Currently several PHP zero days are floating around that effect PHP 5.x to 8.x, therefor all resources using PHP will be turned off until official patches are released and installed.

For a better read, please see:

https://www.reddit.com/r/sysadmin/comments/1xb4jgg/upcoming_php_core_rce_vulnerability_patches/

For more information on the POC if you want to be curious and test, you can visit our discord and read the NEWS channel

Hello, I am seeking help with a very complicated problem. Some time ago, I heard someone calling for help at my neighbors' house and responded by signaling with my hands. To my surprise, the person calling for help signaled back. The trouble began when I checked my phone and discovered it had been hacked. I started receiving questions via "Reels" (short videos); I would respond to them, and subsequent Reels would contain replies to what I had said. Later, a video appeared detailing the individuals allegedly involved; I recognized some of them based on the descriptions provided. The situation escalated when I began receiving more threatening Reels—videos warning that they were coming for me, that they intended to kill me, and even images showing a refrigerator containing what appeared to be human remains. I tried to call the police, but the line would cut out every time I attempted it. When I tried again from my phone, my own phone number, location, and coordinates appeared on the screen. Afterward, more threatening videos surfaced, claiming that within 24 hours, a group of seven people would arrive at my home to take me away and "carry out my sentence." I went into a state of high alert and reached out to some friends, who provided support at that time. Meanwhile, various information kept appearing on my phone—names (such as Lucia, Laura, etc.), accounts of what had transpired, and other details—though I do not recall everything clearly, as I was entirely focused on the unfolding events and deeply worried because my father, siblings, and other relatives were not responding to my messages. They intended to harm me, interfere, or perhaps even kill me. From what I could gather—based on a video—a woman named Laura (married to a police officer) appeared to have some sort of obsession with me. Apparently, the officer was corrupt and involved in drug-related activities. I am also looking for a young woman—a relative (a niece, granddaughter, or daughter) of my neighbor and his son—who I know is responsible for getting me into this situation. There is much more that I know but haven’t mentioned yet; if you would like to know more, please don’t hesitate to ask. I know that Lucía was held captive there for three years and subjected to constant rape; honestly, I don’t know if she is still alive or what happened to her. I also know that there were other women—women who fell ill, died, or lost their sanity as a result of the abuse they endured.

By the way, I am from Mexico, and I need your support to figure out what is actually going on. I recently received threats that I would be killed—which is nothing new since all of this began. However, I need evidence in order to file a formal complaint or take some kind of action.

Long story short:
For research purposes i did:
Create a video (moving near and far) , edited it with ai video editors to change face age and hair color, took a screenshot from video as profile picture, used that screenshot as profile picture for a website.

Tried to verify profile picture using fakeCam + video (to emulate webcam) on browser pc.
Verification fails saying "Could not verify image try with better lighting". The websites uses Amazon Rekognition.

You might find this strange or even funny, but sometimes there are people who know things you don't, or that you might have missed. So, other people's experiences are invaluable, and it's difficult to ask anyone in this field, especially since I'm studying it as my major. That's why I'd like to hear about things you've discovered, anything at all, honestly. No sarcasm or jokes, no matter how small you think it is, it's still important.

So my microsoft account was recently compromised. The hacker deleted all security info and changed the email. I currently only possess the email they've changed to, can I use this to regain ownership of my account?

Am I the only one who finds it annoying when a website uses .blob URLs for media/content that can only be played inside that specific page?

I was wondering if it would be possible to build a browser extension that hooks into SourceBuffer.appendBuffer() and observes the binary chunks being passed to it.

The concept would be pretty simple:

Server → encrypted/chunked data → browser → appendBuffer() → decoder/player

The extension would collect the buffers as they arrive, keep them in the correct order, and potentially reconstruct the original resource from those fragments.

Not talking about breaking DRM or decrypting something the browser itself can't decrypt. More like:

If the browser receives and processes the data, why can't we have a DevTools-like tool that lets us inspect and reconstruct those buffers?

Something like a "Blob Inspector":

• Intercept appendBuffer() calls
• See the individual chunks
• Track their order/size
• Reassemble them
• Identify the resulting media/container format
• Export the reconstructed data when possible

It seems like Network DevTools gets you close, but .blob/MSE-based streaming makes it surprisingly difficult to get back to the actual resource.

Has anyone already built something like this?

Or is there some fundamental browser/MSE limitation that makes this approach impractical?

As the title says, I’ve got some proprietary software that I believe uses Flexera / FlexNet for its license protection.

