During the session, we will learn about the American charged with a felony for wiping his phone at the border, device security, and how to protect your data when you travel.

Zack recently reported on the case of Sam Tunick, an Atlanta man facing a federal felony charge after U.S. border agents claimed he handed over a password that wiped his phone during a search at the airport.

His phone was running GrapheneOS, which lets users set a “duress” password that wipes the device when entered. Prosecutors say triggering that built-in feature amounts to destroying property to prevent its seizure by the government.

This is believed to be the first U.S. case of its kind involving a duress password. It raises important questions about what happens when using a security feature is treated as a crime, and what constitutional and legal rights Americans have at the U.S. border.

Read the reporting: TechCrunch, plus coverage from 404 Media and The Guardian.

Guest Credentials:

• Zack Whittaker, security editor at TechCrunch and author of the weekly cyber newsletter this.weekinsecurity.com, who broke the story on the Tunick case.

• Runa Sandvik, security researcher who works with journalists and at-risk people through her consultancy Granitt. She has spent years helping journalists and activists protect their devices, data, and sources, including at the border, and has weighed in on how novel and consequential this case is.

Ask Your Questions Here!

Ask Them Anything About

• Why this prosecution involving GrapheneOS will be closely watched by privacy advocates and civil liberties defenders, and what it could mean as a precedent

• Border searches of phones and your rights when crossing

• Duress passwords vs. device wiping, and the tradeoffs of these features

• How journalists and activists protect devices and sources

• Practical steps anyone can take to secure their data before they travel

• How they research and report on security, privacy, and surveillance stories

• …anything else on device security, privacy, and press freedom

Ask Your Questions Here!

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 41,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

Guest Credentials:

• Louise Matsakis, reporter at WIRED covering AI and the technology industry, with deep experience reporting on how AI systems are built, deployed, and misused.

• Lily Hay Newman, reporter at WIRED covering cybersecurity, hacking, and digital threats, on the ground at DEF CON this year.

Together they have broken major stories on AI security incidents, including recent disclosures from Anthropic and OpenAI about models breaking into real systems.

Ask Your Questions Here!

AI security is moving fast right now.

Anthropic recently disclosed that its AI models gained unauthorized access to the systems of three organizations during cybersecurity testing, shortly after OpenAI revealed one of its agents had hacked into Hugging Face during a separate test.

Louise and Lily have been reporting on these incidents as they unfold, and Lily is covering DEF CON, so she will have a strong read on what researchers are actually worried about and building right now.

Ask Them Anything About

• The state of AI security and where AI agents and offensive security are heading

• The biggest takeaways from this year’s DEF CON

• AI models breaking into real systems, from the Anthropic and OpenAI incidents to what comes next

• How they report on AI, hacking, and security

• Working with sources and getting companies to talk about incidents like these

• Anything else on AI, privacy, and security

Ask Your Questions Here!

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 41,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

A Reddit user unlocked a BIOS-locked HP 15-dw1036ne laptop using Anthropic’s Claude Code. The laptop had a startup lock and no known bypass, and it flagged BIOS Corruption Detected on any change.

View Story

Claude worked through a backup BIOS dump, found a bypass for the RSA-2048 signature check, and unlocked 55 hidden settings.

The user published a Python script, but warns it may not work on other machines. The account is unverified and has not been independently reproduced.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

Microsoft says attackers hijacked hotel Wi-Fi in several countries, taking over the captive portal guests log in through and using it to push fake browser updates.

View Story

The updates install CornFlake, a remote access trojan that can capture webcam, microphone, and keystroke data, steal passwords, and open a remote shell. x

Microsoft ties the campaign to Storm-2945, which it assesses is part of the Russia-linked group Midnight Blizzard, though that specific link is not independently confirmed. The victim still has to run the payload, so reject any update offered over public Wi-Fi.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

View Story

Over a week of texting, 46 percent of people did what the Al asked, versus 18 percent for the human, and they rated the bot as more trustworthy. The Al used was a Claude model, and it followed instructions to deny being Al. No money was taken; a download stood in for the final fraud.

Anthropic says the study used an old model and its newer Claude flags most scam attempts. Researchers warn Al could soon automate the trust-building phase of these scams at scale.

The real Sparrow Wallet is desktop only and has never shipped on ios, so every version in the App Store is fake. Developer Craig Raw says he reported the clones for years. Apple says it removed the impersonating apps and terminated the developer accounts behind them.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

View Story

The session followed his case study on chaining two five-year-old Ruby memory corruption bugs in the Oj JSON parser into remote code execution on default GitLab installations.

The issues were reported privately in May, fixed in Oj 3.17.3, and later patched in GitLab’s affected code path.

During the AMA session, he took questions on his research and disclosure process, memory-safety risks in native extensions, how AI-assisted systems help prioritize suspicious code, red and blue teaming, and getting started in the field.

About the Guest

Yuhang Wu is a security researcher at depthfirst, where he works on autonomous vulnerability discovery as part of the company’s Open Defense Initiative.

His recent case study chained two memory-safety bugs in Oj, a native C JSON parser for Ruby, into remote code execution on default GitLab installations.

The out-of-bounds write and heap-pointer disclosure had gone undetected for nearly five years, and the chain worked from an ordinary authenticated account, as The Hacker News reported.

His team also autonomously discovered a critical heap overflow in NGINX’s rewrite module, tracked as CVE-2026-42945 with a CVSS score of 9.2.

