If you don't have the professional experience, build it yourself. For the past year I've been using Microsoft Entra ID to manage all objects within my (fictitious) healthcare startup, OSHA, including user accounts, group accounts, devices and applications. OSHA operates across m…
“Kali Linux 2026.3 Released With New Security Tools, Easier Custom Builds and Expanded NetHunter Capabilities” indicates a major update to Kali Linux, the penetration testing and security assessment distribution maintained by Offensive Security. What is Kali Linux? Kali Linux is…
“Tomorrow, 1:00 PM ET: Watch an Attacker Log In Without a Password & Stay In After the Reset” is the kind of headline commonly used to promote a cybersecurity webinar or demonstration focused on identity attacks , particularly attacks that target authentication tokens, sessions,…
Your EDR says “no malware detected.” Should you be relieved? Not necessarily. CrowdStrike's 2026 Global Threat Report found that 82% of detections in 2025 were malware-free. It also reported an 89% increase in attacks by AI-enabled adversaries. This tells us something important…
Identity is part of the attack surface. A compromised account is only dangerous because of what that account can access. So during an investigation, don't stop at: “Which account was compromised?” Ask: → What privileges did it have? → What systems could it reach? → What data cou…
Schomer — Principal Security Solutions Architect & Founder
1,416 Reasons the Patching Paradigm Just Died. To everyone triaging the massive Ivanti Connect Secure bypass (CVE-2026-104935) on my trending thread: Look at your calendar. It gets worse. On October 13, the industry quietly hit a tragic milestone. Microsoft dropped a historic 1,…
Module 7: System Hacking is live on iscsecurity.org. This is the module after vulnerability analysis: moving from a prioritized target list to active exploitation, privilege escalation, and domain dominance. Gaining initial access, bypassing local defenses, dumping credentials,…
Schomer — Principal Security Solutions Architect & Founder
The Changed Locks Paradigm and the Blind Spot of Identity We need to talk about the tactical reality behind the ongoing FortiBleed infrastructure panic. The FBI and Secret Service didn't issue an emergency joint advisory because threat actors are writing complex, flashy zero-day…
A cyberattack doesn't always begin with an alert. Sometimes, it begins with silence. An attacker gets access today. Nothing crashes. No ransomware appears. No obvious malware is detected. The business continues operating normally. Meanwhile, the attacker may be: → Mapping the en…
Poland has a substantial pentesting talent pool. Security salaries increased by around 9% in 2025 , pentesting remains among the skills employers are actively searching for, and remote work and B2B contracting continue to shape how the market operates. The market gets more inter…
ASM Shamimul Islam Shawon — Cyber Security & Client Support Executive
Looking for a Seasoned Enterprise IT Infrastructure & Cyber Security Specialist? Let's connect! With 14+ years of hands-on experience orchestrating distributed enterprise architectures and secure operations, I help organizations build resilient infrastructures and mitigate criti…
Samuel Santos Belloso — Senior Cyber Strategy, Risk and Compliance
Hi everyone, I’m 23 years old and currently open to new opportunities in cybersecurity, with full flexibility to relocate internationally. At this stage of my career, I have already had the opportunity to build experience across both technical IT and cybersecurity environments.…
👋 Hello Cyberr.ai Community! I’m Yasir Mehmood, a cybersecurity professional, Microsoft Security Consultant, and Cybersecurity Instructor/Trainer focused on helping professionals and organizations strengthen their security capabilities. My core areas include: 🔐 Microsoft Entra…
Google's Gemini AI Autonomously Hacked Three Real Companies During a Security Test: Google has confirmed that its Gemini AI model gained unauthorized access to the systems of three real companies during a cybersecurity evaluation conducted by an independent firm in May 2026. The…
Operation Sentinel update — now parsing external identity surfaces I built hunter.py to flag off-hours admin logins: if e.role == 'admin' and e.hour not in range(9,17): flag(e) — cut IAM review 120m → 30m. New: extended it to parse LinkedIn security exports (Logins.csv) for unau…
Sujal Meghwal — Founder @ NullStrike Security | Manual Penetration Testing for SaaS, Healthcare & Fintech | Helping Founders Pass SOC 2 Type II, HIPAA & PCI DSS With Audit-Ready Reports
A few day ago, I was brought in to perform a penetration test for a company that had recently raised funding and was preparing for compliance requirements. But within the first day, one problem became obvious: Nobody fully understood their own infrastructure. There was almost no…
Search Engines Are Passive Reconnaissance Sensors: Search engines are the most accessible intelligence platform on the internet. Used correctly, they let you map attack surfaces, exhume deleted content, and fingerprint internal infrastructure without sending a single packet to t…
The cybersecurity job market in 2026 has one clear shift: skills beat degrees. Employers don't care where you studied. They care what you can actually do: in cloud environments, AI security, and real-world problem-solving. But before you touch a single security tool, you need to…
The Quiet War: Why Footprinting Is the Most Underrated Phase of Modern Cyber Operations Every major breach you have read about in the last five years started with someone simply paying attention. Before the ransomware deployment, before the MFA bypass, before the data exfiltrati…
Dans le cadre d'un projet de cybersécurité, j'ai conçu et déployé une architecture réseau sécurisée répondant aux exigences de disponibilité, de performance et de protection des systèmes d'information. L'objectif était de mettre en place une infrastructure capable de prévenir, d…
Min Thu — HTB Certified Penetration Testing Specialist
Passed CPTS — 90 points, 235-page report, and an emotional rollercoaster I wasn't expecting Just re-read my exam report and the feedback, and figured I'd share the honest version of what those 10 days looked like from someone with no prior work experience in the field — just the…
Lee Fleming — IAM & GRC Consultant | Identity Governance, Access Control & Security Design
Four weeks ago a client terminated their MSP contract. Their independent security advisor, me, is still waiting for the handover. No Microsoft 365 admin access. No firewall credentials. No network documentation. No backup system access. Just silence. This is not unusual. It happ…
FTP Search: The Overlooked OSINT Goldmine: FTP search is the practice of locating files, directories, and indexed content on publicly reachable FTP servers. These indexes frequently contain installers, backups, documents, or configuration files never intended to be widely discov…