I’ve been trying to decompile it to see if the protection can be bypassed but really hitting a brick wall.

Is there anyone here with any experience with such protection methods?

TIA

Learning Red Team. I’ve worked with EternalBlue and notPetya for Windows 7, but I’ve moved on to studying 8.1 and can’t seem to find any publicly known vulnerabilities. If they’re all private, fair enough. Where should I look?

This activity has been super engaging and fun for my students and I've done a lot of crash testing. It seems stable at this point. So hurray! I encourage folks to try it. (Especially if you are a cybersecurity mentor or teacher!) --The self-paced student directions are linked below along with the installer.

Prerequisite: Kali/Ubuntu in a VM

I teach a cybersecurity class in San Antonio, and I just published "Blockchain in a Box" (iCSI Coin)—a completely free, open-source lab environment where students can spin up crypto nodes and work with the concepts. (Lesson plan docs for students are linked below if you are interested!)

Quick Install: A one-shot installer is on the right-hand side of the webpage linked below.

Project & One-Line Installer: crypto.cyberlessons101.com

At its core, this is a Python port of the Litecoin blockchain.

Hope someone out there finds this useful!

Im a grown ass adult but my mother insists on knowing my location at all times- I live on campus but would like to go out at night without leaving my phone in my dorm. Any clue how I can make it look like I’m still on campus/at a friends place without my phone blowing up?

The title.

But also, a friend recently got hacked (their twitter) and I wanna know how to prevent it for myself and testing my own accounts.

Hi,
We are trying to unlock a relative’s android phone to access photos, files after he suddenly passed away. We tried fingerprint but unfortunately it did not work.We wish to obtain data so would prefer not doing a factory reset. We have the gmail account so have managed to get contacts so far.

And how do yall start? I know nothing

Yo, brothers and sisters, let me keep it a buck. I ain’t no hacker.
So today after work, I realized I left my earbuds at the reception desk, in an area my keys don’t even open. The school was still open ’cause the kids were having a birthday party, and somebody had to be there to lock the place up for the weekend.
So I hit up my supervisor and asked what the move was. She told me to find the janitor ’cause he was working till 10 and had access. I got his number, called him, and dude wasn’t even at the school. He told me I could go into his office, grab a master key, and get my earbuds.
Bet. I went in, grabbed the key, got my stuff, and was about to dip. Then outta nowhere, this librarian pops up. Mind you, it’s 6 p.m. on a Friday. Like, bro, what are you even doing at school this late on a Friday? 😂
Next thing you know, dude starts firing off questions like I’m some kinda criminal. Who gave you access? How’d you get in? What are you doing here? All that who, what, when, where type shit. Bro had me feeling like I was in an interrogation room.
I’m a street dude. I ain’t naturally wired to explain my every move to somebody who comes at me sideways. So I kept it vague. I’m not about to stand there explaining my whole business to somebody who couldn’t even say hello before treating me like a suspect.
I get it, librarian is librarian, but there’s a way to approach somebody. You don’t gotta come at me like I just pulled off a damn heist.
And the funny part? Dude could clearly see I had my school keys and the school lanyard on me, so I’m sitting there wondering what the whole interrogation was even about.
Now I might have to explain why I was at school that late, all because I went back to grab MY OWN earbuds.
And lowkey, I was thinking of saying something like:
“Me. Principal, if I was really tryna get my hands on something valuable in that office, you think walking in there for a pair of earbuds would be my master plan? There are other ways people can potentially exploit a school’s network or IT systems. Like ……. I’m just saying, not everybody who walks into an office is there to snoop through people’s files or steal confidential information. I came for my earbuds, bro. That’s it. Nothing more, nothing less.”
So now I’m curious: what are some ways people actually hack into a school’s network? Not ’cause I’m tryna do anything shady, but just so I understand what’s possible and can make my point without sounding like I’m talking outta my ass.
Like I said from the jump, I ain’t no hacker. I just came to get my damn earbuds. 💀

I want to announce a new pentest learning platform: Knossos

I’ve been working on this lab for a bit - I’ve always wanted a better server platform for people to learn pentesting on, besides simply spinning up VMs, and I finally had the opportunity to build it.

Based on the lessons in my books, I built Knossos to have over 2 dozen servers, three networks (DMZ, Internal, Private), and 33 pentest challenges. It emulates an enterprise environment, and the best part is it’s all wrapped up in a single docker deployment. A couple commands, and you have an entire, complex network to learn hacking against.

Capture flags as you work through the network. Each flag is tied to a chapter within my book ”Professional Penetration Testing” where I teach how to perform the attack and why.

