conflicted.

Almost everywhere online I see people recommending Security+ followed by CySA+, but that's the opposite of the advice I received from someone who leads our company's security team. I don't want to ignore advice from someone who's already built the career I'm trying to achieve, but I also don't want to overlook certifications that many employers ask for.

For some background, I graduated from Wayne State University in May 2026 with a B.S. in Business Administration with a major in Technology Information Systems & Analytics.

In March 2026, I landed my first IT job as a Tier II Desktop Support Technician at the corporate headquarters of a company with approximately 9,000 employees. Over the past few months, I've taken on increasing responsibilities and have since become the senior desktop support technician on my team.

Some of the experience I've gained includes:

• Windows laptop, desktop, tablet, scanner, and peripheral provisioning
• Windows 10 to Windows 11 migration and hardware refresh projects
• Microsoft Intune / Endpoint Manager
• Windows Autopilot deployments
• Microsoft Entra ID (Azure AD)
• Active Directory administration
• Microsoft 365 administration
• New hire onboarding and employee offboarding
• User account provisioning and deprovisioning
• Enterprise software deployment and license management
• Executive support for the CEO, CTO, and other executive leadership
• Remote support and troubleshooting
• VPN and remote connectivity troubleshooting
• Enterprise VoIP phone support, activation, troubleshooting, and replacements (8x8)
• Hardware ordering, deployments, replacements, and lifecycle management
• IT Asset Management (ITAM), asset tracking, and inventory management
• Printer support and troubleshooting
• Basic Cisco Meraki administration, switch ports, VLAN verification, and network troubleshooting
• Multi-factor authentication (MFA) support
• Technical documentation and Knowledge Base creation
• Help desk ticket management and root cause analysis

Ultimately, my goal is to become a Cybersecurity Analyst (SOC / Blue Team).

If you were in my position, would you follow my Security Director's advice and start with CCNA, or would you still pursue Security+ first?

More importantly, why?

I'd really appreciate hearing from people who currently work in cybersecurity or who made the transition from desktop support.

Some people call it “being too responsible,” others just say “He just likes his job too much.” Either way, just like any excess in life, working too much hurts you and the people around you.

A cybersecurity leader shares how workaholism and constant availability hurt his team’s growth, and why true leadership means letting go.

​

A lot of developers focus on writing clean, readable, and maintainable code

That's a good habit

But clean code doesn't automatically mean secure code

A beautifully written application can still be vulnerable to SQL injection, Cross-Site Scripting (XSS), broken authentication, or insecure file uploads

Security isn't just about how your code looks

It's about how your application behaves when someone tries to break it

Secure coding starts with thinking about security from the very beginning not after deployment

What's one secure coding practice every developer should learn early?

Many beginners finish labs but have nothing useful to show afterward.

Would it be better to document:

• The objective
• Initial assumptions
• Tools used
• Commands attempted
• What failed
• What worked
• The security impact
• Recommended remediation

What makes a beginner lab write-up valuable to recruiters without becoming a copied walkthrough?