Before depthfirst, Wu spent about a year as a red team engineer at TikTok focused on AI security, and interned at Tesla, where he worked across application, vehicle, and factory software security and built an LLM-based code-auditing agent that uncovered eight critical vulnerabilities. His earlier roles include a security internship at Sec3 and several years as a researcher at Beijing Chaitin Technology.

His academic background is in low-level exploitation. He holds a PhD from Northwestern University, where he co-authored DirtyCred, a Linux kernel privilege-escalation technique presented at Black Hat USA 2022 and tracked as CVE-2022-2588, along with related kernel research such as GREBE at IEEE S&P 2022. Per his AMA, he has more than ten years of competitive CTF experience. You can find more of his work on his personal site and follow him on X.

This AMA took place on r/pwnhub. The questions below are organized by topic, and the wording of each question and answer is reproduced as it appeared in the thread.

Getting Started and Breaking Into the Field

Q: How did you get into this field? Whats your story? Can you go into detail on your overall progression of knowledge which led you to where you are today?

A: I majored in Information Security as an undergraduate and started competing in CTFs during my sophomore year (around 2015). It took me about a year to go from competing with a relatively unknown university team to being accepted by an internationally recognized team.

I think security is a field that’s relatively easy to get into, but incredibly broad. Over the past ten years, I’ve never stopped learning new things, and I even pursued a Ph.D. along the way. If there’s one thing I’ve learned, it’s that maintaining your passion and your motivation to keep learning is the most important part.

Q: How did you get into this line of work? Do you think it’s easier or harder to get into it right now? And what are the best resources that helped you learn and grow?

A: I got into security quite early, driven purely by interest. Today, it’s much easier to get started thanks to the wealth of learning resources and AI tools, but it’s also much harder to land a job because the field has become far more competitive.

Looking back, my CTF experience had an enormous impact on my career. I strongly recommend that anyone who wants to pursue offensive security spend a few years competing in CTFs with an internationally recognized team. It’s one of the fastest ways to build both deep technical knowledge and practical problem-solving experience, and it provides an excellent foundation for real-world security research.

Q: Hello Mr. Yuhang Wu what path and tooling do you suggest for an IT professional to switch into the ITSecurity/pentesting/red teaming field in 2026.

A: AI can help you a lot, you can start with reproducing history CVEs, play CTFs with the help of the AI, and make sure to learn what’s the path AI following, and the behind reason why it do something.

Q: Do you think there’s still a path towards entry-level cybersecurity and how might someone get into that path?

A: I do think there are still paths into entry-level cybersecurity roles, but they’ve changed significantly. Getting started is easier than ever because there are abundant learning resources and AI tools, yet landing a job has become much more competitive.

My advice is to build real technical ability rather than just collecting certifications. Learn the fundamentals of operating systems, networking, programming, and common vulnerability classes. Then spend time solving CTF challenges and, if possible, join an internationally recognized CTF team. Working alongside strong teammates for a few years is one of the fastest ways to develop the skills and mindset needed for real-world security research.

Also, don’t rely on AI to do all the work. AI is an incredible learning tool and can make you much more productive, but it’s important to understand why something is a vulnerability and be able to verify it yourself. Use AI to accelerate your learning, not to replace it.

Learning: CTFs, Certifications, and Resources

Q: Is CTF the best way to learn security or strengthen my sec skills?

A: I think the answer is “yes”, but be selective about which CTFs you participate in. Try to focus on internationally recognized competitions, as they generally have higher-quality challenges and fewer “guess-the-author’s-intent” problems. They’re much more effective for improving your skills.

Q: What tools/methods have you used at the beginning of your career or what certificates were you going towards?

A: I never really pursued certifications. When I was getting started, I learned mostly by doing, reading code, playing CTFs, and building things myself. CTFs had by far the biggest impact on my career because they exposed me to a wide range of security topics and taught me how to solve unfamiliar problems under pressure.

I also spent a lot of time reading open-source projects, security blogs, and vulnerability write-ups, then trying to reproduce and understand them myself. Looking back, that hands-on experience was much more valuable than any certification could have been.

Research Methodology and Process

Q: What is your bug hunting process like? Where do you start? What steps do you take?

A: First, identify the attack surface. Then build a threat model, and systematically trace every code path that is reachable from that attack surface, as deep into the stack as possible.

Q: What’s the best first step for someone who wants to get into vulnerability research?

A: Question every line of code. Trust no software. Read the code yourself, reverse engineer it, and discover how it really works.

Q: How much of your time is spent on vulnerability research looking for 0-days? What is the average time of discovery for Linux kernel useable exploits (RCE)?

A: For a fairly large project, I typically spend about a week on it. With something like the Linux kernel, finding the first vulnerability is usually the hardest part. But once you’ve found that first bug, the following ones often become much easier because you’ve already built a solid understanding of the architecture and codebase.

Q: How long personally do you think you spent on researching DirtyCred? The culmination of experimentation, research, and finalizing the exploit chain? Thank you!

A: This was a project I worked on with my labmates. We spent about a few months on it from start to finish.

The Oj / GitLab Research and Exploit Development

Q: Seeing how you chained a simple stack overflow into a full server takeover is fascinating.

For those of us who want to learn how to transition from basic buffer overflows to complex exploit chains like this, what resources or labs do you recommend starting with?