You can learn more about the free lab at https://pentest.tv/knossos

This is the lab I wish I had when I was trying to learn pentesting over two decades ago. For those that don’t know, I created one of the first exploitable virtual machines: De-ICE. I spoke on the De-ICE discs at DefCon 15, which later spawned the books - the most recent version of "Professional Penetration Testing" is the 3rd edition. This has been an incredible journey over the last couple decades, and I’m excited to bring you Knossos - the next generation of pentesting labs.

LMK if you give it a try and what you think. Thanks!

- Tom Wilhelm

Hello, friends! I'm learning Linux kernel exploitation and looking for educational resources and communities interested in this area of cybersecurity. I'd be grateful for any help, even a simple piece of advice. Thank you!

Hi I've seen people use old iPhone S for pictures because of the old timy quality. My mom has one but she forgot the password does anyone know how i can break into it ?

I just picked up a new internet provider and they have this program where you can pause the internet for a certain device on your network. Obviously I'm on this subreddit and I'm just getting into computers and I'm wondering if it's possible to get around this? I've tried a few things like playing around with VPNs and pausing my own computer to see if I can get internet anyways through different settings on the computer's side, but I can't get around it. Anyone know more about this? My goal is to figure out a way to get past the system - just for fun.

There's a guy who's hacking my Minecraft server and I know his name, his phone number and his Minecraft gamertag. He seeks revenge for being banned. Is there anything I can do with these informations??

I dont need help with recovering anything just curious to know if someone has an idea on what happened to my account I dont understand, how come someone randomly attack my Microsoft account gets my code inside Email. Which he did not have access too? I went directly open it logged him out changed my stuff but while i kicked him out and was busy changing password, he used the same email to login my Steam, Epic Game, Discord. Managed to get my Epic and Discord which both of them were empty so nothing won xd. Recovered my Steam. Lol just curious if anyone has an idea how this could’ve happen i barely use microsoft or have anything to do with it how come?

I am playing a Unity-based online game. By accessing the game's code using dnSpy, I created a bot using AI that I can use in-game. However, I want to try adding more hacks/cheats to the game, but since the server verifies almost everything server-side, I can't perform client-side manipulations. I am open to any ideas or suggestions on what I could try to do. By the way, the game I'm playing is one of the Darkorbit pvp servers.

I have a Nintendo Switch (not one of the ones with the exploitable firmware idk what it’s called), I’m trying to see what I can do with it. The only thing I’ve really been able to do so far is connect it to a proxy server on my laptop and look at the network traffic (also I can’t use https because it detects the ssl shit). Is there a way that I can see more of what it’s doing? Not very familiar with reverse engineering and stuff

I don't know anything about hacking and stuff like that so sorry if my terms are going to be wrong , my mom already went to the police for this , but they said they couldn't do anything which is not surprising since in my country they barely do anything, but I don't really trust them

That hacker already contacted my mom friends and family asking them for money , my mom doesn't see those messages , she only sees the initial response that her friends and family send to that hacker

She can't even change numbers easily since she has a lot in it , like at least 20 years of stuff

Is there any way that I or someone more expert can track them down? I'm sick of their bullshit

Hello,

I currently work as an IT Lead for a large company in Europe, while the headquarters are located outside of Europe.

I recently graduated with a Bachelor's degree in Cybersecurity. I had to start working durigg my studies as IT analist/lead. Now I graduated I feel it is time to specialize in cybersecurity and take the next step in my career. I know the market is tough for starters…

I would like to stay with my current company, but most security-related roles seem to be based outside my region. As a result, the opportunities to transition into a cybersecurity position internally appear to be quite limited.

Looking at the job market, I notice that many consulting companies are offering junior cybersecurity roles, particularly in security engineering and related areas. The downside is that these positions would likely involve a salary decrease compared to what I earn today.

I would be interested to hear from people who have been in a similar situation. Would you recommend taking a step back financially in order to gain experience in cybersecurity? How did you make the transition into the field, and would you do anything differently?
I am 25 years old and trying to make the best long-term decision for my career.

Thanks

I’m aware gobuster (Kali) isint 100% private even if you use a proxy chain or a tor proxy. Sometimes gobuster can leak your real IP. I have been trying to figure out how people do similar things or use gobuster it’s self but actually remain anonymous, researching didn’t help and the only idea I myself came up with was to use a vm in a computer running a vpn. But Kali is my only OS on my computer.

Please help, how do I use gobuster or a equivalent anonymously?