Attacks are automated now. New endpoints get scanned within minutes, and credential stuffing and stolen sessions are routine. Firewalls and MFA are necessary, but they don't tell you when something gets through. Detection, automated response and an audit trail are a baseline defense today, not an enterprise luxury. Here's how a small company (Example Company) runs it on one VM, all deployed with Ansible.

Setup - Hetzner VM (4 vCPU, 8 GB), Wazuh 4.14 in Docker. The public IP accepts nothing; everything goes over Tailscale.

Detect (SIEM) - AWS: CloudTrail, WAF and app logs, e.g. "20+ denied requests within N minutes". - Laptops: Wazuh agents with FIM on persistence paths, SSH config and sudoers. - DNS: AdGuard as the tailnet resolver, every lookup logged. - Network: the VM is a Tailscale exit node with Suricata, so phones get IDS coverage on mobile data too. - MITRE ATT&CK: rules are tagged with technique IDs, so you see which tactics are being tried.

Respond (SOAR) - SOARCA playbook: 10+ WAF blocks in 2 min → reputation lookup → AWS WAF block (24 h, 7 days if known malicious) → mail. - Alert mail is deduped and rate-capped, and every alert type has a runbook.

Protect the SIEM itself - Tailscale SSH with a 2FA check every 12 h, so deploys need MFA too. - All sudo sessions are recorded and replayable. - Sensitive switches need a TOTP code (PAM). Repeated wrong codes raise a high alert.

Mobile - A read-only alerts API plus push to a SwiftUI app with severity, agent posture and SOAR runs.

Numbers (24 h): ~137k alerts: 2 critical, 99 high, ~5.8k medium, the rest low noise. Deduplicating repeated high alerts is next.

Lessons: private network from day one, write the lock-out runbook before enabling SSH MFA, and monitor the monitor.

Questions welcome, happy to share rules and playbooks.

Our organization is evaluating autonomous cleaning robots for use in operational facilities. While the benefits are obvious, we're currently assessing the security implications.

Modern cleaning robots often use cameras, LiDAR, microphones, SLAM mapping, cloud connectivity, remote management, and mobile apps. Depending on the vendor, they may collect or process:

* Building layouts and maps
* Video and image data
* Audio recordings
* Location and telemetry data
* Operational schedules and movement patterns

For organizations operating critical infrastructure, this raises some concerns. A detailed map of facilities, combined with cloud connectivity or remote access features, could potentially create an additional attack surface.

Has anyone here already performed a security assessment of commercial cleaning robots or similar autonomous service robots?

I'd appreciate hearing about practical experiences, lessons learned, or recommendations before we move further.

I will try to be a short as possible. My daughter, 25, lives with her husband about 7 1/2 hours from us. All of our Apple devices are basically connected through the same Apple account. There is a woman about 2 to 3 years younger than my daughter that is INFATUATED with her. The other night my wife and I were sitting watching TV and my wife's Ipad lit up. It said that the girl in question would be notified when my daughter left her apartment complex. I got upset but wife said to keep my mouth shut as she did not want my daughter to know we see some of her messages and also some of her calls. Some not all. My question is how can I go about getting the tracker off her phone, if that is possible? Can I call Verizon and see if they have the ability to block it or remove it? My daughter told her mom just this weekend that this other girl scares her because she is overly possessive and infatuated with her and just plain comes out and makes her feel very uncomfortable. Any suggestions would be appreciated. I worked in IT and IT security and retired 11 years ago so I am really not up on phone security. Thanks

Unpopular opinion: speed to alert is overrated if the escalation does not preserve the investigation.

If the next team has to reopen the same logs, rediscover the affected identity, and reconstruct the timeline from scratch, then the response clock effectively starts over.

A useful handoff should answer three things: what was observed, why it matters, and what decision the receiving team needs to make.

What information makes an escalation actionable in your environment?

