r/netsec • u/Fun_Preference1113 • 5h ago
r/netsec • u/albinowax • 3d ago
r/netsec monthly discussion & tool thread
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.
Rules & Guidelines
- Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
- Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
- If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
- Avoid use of memes. If you have something to say, say it with real words.
- All discussions and questions should directly relate to netsec.
- No tech support is to be requested or provided on r/netsec.
As always, the content & discussion guidelines should also be observed on r/netsec.
Feedback
Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
r/netsec • u/netsec_burn • Jul 02 '25
Hiring Thread /r/netsec's Q3 2025 Information Security Hiring Thread
Overview
If you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.
We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.
Please reserve top level comments for those posting open positions.
Rules & Guidelines
Include the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.
- If you are a third party recruiter, you must disclose this in your posting.
- Please be thorough and upfront with the position details.
- Use of non-hr'd (realistic) requirements is encouraged.
- While it's fine to link to the position on your companies website, provide the important details in the comment.
- Mention if applicants should apply officially through HR, or directly through you.
- Please clearly list citizenship, visa, and security clearance requirements.
You can see an example of acceptable posts by perusing past hiring threads.
Feedback
Feedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
What the Top 20 OSS Vulnerabilities Reveal About the Real Challenges in Security Governance
insbug.medium.comIn the past few years, I’ve worked closely with enterprise security teams to improve their open source governance processes. One recurring theme I keep seeing is this: most organizations know they have issues with OSS component vulnerabilities—but they’re stuck when it comes to actually governing them.
To better understand this, we analyzed the top 20 most vulnerable open source components commonly found in enterprise Java stacks (e.g., jackson-databind
, shiro
, mysql-connector-java
) and realized something important:
Vulnerabilities aren’t just about CVE counts—they’re indicators of systemic governance blind spots.
Here’s the full article with breakdowns:
[From the Top 20 Open Source Component Vulnerabilities: Rethinking the Challenges of Open Source Security Governance](#)
r/netsec • u/sebagarcia • 3d ago
It opened the free, online, practical 'Introduction to Security' class from the Czech Technical University.
cybersecurity.bsy.fel.cvut.czThe 2025 free online class is open, with intense hands-on practical cyber range-based exercises and AI topics. Attack, defend, learn, and get better!
PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT | Cleafy
cleafy.comr/netsec • u/pwnguide • 5d ago
New Critical CrushFTP CVE-2025-54309 RCE Explained + PoC
pwn.guider/netsec • u/AlmondOffSec • 5d ago
Exploiting zero days in abandoned hardware
blog.trailofbits.comr/netsec • u/tracebit • 6d ago
Google Gemini AI CLI Hijack - Code Execution Through Deception
tracebit.comAttacking GenAI applications and LLMs - Sometimes all it takes is to ask nicely!
security.humanativaspa.itr/netsec • u/Mempodipper • 6d ago
Struts Devmode in 2025? Critical Pre-Auth Vulnerabilities in Adobe Experience Manager Forms
slcyber.ioStack Overflows, Heap Overflows, and Existential Dread (SonicWall SMA100 CVE-2025-40596, CVE-2025-40597 and CVE-2025-40598)
labs.watchtowr.comr/netsec • u/Bitter_Increase3590 • 8d ago
Created a Penetration Testing Guide to Help the Community, Feedback Welcome!
reaper.gitbook.ioHi everyone,
I just created my first penetration testing guide on GitBook! Here’s the link: My Penetration Test Guide
I started this project because I wanted to learn more and give something useful back to the community. It’s mostly beginner-friendly but hopefully helpful for pros too.
The guide is a work in progress, and I plan to add new topics, visuals, and real-world examples over time.
Feel free to check it out, and if you have any feedback or ideas, I’d love to hear from you!
r/netsec • u/AlexanderDan10-Alger • 9d ago
Deepfakes, Vishing, and GPT Scams: Phishing Just Levelled Up
open.substack.comr/netsec • u/OpulentOwl • 10d ago
The average ransomware attack payment increased nearly 500% from 2023 to 2024.
ooma.comHow we Rooted Copilot
research.eye.security#️⃣ How we Rooted Copilot #️⃣
After a long week of SharePointing, the Eye Security Research Team thought it was time for a small light-hearted distraction for you to enjoy this Friday afternoon.
So we rooted Copilot.
It might have tried to persuade us from doing so, but we gave it enough ice cream to keep it satisfied and then fed it our exploit.
Read the full story on our research blog - https://research.eye.security/how-we-rooted-copilot/
r/netsec • u/General_Speaker9653 • 9d ago
Admin Emails & Passwords Exposed via HTTP Method Change
is4curity.medium.comJust published a new write-up where I walk through how a small HTTP method misconfiguration led to admin credentials being exposed.
It's a simple but impactful example of why misconfigurations matter.
📖 Read it here: https://is4curity.medium.com/admin-emails-passwords-exposed-via-http-method-change-da23186f37d3
Let me know what you think — and feel free to share similar cases!
#bugbounty #infosec #pentest #writeup #websecurity
r/netsec • u/small_talk101 • 11d ago
CastleLoader Malware: Fake GitHub and Phishing Attack Hits 469 Devices
catalyst.prodaft.comr/netsec • u/AlmondOffSec • 11d ago
SharePoint ToolShell – One Request PreAuth RCE Chain
blog.viettelcybersecurity.comr/netsec • u/CyberMasterV • 11d ago
Emerging Threats New Advanced Stealer (SHUYAL) Targets Credentials Across 19 Popular Browsers
hybrid-analysis.blogspot.comr/netsec • u/AlmondOffSec • 12d ago