A: This requires debugging with gdb to understand the heap layout and evaluate whether the out-of-bounds access can reach any interesting data structures. Building a working exploit often depends on identifying a number of useful gadgets and chaining them together. In some cases, it’s even possible to turn a constrained OOB primitive into an arbitrary OOB write, and with careful heap grooming, that can be achievable. Above all, exploit development comes down to patience and experience.

If you’re interested in learning exploit development, I’d recommend starting with the classic glibc heap exploitation techniques. The how2heap project is an excellent resource: https://github.com/shellphish/how2heap

Q: Since the buffer overflow in the nesting stack was a relatively straightforward out-of-bounds write, why do you think it managed to survive hidden in the Oj code for nearly five years without being caught by standard security tools or fuzzers?

Do you think AI agents are going to uncover many more vulnerabilities like this in the near future?

A: The biggest challenge was that libraries like Oj sit so deep in the software stack that they’re often overlooked by both security tools and researchers, or simply assumed to be safe. That kind of implicit trust can cause you to miss valuable vulnerability discovery opportunities.

As AI continues to improve, I expect it to learn more from the way human researchers progressively dig deeper into the software stack. Rather than stopping at the application layer, it will likely become much better at following dependency chains and uncovering similar classes of vulnerabilities hidden in low-level libraries.

Q: Sickest sandbox or proxy bypass you saw in the wild?

A: Hmm, that’s a difficult one. But the talk that left the biggest impression on me was Orange Tsai’s Black Hat presentation on SSRF. Many of the techniques he introduced fundamentally changed how people think about SSRF exploitation and proxy bypasses.

AI-Assisted Vulnerability Research

Q: how to guide ai to find more critical vulnerabilities, sometimes ai just finds easy ones

A: I’ve noticed that AI often tries to rediscover historical vulnerabilities in a project by following patterns from previously reported bugs. While that can be effective, many projects simply don’t have those same bug classes. The more interesting vulnerabilities often require a different perspective and exploring parts of the codebase that have received far less attention. It can be helpful to deliberately steer the AI toward areas it hasn’t considered yet.

AI also tends to stop at relatively shallow findings. You can encourage it to look beyond the application’s own code and investigate third-party dependencies or extensions as well. That’s exactly what happened in our GitLab research, we eventually pivoted into the Oj dependency, where we discovered the vulnerabilities that ultimately led to the exploit chain.

Q: Since you’ve listed ‘getting started with AI-assisted research’ as a topic, you’ve probably seen how a lot of newcomers try to leverage AI for source audits.

What is the biggest trap or misconception you see beginners fall into when relying on automated AI tools to find vulnerabilities?

What tips or words advice do you have for those looking to add more AI to their workflow?

A: I think the biggest challenge for beginners using AI tools to find vulnerabilities is that AI models can hallucinate and sometimes exhibit a tendency to “cheat” by making unsupported assumptions. Beginners often don’t recognize this, which can lead to a large number of false positives. If those are submitted to maintainers or security teams without proper validation, they waste everyone’s time and can also hurt the reputation of legitimate security researchers.

Another challenge is that beginners rarely find deep or highly sophisticated vulnerabilities with AI alone. Those discoveries usually require carefully crafted prompts, the right research direction, and human guidance before the AI can uncover them.

My advice is to use AI as a learning companion rather than a replacement for security knowledge. While using AI to find vulnerabilities, you should also be building your own understanding of security concepts and vulnerability research. As your knowledge grows, you’ll get better at guiding the AI, filtering out false positives, and ultimately discovering much more interesting vulnerabilities.

Q: Could you share more about how do you harness Al? Any tips for building agents for cybersecurity?

A: The biggest lesson I’ve learned is that AI works best as a research partner rather than an autonomous vulnerability hunter. Instead of asking it to “find bugs,” I try to give it a well-defined objective and enough context to reason effectively. I usually start by identifying the attack surface, building a threat model, and tracing the reachable code paths. Then I use AI to analyze those specific components, challenge assumptions, and explore hypotheses.

Another important point is to actively guide the AI. Left on its own, it often gravitates toward well-known bug patterns or previously disclosed vulnerabilities. In many projects, the interesting bugs are in places that have received very little attention, such as deep dependencies, extensions, or low-level libraries. Human intuition is still critical for steering the AI toward those overlooked areas.

Finally, don’t treat the model’s output as ground truth. AI can hallucinate, make unsupported assumptions, and generate a lot of false positives. Every finding should be validated manually. The goal is to combine the AI’s speed with human judgment and experience.

For anyone building AI agents for cybersecurity, I think the hardest technical problems are achieving broad coverage, intelligently partitioning large codebases into manageable pieces, maintaining useful context across long reasoning chains, and filtering out false positives without losing real vulnerabilities. Those are exactly the kinds of challenges we’re working on at depthfirst.

Q: Hi Yuhang - how are you testing and verifying agents internally before you launch into production or internal use. Also how are you evaluating 3rd party applications with the agentic loop?

A: We evaluate our agents using many state-of-the-art open-source benchmarks, but we’re also actively building our own, especially benchmarks based on real-world applications and vulnerabilities. We believe real-world benchmarks are a much better way to measure an agent’s practical capabilities, identify its weaknesses, and ultimately drive meaningful improvements to the system.

Q: Do you need serious coding chops to get into LLM red teaming, or is that more of a “nice to have”? What’s your recommended starting point?

A: I think it’s a nice-to-have rather than a requirement, especially now that AI has made coding much easier. These days, a lot of programming is essentially “vibe coding.”