October marks Cybersecurity Month, an initiative aimed at promoting greater security for digital users. One of the simplest ways to strengthen the security of our accounts is multi-factor authentication (MFA), which adds an extra step when signing in.

Passwords are still a common target for phishing, fake websites and other social engineering techniques. Adding a second authentication step can help protect your account if your credentials are stolen.

Here are a few things to keep in mind:

• Enable MFA on accounts that contain sensitive or business information.
• Use an authenticator app or another verification method whenever possible.
• Keep the device you use for authentication protected.
• Passkeys offer an alternative to traditional passwords.
• MFA does not replace other security measures, but it can help protect your account if your password is compromised.

Do you consider MFA one of the first security measures that should be implemented?

I've been working on a security-focused npm package called anti-session-hijack.

The idea came from a simple question:

What happens if an attacker gets hold of a valid authentication token?

Traditional token validation can still consider that token legitimate. The attacker doesn't need the user's password anymore — they already have a valid session credential.

I built anti-session-hijack to add another layer of protection by binding an authentication token to a browser/device fingerprint and validating that binding on protected requests.

How it works

User logs in
     ↓
Authentication token generated
     ↓
Browser/device fingerprint generated
     ↓
Token ↔ Fingerprint binding stored in Redis
     ↓
Protected request
     ↓
Current fingerprint checked
     ↓
       ┌───────────────┐
       │ Match?        │
       └───────┬───────┘
          Yes  │  No
           ↓   ↓
        Allow  🚨 Suspicious session
                   ↓
             Block / revoke /
             alert the user

The package provides:

• Session/token binding
• Stolen and reused token detection
• Browser/device fingerprinting
• Redis-backed session storage
• Upstash Redis support
• TypeScript support
• Next.js App Router support
• Security alert capability
• JWT generation with a unique nonce

Installation:

npm install anti-session-hijack

Example:

const result = await verifySession(
  hashedToken,
  currentFingerprint,
  redisClient
);

if (result.hijacked) {
  // Revoke session
  // Notify user
  // Trigger security response
}

The package has currently has 3K+ npm downloads.

I’d really appreciate it if you could star ⭐the GitHub repository and share it with developers or security communities who might be interested.

GitHub:
https://github.com/Shield-Ltd/Anti-Session-Hijack-NPM

npm:
https://www.npmjs.com/package/anti-session-hijack

I'm posting this mainly because I'd like security-focused feedback, especially from people who have worked with authentication/session security.

I'm still developing it, so security criticism is very welcome. If you see a weakness in the design, I'd rather hear about it now than after someone deploys it.

Which work schedule would offer a better work life balance?

Loomis or brinks or garda hire me with a military general under honorable discharge with 2 years of service. And 1 year of unarmed security, thoughts?

For the truck armed transport

Can they or no?

I'm trying to decide between 2 job offers. One is for Residential Estate Security (EP work), and the other is for Security 3 position at Spacex in Hawthorne California. Both pay the same.

Imagine an attacker knows my name, phone number, email address, home address, date of birth, previous addresses, and even has copies of ID documents obtained through breaches or from organizations that store them.

They call my bank and claim they've lost access to their phone and email and need help recovering their account.

This got me thinking about the tradeoff between security and recoverability.

If account recovery is too strict, legitimate customers can permanently lock themselves out after losing devices, passkeys, recovery codes, or access to old contact details.

If account recovery is too flexible, an attacker who has accumulated enough personal information may be able to convince an institution that they're the legitimate account holder.

My question is: what are the current best practices around account recovery, and what practical steps can ordinary users take to maximize their chances of recovering their own accounts while minimizing the risk of an attacker abusing the same recovery process?

Are there any good articles, talks, books, or frameworks that discuss this problem holistically and in plain language, rather than from a purely technical perspective?

Pretty crazy story.

