FBI probes dark web site selling millions of US and Canada drivers' licenses

I am the IT Director for our team of ~100. I have pretty boring rule that we don’t send anything by email that can be used to access any system: no passwords, no PINs, no API keys, no SSH keys, no client secrets for Azure Ent Apps. I often get push back from leadership, end users, colleagues at other orgs, and internet randos. The most common response is some variation of: “my email is secure. What’s the problem?”.

Given how many times I have seen people’s emails get compromised, I don’t trust that it’s very secure at all.

This was an interesting article I wanted to share with people in case you never saw it. Happy reading, Holly xxx

It’s the largest documented surveillance wave in Serbia to date.

Hi everyone, I just have a quick question i’ve been wondering about. If you’re working towards becoming a cybersecurity engineer and you’re building your experience towards it by following a path like 2 years helpdesk → 2 years system admin → 1 year cybersecurity analyst, and the the job market gets bad and you’re laid off, what happens then? If cybersecurity analyst jobs are mostly mid-level and you’re competing against people with 3–5 years of security analyst experience, and you only have one year of cyber security analyst experience , and you face the same problem when applying for system admin jobs because you only have 2 years of experience, are you basically out of luck? Would my only choice be to fall back down to helpdesk? How does this type of career progression and accumulated experience work during a bad job market?

I know IT is different from many other fields because you often have to work your way up the ladder instead of starting directly in the role you ultimately want. This means your earlier experience may not be directly in your target field. Since experience becomes especially important in a bad job market, how does that affect someone in IT who is progressing through different roles?

Looking for something i could listen to for 20-30 minutes with whats going on in the world of cyber. Everything i get referenced is like 2 hours long.

I use bleeping computer generally but wanted something while im driving.

Been reading into x402, the protocol a bunch of AI agent frameworks use so agents can autonomously pay for APIs and tools. Found an arXiv writeup from May that tested it against real SDKs and live endpoints, not just theory, and it's rough. Five attack classes worked, including replay and authorization bypass.

The one that stuck with me isn't even the flashy exploit stuff though. Agents just overshare. They'll stuff PII into payment metadata because nobody told them not to, and that rides along on a public, irreversible payment rail with nobody watching it.

We're moving fast toward "let the agent hold the card" as a default and the security tooling hasn't caught up. No equivalent yet of what we take for granted with normal payment infra, spend caps that mean something, PII scrubbing, per-agent rate limiting. I've actually been messing around building something for exactly this (pennywall.io if anyone's curious), mostly because I got annoyed nothing existed for it.

Paper's here if you want the breakdown: https://arxiv.org/html/2605.11781v1

Anyone running agent payments in prod right now? What are you doing about this, or is everyone just hoping it's fine?

What are some AI security tools or vendors out there that cover agentic security, Shadow AI and MCP security? Looking for enterprise grade tools, I have found a few but looking for more I may have missed

I started a blog series to provide free insights into appsec. It’s mainly to breakdown what application security is all about and it’s mainly targeted towards beginners and startups, so take it as you will.

Just want to teach every one interested in appsec my perspective on it from my experience in big tech. I talk about the importance of Application Context aka understanding what your application is doing.

I can dive into any topic anyone is interested in. Just let me know what sort of topic you’d like me to dive deeper into. Thanks!

Hey everyone!

My team of 6 is participating in Smart India Hackathon 2026, and we're currently stuck between a few cybersecurity problem statements.

Our biggest constraint is only 36 hours to build the prototype, so we're trying to balance technical depth, innovation, feasibility, and winning potential.

We're currently considering:

1. SIH26145 – AI-Based Detection of Cyber Threats in Unidirectional IP Traffic

Passive monitoring of one-way network traffic

Detect DDoS, port scanning, DNS tunneling/DGA, C2 beaconing, encrypted-session anomalies, exfiltration

AI/ML + behavioral analysis

Live SOC-style dashboard

No decrypting traffic or interacting with the network

1. SIH26153 – AI Based Network Attack Forecasting from Network Traffic Data

Predict future network attack progression rather than just detecting attacks

Uses network traffic features and ML/deep learning

Potentially maps predictions to MITRE ATT&CK stages

More research-oriented and technically ambitious

1. SIH26106 – AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform

Phishing/spoofing/BEC detection

Email header and protocol analysis

IP/domain intelligence and geolocation

Threat correlation and forensic reporting

Potential graph-based campaign/infrastructure analysis

1. SIH26155 – AI-Driven Multi-Vendor Network Security Compliance Auditor

Analyze firewall/router/switch configurations from different vendors

Map configurations against security standards

Detect misconfigurations and generate remediation commands/reports

We're leaning toward SIH26145, but I'm wondering if we're overlooking something.