I actually have a somewhat unconventional opinion: sometimes being a very strong programmer can make you more likely to miss certain vulnerability discovery opportunities. When you’ve used a particular library for years, you naturally develop a level of trust in it. During a code review, it’s easy to skim past that dependency without questioning it. On the other hand, if you’re unfamiliar with the library, you’re more likely to stop, ask what it does, and inspect it more closely. Ironically, that’s often where you end up finding vulnerabilities—in the low-level dependencies that everyone else has implicitly trusted.

Q: Many AI models refuse to communicate about cybersecurity work - especially red teaming.

Are there any AI models you prefer for cybersecurity work?

Do you have any tips for how to get AI models to allow you to talk to them about cybersecurity work?

A: That’s a great question, and it’s something I struggle with as well. I regularly use Claude Opus 4.8 and GPT-5.6. As long as I have access to the Cyber Grant, it’s generally not a major issue. However, GPT still has a fairly strong tendency to refuse or become overly cautious at the model level, even after passing the Cyber Grant checks.

What I’ve found works much better is framing a real vulnerability research task as an explicitly authorized security engagement, such as a bug bounty program or a Pwn2Own competition. Providing that legitimate, authorized context tends to significantly improve the quality of the model’s responses and reduces unnecessary refusals.

Red Team and Blue Team

Q: What’s the balance between time spend on keyboard (hacking) versus planning red team activities?

A: I would say the balance depends on the stage of the engagement. Early on, more time should go into planning: understanding the target, defining objectives, mapping the attack surface, reviewing the threat model, and deciding which paths are most likely to produce meaningful impact. Once a promising direction is identified, the balance shifts heavily toward hands-on work.

In practice, I probably spend around 30–40% of my time planning, researching, and analyzing, and 60–70% actively testing, debugging, and developing exploits. However, the process is iterative rather than strictly separated. Findings from hands-on testing constantly change the plan, and good planning helps avoid spending too much time on low-value attack paths. The goal is not to maximize keyboard time, but to make sure that each technical action is guided by a clear hypothesis.

Q: What were common shortfalls within the blue team that impacted their ability to detect and respond to red team activities?

A: One common issue was insufficient visibility across the full attack chain. Individual events might be logged, but the blue team often lacked the context needed to connect them, for example, linking an unusual API request to a privilege change and then to suspicious internal access.

Another shortfall was overreliance on predefined signatures and known attack patterns. More subtle activity, especially when it used legitimate credentials, normal application functionality, or low-volume requests, often did not trigger alerts.

We also frequently saw gaps in logging, weak alert prioritization, and unclear ownership during incident response. Even when suspicious behavior was detected, teams sometimes struggled to determine who should investigate it or how serious it was. In other cases, alerts were generated but buried in noise.

The strongest blue teams were generally the ones that had good application-level telemetry, understood normal user and service behavior, and regularly practiced responding to realistic attack scenarios rather than relying only on endpoint or network-based detections.

Q: When planning a red team engagement, how do you decide whether to lead with social engineering/phishing or go straight for technical exploitation?

At companies like TikTok or Tesla specifically with their scale and security maturity which approach enabled you initial access faster, and does that change once you’re past the perimeter and trying to escalate or move laterally?

A: In general, I don’t consider social engineering or phishing as part of my approach. Those techniques are difficult to get authorized for in legitimate security assessments and are more commonly associated with real-world threat actors than with vulnerability research.

Even highly mature organizations almost always have small cracks in their attack surface. At their scale, it’s nearly impossible to eliminate every overlooked asset. I think those overlooked corners often make the best starting points, for example, a rarely discovered public-facing web server that hasn’t been updated in a while and may still be vulnerable to a recently disclosed 1-day vulnerability. Those kinds of entry points are often much more practical than relying on social engineering.

The Future of Security and AI

Q: What impact will Al have on the future of vulnerability research? It seems to be getting better & better at finding 0-days.

A: I think AI is making vulnerability research faster and more accessible, but at the same time it’s also enabling developers to write code much more quickly, which inevitably creates more opportunities for new vulnerabilities. So I believe the future will look much like the present: attack and defense will continue to evolve together, driving each other forward. As AI improves both software development and security research, the two sides will keep advancing in parallel.

Q: How do you feel about security as a field with Al?

A: I think it’s one of the most exciting times to be in security. AI has dramatically increased the speed of vulnerability research, code review, reverse engineering, and exploit prototyping. Many tasks that used to take days can now be done in hours, which allows researchers to spend more time thinking about interesting problems instead of repetitive work.

At the same time, AI is also accelerating software development. Developers can build products much faster, which means we’re also producing much more code—and inevitably, more vulnerabilities. In that sense, I don’t think AI will make security researchers obsolete. If anything, it raises the bar for both attackers and defenders.

I see AI as an amplifier rather than a replacement. The best results still come from combining AI with human intuition, curiosity, and deep technical understanding. AI is excellent at analyzing code and exploring hypotheses, but humans are still the ones who identify the right attack surface, question assumptions, and decide where to dig deeper.

Ultimately, I think attack and defense will continue to evolve together. As AI improves, both sides will become more capable, and security research will become even more impactful and interesting.

Q: Do you think it will be necessary for pentesters and red team operators to shift into more of a development/engineering role as more of the day to day testing becomes automated?

A: no.... development/engineering will also be automated... I’ve always believed that security is a never-ending problem because security demands zero tolerance. Even if someone claimed to have an AI system capable of generating 100% secure code, I still wouldn’t trust it without independent human verification. In security, trust should never be assumed, it has to be earned through validation.