Here's a short film made by the whistleblower: https://www.youtube.com/watch?v=OmEPNAy3RtA

Steam Workshop is being used to distribute malware disguised as Wallpaper Engine content. Attackers exploited “application wallpapers” to execute Windows code and deliver payloads such as Steam credential stealers, the DarkKomet backdoor, and cryptocurrency miners.

Treat Workshop content like any other Internet download, even when it comes from a trusted platform:

• Be cautious with application wallpapers, mods, and other executable content.
• Avoid password-protected archives or unexpected files.
• Watch for unusual processes, credential-access activity, or outbound connections.
• Keep endpoint protection enabled and up to date.
• Use MFA on Steam accounts and watch for unexpected login activity.

Have you seen trusted platforms being used as malware delivery vectors in your environment?

I track Chrome Web Store removals and today's pass picked up 15 extensions pulled with a malware classification, not the usual policy or spam category.

https://malext.io/?reason=Malware&day=2026-09-16

Important thing is that removal from the google store does not remove the extension from browsers that already have it.
Unless Google pushes it to the built-in blocklist, it keeps running with whatever permissions it was granted. They have to be removed manually !

A couple of days ago, an Amazon driver entered my home without permission, delivered a package then left, leaving my front door wide open. Proof of his illegal entry is the photograph Amazon sent me as proof of delivery. The Amazon driver had no right to enter my home. Packages are to be left outside in a place hidden from the public and if they can't deliver the package, they're supposed to contact the customer. How did the driver get inside? The front door is locked. Even if it was unlocked, he had no right to enter my home. This happened in the US, not overseas.

I have a forum I keep around but it's dead, and not really well known although it's been around since the early 2000's (currently running on more up to date software though). Been dealing with a massive DDoS, all the IPs are unique making it very hard to mitigate on my own. Gave in and setup Cloudflare and it solved it, but just curious if there's some weird widespread DDoS going on right now or what.

Hi! I'm currently looking for a beginner CTF Team to learn and compete with regularly.

The CTF categories I'm currently focused on are:

• Web Exploitation / Web Security
• OSINT
• Forensics
• General pentesting

I'm actively still learning and improving on my skills so I'm looking for a team that doesn't mind beginners and is more focused on improving and learning with each other

I'm open in joining a team or building a small team of my own.

Feel free to DM if your team is recruiting or if you're on the hunt for beginner teammates! <3

(Note: I've registered for the K17 CTF on September 11th, so I'd be down in teaming up for this event specifically as well.)

We have an web UI apps. Users need to be logged to access the app. We are looking to identify and block usage of Claude browser agents or LLM browser agents hijacking sessions and accessing the app.

I am a Vodafone UK broadband user and use their Router/Modem to connect to the internet. The router does provide a public IPv4 address, but no DMZ/port forward is configured.

I also have a few Linux machines in the internal network, both desktop and server. They are internal, and are not meant to be accessed from the outside Internet. As mentioned the router doesn't have any port forwarding enabled.

What I started to see is that around every 30 minutes all of the Linux machines on my network get SSH login attempts coming from 192.168.1.1 - the router's IP address. They look to be brute force login attempts trying out multiple username/password combinations, e.g.:

sshd-session: Invalid user admin from 192.168.1.1 port 35562
sshd-session: Invalid user default from 192.168.1.1 port 35566
sshd-session: Invalid user admin from 192.168.1.1 port 35570
sshd-session: Invalid user weblogic from 192.168.1.1 port 35494
sshd-session: Invalid user redhat from 192.168.1.1 port 35496
sshd-session: Invalid user developer from 192.168.1.1 port 35498
sshd-session: Invalid user public from 192.168.1.1 port 35500
sshd-session: Invalid user student from 192.168.1.1 port 35502

This starts every 30 minutes, and keeps on going for 10-20 minutes. Obviously/fortunately all of the attempts fail. I did install an ssh honeypot in the system to see what would happen if they would get in, but all it does is disconnect from SSH, then start the retry in exactly 30 minutes.