For people who have participated in SIH, hackathons, cybersecurity competitions, or similar events:

Which one would you choose?

Which has the best winning potential?

Which is realistic to execute well in 36 hours?

Which one gives the best combination of technical depth + innovation + strong demo?

Would you prioritize a technically ambitious PS or one that can be polished much better within the time limit?

I'd especially appreciate opinions from people who have actually participated in SIH or judged hackathons.

Thanks!

Hey everyone,

I’m looking to find a good Discord, Slack, community, or online group for cybersecurity professionals where people regularly share and discuss what’s happening in the industry.

I’m not looking for something focused on one specific area of cybersecurity. I’m more interested in a general community where I can:
● Keep up with the latest cybersecurity news and major incidents
● Learn about new vulnerabilities, exploits, breaches, ransomware, and threat actors
● Follow new developments in AI and how AI is affecting cybersecurity
● See interesting tools, research, and security developments
● Discuss interesting incidents and learn from other security professionals
● Share things I’ve come across and get different perspectives
● Generally stay current with what’s happening in cybersecurity

I’ve been in cyber for 5 years and I’m mainly looking for a community where people actually talk and exchange knowledge, rather than just a place where links get posted with little discussion.

If you know of a good community like this, I’d really appreciate the recommendations.
Thanks!

Took a job I’m not already comfortable with a few months back and actively looking for something more ethical in nature and in general, but recently I’m having more thoughts …

I was taking a CPE training today and the topic was a camera/ai software company that makes systems for businesses that look for patterns and some of the examples are warehouse workers without ppe , kitchen workers who touch their phones in the kitchen etc … while these examples seem like reasonable use cases to me I feels very much like a slippery slope that make more people subject to micro managing, and surveillance at every corner along with the whole farms around flock cameras.

Just today I was at work and 2 coworkers were having a conversation about a group of people ( that I happen to be a part of ) and it was a very political/racist convo between them , I continued to work but a phrase was said that actually gave me chills and I continued to work as if it’s normal.

But since all of that I feel like I am part of a system that is toxic , evil , and not sitting well with me,

I have over a decade of work experience and feel like only healthcare is a industry where cyber makes a world a better place ( ofc with caveats) , I have a good salary, and good experience, but I’m questioning leaving both bc of the combination of what I’m seeing and experiencing in the world of tech and cyber.

How do I go about my career , I want a change but I also am not exactly in the best position bc of a few other things in life that requires a level of stability and income etc

Would you leave a Fortune 500 company making 100k as a SOC analyst to go work at a Private equity back hospital getting paid 50% more as a cybersecurity manager wanna hear the thoughts and comments

Started out as a security engineer 1 then promod to Security engineer 2 a year ago.

I'm looking for another job. Should I be applying to mid level career roles or senior roles?

I would say that I have had pretty meaningful projects.

Any position is not invincible, but are there areas of cybersecurity, like GRC, that will have the most long-term resiliency and growth?

How do you evaluate software delivered by third-party development vendors?

I see a lot of organisations outsource software development to third-party vendors.

I'm curious how organisations evaluate the quality and security of the software they receive — not just the vendor itself.

For example:

• Do you review the source code?

• Do you generate and review an SBOM?

• Do you scan dependencies for known vulnerabilities?

• Do you check what third-party libraries/components are packaged inside the application?

• Do you perform SAST/DAST or other security testing before deployment?

• Do you have specific security requirements in the vendor contract?

• Do you continuously reassess the software after delivery?

It seems that selecting a trustworthy vendor is only one part of reducing software supply-chain risk. The actual application delivered by the vendor can still introduce vulnerabilities, outdated dependencies, or unexpected components.

How does your organisation handle this in practice?