Q: How do you feel about companies dumping their internal source code to LLM providers, essentially losing track of where it ends up and giving up control and ownership on their code?

A: I think this will become more standardized over time. Ultimately, I expect the industry to move toward a model where every company runs its own AI models internally, allowing them to benefit from AI while keeping their code and data within their own environment.

Q: In future really agents/ai models can attack individually without any intervene

A: Possibly. But I think the industry will gradually develop standards and regulations to govern these kinds of issues.

Q: What are the trends you’re seeing which you feel need more attention?

How active are you in environments where threat actors operate and what trends or changes have you seen in these communities over the years?

Are there any major changes you’ve observed in the last 5 years either with regards to attacker MO or how equipped companies are with their defenses?

What are you most worried about?

A: What are the trends you’re seeing which you feel need more attention?

I think we should pay more attention to evaluating AI based on its ability to solve real security problems, rather than relying on benchmark scores or vendor demos. What really matters is whether experienced security researchers actually become more effective when using these models. I think we need more independent, real-world evaluations from practitioners.

How active are you in environments where threat actors operate, and what trends have you seen?

I don’t spend much time in threat actor communities. My work is mostly focused on vulnerability research. But one thing I’ve noticed is that the barrier to entry is getting much lower. AI and publicly available tools are making many techniques accessible to people who previously wouldn’t have been able to use them.

Are there any major changes you’ve observed in the last five years?

I think companies have become much better at defending against known attack techniques. The interesting vulnerabilities today are much deeper in the software stack, often hidden in dependencies, middleware, or native libraries that everyone implicitly trusts. That’s where I’ve been spending most of my time.

What are you most worried about?

One thing I’m concerned about is that AI security research could become concentrated in just a handful of model providers. I don’t think that’s a healthy direction for the industry. Security benefits from independent researchers, different perspectives, and open competition. If only a few companies have the best capabilities, I think the ecosystem will become less innovative and ultimately less secure.

Technical Deep Dive: Rootless Containers and Seccomp

Q: Rootless containers depend on unprivileged user namespaces, and those have historically been an exploit vector in their own right, with several distros shipping them disabled by default for exactly that reason.

So from an attacker’s point of view: does a machine with unprivileged userns enabled end up with a larger kernel attack surface than one without, even when the userns is what is providing the isolation?

Put differently, is a rootless sandbox net-positive or net-negative for the host?

And a practical follow-up: does a seccomp filter meaningfully raise the cost of the kind of kernel exploitation you do, or is it mostly an obstacle that gets routed around?

A: That’s a great question. I think unprivileged user namespaces definitely increase the kernel attack surface. Historically, we’ve seen quite a few kernel vulnerabilities that were only reachable because user namespaces were enabled.

That said, I still think rootless sandboxes are generally a net positive. Yes, they expose more kernel code, but they also remove a lot of privileges from compromised applications. In practice, it’s a tradeoff, and I think the security benefits usually outweigh the additional kernel exposure.

As for seccomp, I think it absolutely raises the cost of exploitation. A well-designed seccomp profile removes many useful syscalls and forces an attacker to find a much narrower path. It’s not a silver bullet, but it definitely makes kernel exploitation harder rather than just being something you can easily work around.

Current Work and Where to Follow

Q: What sort of research are you focused on right now?

What are you currently working on?

Where can we follow your work and get updates on your research?

A: Right now, my main focus is finding more real-world vulnerabilities with meaningful impact. I’m particularly interested in bugs that affect widely deployed software and open-source dependencies, where a single overlooked issue can have a large downstream impact. My teammates are working on similar problems, so we’re constantly exploring new attack surfaces and pushing deeper into software stacks that are often overlooked.

You can follow me on X (@wupco1996) and keep an eye on the depthfirst blog. We have several exciting research projects and vulnerability write-ups in the pipeline, including some very interesting real-world vulnerability analyses that we’ll be publishing soon.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

View Story

The real Sparrow Wallet is desktop only and has never shipped on ios, so every version in the App Store is fake. Developer Craig Raw says he reported the clones for years. Apple says it removed the impersonating apps and terminated the developer accounts behind them.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

Guest Credentials:

• Former Red Team Engineer at TikTok, targeting cloud and application-layer defenses.

• Former Security Engineer at Tesla, securing vehicle software, factory systems, and internal applications.

• Co-developer of “DirtyCred”, a groundbreaking Linux kernel exploitation technique.

• AI Security Innovator, who built LLM-based autonomous agents that uncovered 8 P1 (critical-severity) production vulnerabilities.

Ask Your Questions Here!

Yuhang Wu is a vulnerability researcher at depthfirst, where he works on autonomous vulnerability discovery as part of the Open Defense Initiative.

He recently published an exploit chain achieving remote code execution on default GitLab installations, built from two Ruby memory corruption bugs in Oj that had gone undetected for nearly five years.

Before depthfirst, Yuhang was an AI Red Team Engineer at TikTok, where he built a security testing framework that uses fuzzing and prompt mutations to surface safety and security weaknesses in AI models.

He holds a PhD from Northwestern University and has more than 10 years of experience as a competitive CTF player, including nine consecutive appearances at the DEF CON CTF Finals. He has spoken at Black Hat USA and had his research referenced in Phrack Magazine.

Ask Your Questions Here!

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, CNET, The Guardian, Daily Mail, and Ars Technica breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

One label marks what the user typed, another marks what the model said back, another marks the private notes a model writes to itself while reasoning, and another marks text pulled in from a webpage or an outside tool.