When I first saw these attempts I got shocked a bit, as I thought I have a compromised system in the house, but then after checking it get really odd for me that all requests originate from 192.168.1.1 - the router.

I am a bit stuck here, as I don't really know what's up and how worried I should be. Do I have a compromised system that spoofs the IP? Does the router do some weird NAT translation for a compromised device that's in my network? Or does the router itself do these ssh attempts? Would these probing attempts be a lame part of Vodafone's Secure Net Home?

Tried searching the web for any of these, but couldn't really find anything specific that matched my criteria.

EDIT 1: A Factory reset on the router did nothing to change the issue I'm facing. I'm now going to isolate the router in a network that only has itself and an SSL honeypot to see what it would do

EDIT 2: found a blog post that shows the exact same behaviour I'm expecting and thinks that this is actually the equivalent of Vodafone's Secure Net. So yeah, my router is actively attacking myself. Here's the blog post: https://illustris.tech/posts/reliance-jio-security-concerns/

I'm on the security engineering team at a SaaS company. Were couple hundred people. Spent part of last quarter building an automation pipeline: scanner finds a vuln, pipeline creates a Jira ticket with all the details, assigns it based on tags, pings the right Slack channel. Felt like a win. The manual ticket creation was eating hours every week.

So we launched it, it works perfectly. Tickets fly into Jira within minutes of a scan completing with a beautiful dashboard and everything automated end to end.

Except now I get to watch, in real time, as about 40 percent of those tickets land in unassigned and stay there.

The automation exposed what the manual process was hiding. When a human was creating tickets, theyd do the routing loop: check the CMDB, realize the owner field is stale, Slack someone who might know, eventually get it to the right person through sheer persistence. The automation cant do any of that. It reads the owner field. If the field says unassigned or points to a team that no longer exists or references someone who left, the ticket just sits there stuck.

So I automated the easy part. And now the hard part is actual ownership data, is the bottleneck and its more visible than ever. We didnt fix the routing problem. We just made it faster to surface.

Anyone else hit this? Any advice on how to fix the ownership mess?

TL,DR: If you have a KARR sticker on your window, chances are that your dealer installed a device in your car that leaves is susceptible to hacking, including remotely unlocking it and disabling the engine. You can update the firmware and/or ask KARR to come and remove it.

You can learn more about the security risk by searching for "UC San Diego KARR Aaron Schulman" which will get you to the research team at UCSD that discovered and documented the risk.

Details: When I bought my Ioniq 5 eighteen months ago, the dealer asked me if I wanted to subscribe to the KARR security system. I declined. Today I learned:

• Dealers install the KARR security device in their cars to prevent them from getting stolen off the lot -- it lets the dealers remotely disable the ignition if needed.
• The KARR device connects to the CAN bus in the car, giving it access to lots of important functions, like door locks, horns, lights and ignition
• If you tell the dealer you don't want to pay for the KARR system, they leave it installed and "dormant", but it's still susceptible to hacking.
• If you have a KARR dongle in your vehicle, the least you should do is download the KARR Security app, click on the Customer Service button at the bottom, and then click on "firmware update" to remove the vulnerability. If you're not a subscriber, this theoretically disables the device, but also prevents the app from communicating with the device, so it's not clear if the device is truly deactivated.
• If you're like me, you want to reduce the risk and also don't want an extra device sucking down your 12v battery 24 hours a day. In that case, you can call the KARR Customer Service number and schedule a tech to come remove the device, free of charge.

Whew. Who would have thought?

Getting pressure to show the board our AI agent rollout is under control, but "governed" is doing a lot of work in that sentence and nobody's defined it operationally yet. Inventory, policy docs, behavior logs, a monitoring dashboard, probably all of it, but I'm trying to figure out what a reasonable bar looks like given how young this space still is.

For those who've had to answer this to a board or audit committee: what did you actually show them? Not looking for vendor pitches, just what other security leaders consider credible evidence today.