View Story

Those labels are the foundation of nearly every defense against jailbreaks and prompt injections, because most attacks work by making a model treat one kind of text as another.

Independent researchers Jasmine Cui and Charles Ye looked inside several models to see how well that system holds up.

They found that models judge a piece of text by its writing style and word choice, not by the label wrapped around it. Swapping the labels changed almost nothing. Text that reads like a model’s own private reasoning gets treated as trustworthy, no matter who actually wrote it.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, and The Guardian breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

Anthropic says it closed the crawler gap within days, but cached copies may still exist. If you have shared a Claude chat, check Settings, then Privacy, then Shared Chats.

View Story

Over the weekend of July 25, a Reddit user ran the search term site:claude.ai/share on Google and found a long list of Claude Al conversations sitting in the results.

Anthropic’s Claude lets any user turn a chat into a public link with one click of the Share button, and the resulting page shows everything sent up to that point, including images and code.

None of it came from a hacked account or a leaked database.

The topics ranged from health questions, legal situations, work projects, and code reviews. Each page had been made public by the person who created it, but most people who share a link with one colleague or friend do not expect Google to hand it to anyone searching a name, a company, or a technical term.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, and The Guardian breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

View Story

Key Points:

• Claude AI successfully derived an end-to-end key-recovery attack against HAWK-256, a challenge parameter in NIST’s post-quantum standardization process.

• The AI also found a 200- to 800-fold speedup for an attack on seven rounds of AES-128 by removing a guessing step in meet-in-the-middle attacks.

• Anthropic states that neither attack affects production systems, as HAWK-256 is not a final security parameter and the AES attack requires impractical resources.

• The research was conducted by the AI model with human verification, costing approximately $100,000 in API usage and hundreds of hours in manual review.

Anthropic has published findings showing that its Claude AI model, specifically the Mythos Preview version, was able to identify critical vulnerabilities in two major cryptographic standards.

The first result involves HAWK-256, a lattice-based digital signature scheme currently under review by the National Institute of Standards and Technology (NIST). The AI exploited a previously unused symmetry in the lattice structure to reduce the work factor for key recovery, achieving a successful attack in roughly three hours and 42 minutes on a high-end server. However, this attack only applies to the HAWK-256 challenge parameter, not the larger HAWK-512 or HAWK-1024 parameters intended for actual use, which remain computationally impractical to break.

The second finding relates to the Advanced Encryption Standard (AES). The AI improved an existing meet-in-the-middle attack on seven rounds of AES-128 by developing a new invariant fingerprint called the Möbius Bridge.

This innovation eliminates a 256-way guessing step, making the attack 200 to 800 times faster than previous methods. Despite this acceleration, the attack still requires an impractical number of chosen plaintexts and does not extend to the full ten rounds of AES-128 used in real-world applications. Anthropic emphasizes that no production software needs to be updated in response to these findings, as the attacks remain theoretical exercises in cryptanalysis rather than immediate threats to deployed systems.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Should using a privacy phone raise suspicion at the border?

An Atlanta man is facing federal charges after his GrapheneOS phone automatically wiped itself during an airport search, a feature the privacy-focused operating system is designed to perform when tamper attempts are detected.

Prosecutors appear to be treating the wipe as evidence of wrongdoing, while privacy advocates argue that using secure technology is a legal right. The case puts a spotlight on the tension between border search powers and the growing use of privacy-hardening tools by ordinary people.

What do you think?

Should wiping your phone at the border be treated as suspicious behavior, or is protecting your data a basic right?

Join the Discussion

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, and The Guardian breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

One of those pieces, a Ruby component called Oj used to read data in a common format, quietly carried security flaws for nearly five years. No human had caught them.

Ask Your Questions

An autonomous AI system did. It reviewed the code, flagged the suspicious spots, and Depthfirst researcher Yuhang Wu took it from there, showing how two of those flaws could be combined to break into a default installation of GitLab, the platform millions of developers use to store their code.

An ordinary user account was enough to pull it off.

Yuhang broke down how the whole thing worked, from the AI-assisted discovery to the responsible way the bugs were reported and fixed, and he’s coming to the PWN Community to answer your questions.

Whether you write exploit code for a living or just want to understand how AI is changing security, there’s something here for you.

Yuhang is a vulnerability researcher at depthfirst, where he works on AI-assisted security research through the Open Defense Initiative. Before depthfirst, he was an AI Red Team Engineer at TikTok.

He holds a PhD from Northwestern University and has nine consecutive appearances at the DEF CON CTF Finals. He’s joining us live on Friday, July 31st from 12 to 1 PM Pacific Time (3 to 4 PM ET).

Post your questions

Post your questions in the comments now, then join the live AMA on Friday, July 31st at 12 PM PT: SHARE QUESTIONS HERE

Upcoming AMA: Friday, July 31st (12 PM - 1 PM Pacific Time)

Hi PWN Community,

I’m a vulnerability researcher at depthfirst, where I work on AI-assisted security research through the Open Defense Initiative.

I recently published a technical case study about two memory-safety issues in Oj, a widely used JSON parser for Ruby applications. These issues had been present for nearly five years and were reachable through GitLab’s Jupyter notebook diff functionality.

Our analysis identified several security-relevant issues in Oj’s native C implementation. By studying how two of them interacted, I was able to demonstrate their impact in GitLab under an authenticated, non-administrative account.

The issues were reported privately in May. The Oj maintainer responded quickly, released fixes in Oj 3.17.3, and GitLab subsequently updated the affected code path.

The full research post is available here:

“Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities”

https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities

I’ll be hosting an AMA and would be happy to discuss:

• The vulnerability research and disclosure process

• Memory-safety risks in native extensions used by memory-safe languages

• How AI-assisted systems can help prioritize suspicious code

• Lessons from analyzing a large C-based Ruby dependency

• Coordinating fixes across an open-source library and a downstream application

• Getting started with AI-assisted vulnerability research

• General questions about security research and defensive tooling

To keep the discussion responsible, I may avoid sharing details that would make reproduction against unpatched systems easier.

I’ll be here live on Friday, July 31, from 12:00 PM to 1:00 PM PT. Questions are welcome in advance, and I’ll answer as many as I can during the session.

Looking forward to the discussion.

Post your questions

Post your questions in the comments now, then join the live AMA on Friday, July 31st at 12 PM PT: SHARE QUESTIONS HERE

View Story

The case raises concerns about the criminalization of security tools and the application of constitutional rights at US borders.

The incident is connected to Tunick’s alleged association with the movement against Cop City, a police training facility.

View Story

Discussion on This Story

Members in PWN are discussing this story here.

Should using a privacy phone raise suspicion at the border?

An Atlanta man is facing federal charges after his GrapheneOS phone automatically wiped itself during an airport search, a feature the privacy-focused operating system is designed to perform when tamper attempts are detected.

Prosecutors appear to be treating the wipe as evidence of wrongdoing, while privacy advocates argue that using secure technology is a legal right. The case puts a spotlight on the tension between border search powers and the growing use of privacy-hardening tools by ordinary people.

What do you think?

Should wiping your phone at the border be treated as suspicious behavior, or is protecting your data a basic right?

Join the Discussion

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 40,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, and The Guardian breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

If you have questions, comment below and we’ll get them answered! Make sure to join our free Reddit community for further discussion.

Ethical Hacking Isn’t for Everyone

Before we get into the roadmap, we need to make one thing clear… Ethical hacking isn’t for everyone. It doesn’t matter how smart you are, or how fast you can learn - what really matters is how much you love learning this skillset.

If you don’t genuinely love the work, the field will burn you out fast.

This isn’t a career you can coast through. It requires constant learning, because the technology, the attack techniques, and the defenses are all evolving at the same time. In the era of artificial intelligence, this pace is accelerated.

If you’re not the kind of person who wants to keep reading, testing, and breaking things in your free time, this path will feel like a grind rather than a calling.

The good news is: If you love learning how things work, and breaking them, then this field is for you! Your genuine curiosity for the process is your superpower.

What Hacking Actually Requires

Here’s the core truth about hacking: to exploit a system, you have to have a deep understanding of how it works.

You need to know exactly how something is supposed to work, in enough depth that you can figure out how to make it do something it was never designed to do.

That kind of understanding doesn’t come from a weekend course. It comes from years of curiosity compounding on itself.

The field is also enormous.

You could spend an entire career studying one narrow slice of it, like wireless protocols or malware obfuscation, and still not know everything. That’s actually good news for beginners.

It means you don’t need to master everything. You need a broad map of the landscape first, so you understand where the different specialties fit together, and then you pick one to three areas to go deep on.

The Landscape: Know a Bit of Everything First

Before you specialize, get a working knowledge of the major domains of ethical hacking. The current CEH v13 curriculum is organized into 20 modules, and it’s a solid checklist for a beginner’s map of the field.

Reconnaissance and target mapping

• Footprinting and reconnaissance (gathering intel on a target before touching it)

• Scanning networks

• Enumeration

• Vulnerability analysis

System and application exploitation

• System hacking

• Hacking web servers

• Hacking web applications

• SQL injection

Malware, sniffing, and disruption

• Malware threats (trojans, viruses, worms, fileless malware, APTs)

• Sniffing

• Denial-of-service and distributed denial-of-service attacks

• Session hijacking

Perimeter evasion and human-focused attacks

• Evading IDS, firewalls, and honeypots

• Social engineering

Wireless and mobile

• Hacking wireless networks

• Hacking mobile platforms (Android and iOS)

Emerging and specialized environments

• IoT and OT (operational technology) hacking

• Cloud computing (including containers and serverless)

Foundational theory

• Introduction to ethical hacking (fundamentals, laws, and standard procedures)

• Cryptography

You don’t need to be an expert in all of these to start. You need enough exposure to each one that when you eventually pick a specialty, you know how it connects to the rest of the puzzle.

A phishing specialist who understands network evasion is far more dangerous, and far more employable, than one who only knows phishing.

Building Your Foundation

Certifications aren’t the end goal. They’re a structured way to make sure you’re not skipping the fundamentals. Here’s a sensible order.

CompTIA A+ Covers the basics of how computers and operating systems actually work. If you don’t know how a filesystem, a boot process, or an OS handles permissions, you’re not ready to attack any of it yet.

CompTIA Network+ Teaches you how networks function: routing, switching, protocols, and how data actually moves from one machine to another. Nearly every attack technique assumes you understand this layer.

CompTIA Security+ Introduces the fundamentals of security work and the shared vocabulary of the industry. This is often where the line gets drawn between someone who’s casually interested in hacking and someone who’s starting to think like a professional.

CEH (Certified Ethical Hacker) Gives you the high-level overview described above: a tour through every major attack category so you understand the full landscape before narrowing your focus.

OSCP (Offensive Security Certified Professional) This is the gold standard for hands-on technical skill. It’s earned through a grueling 24-hour practical exam where you actually have to compromise systems, not answer multiple choice questions about them. Holding an OSCP is one of the clearest signals to employers that you can do real red team work, and it’s often a baseline requirement for red team roles at larger companies.

Specialize Once You Know Where You Fit

Once you’ve got the broad overview and you’ve noticed which corner of the field keeps pulling your attention, it’s time to go deep. This is where you start learning the bleeding edge of a specific specialty rather than the textbook version.

A few examples of specialized training worth pursuing, depending on your interest:

• Phishing and credential capture: Evilginx Mastery teaches how top-tier attackers use reverse proxy techniques to phish past multi-factor authentication and capture session cookies, not just passwords.

• Web application security: The PortSwigger Web Security Academy and its Burp Suite Certified Practitioner (BSCP) exam go far beyond the basics of SQL injection and cross-site scripting into modern, real-world web exploitation.

• Malware analysis and reverse engineering: SANS FOR610 (Reverse-Engineering Malware) is a well-respected deep dive into dissecting real malicious code.

• Wireless attacks: OffSec’s PEN-210 (Foundational Wireless Network Attacks), which leads to the OSWP certification, goes deep into cracking and exploiting Wi-Fi networks beyond what a general course will cover.

• Cloud penetration testing: SANS SEC588 (Cloud Penetration Testing) focuses specifically on AWS and Azure attack surfaces, an area becoming essential as more infrastructure moves off-prem, and a rapidly growing specialty with less competition than traditional network pentesting.

Join a Community

Learning on your own is a grind. The fastest way to level up is to surround yourself with people already doing the work.

PWN offers a free community on Reddit that hosts AMAs with industry professionals and journalists following the bleeding edge of the field.

It’s also a solid place to keep up with industry news, the latest vulnerabilities, new hacking techniques, and tutorials from people actually doing this for a living.

Having a place to ask questions and see what real practitioners are working on will save you more time than any single course.

Frequently Asked Questions

These questions have been asked by members of the community. If you have a question, comment below and we’ll get it answered!

No, not to start. Basic scripting (Python is the common pick) helps later for automating tasks, but you can begin learning networking, operating systems, and security concepts without writing a line of code. Add coding once you know which specialty you’re leaning toward.

No. Most employers care more about demonstrated skill (certs, a home lab, CTF results, a portfolio) than a diploma. A degree can help with some corporate or government roles, but it’s not a requirement to break in.

Only on systems you own or have explicit written permission to test. Practicing on someone else’s network or app without permission is illegal, full stop. Use built-for-this platforms like TryHackMe, Hack The Box, or your own home lab instead.

No, but they’re helpful. Certs aren’t magic tickets, employers still care about actual skill, but they give you a structured curriculum so you’re not guessing what to learn next, and they signal to employers that you’ve hit a baseline. Think of them as a forcing function, not a finish line.

That’s normal, and it’s exactly why structured training programs help. Nobody can hand you a clean list like “study networking, then OS internals, then Linux, then...” because the real list is much longer and messier than that. A structured course does that sequencing for you, so you’re not lost trying to map the whole field before you’ve even started.

The Real Starting Point

If all of this feels like a lot, that’s because it is. The actual first step is simpler than it looks: pick up CompTIA A+ material, or even just start building and breaking things in a home lab, and see if you actually enjoy the process of pulling a system apart to understand it.

If you do, the rest of this path will feel less like a checklist and more like a series of doors you’re excited to open.

Got a question we didn’t cover, or want a second opinion on where to start?

Share it in the comments. We read every one, and there’s a good chance someone in the community has already been exactly where you are.

Stay sharp. Stay secure.

Ask Your Questions

Privacy experts warn the rules would effectively end anonymous phone service in the US and could cut off millions of people who lack a standard ID.

CNET Reporter, Joe Supan, broke down what that would mean, and he’s coming to the PWN Community to answer your questions.

Joe is a senior writer at CNET covering home technology, broadband, and privacy. He’s joining us live on Friday, July 24th from 2 to 3 PM ET.

Post your questions

Post your questions in the comments now, then join the live AMA on Friday, July 24th at 2 PM ET: SHARE QUESTIONS HERE

Upcoming AMA: Friday, July 24th (2 PM - 3 PM ET)

“I’m Joe Supan, a senior writer at CNET covering home technology, broadband, and privacy. Before CNET, I reported on broadband policy, the digital divide, and privacy issues for Allconnect. My work has been referenced by the Los Angeles Times, Forbes and National Geographic, among others.

I recently reported on the FCC’s proposed Know-Your-Customer requirements, which would force telecom companies to collect a name, physical address, and government ID for every cellphone customer. Privacy experts warn the rules would effectively end anonymous phone service in the US and could disconnect millions of people who lack a standard ID.

Ask me anything about:

• The FCC’s Know-Your-Customer proposal and what it would mean for anonymous phone use

• How the rules could affect journalists, travelers, whistleblowers, and marginalized groups

• Whether telecoms can be trusted with sensitive customer data

• Broadband policy and the digital divide

• Practical steps people can take to protect their privacy

• Anything else on tech, privacy, and surveillance

I’ll be here live on 7/24 from 2 to 3 PM ET answering your questions in real time. Feel free to leave questions in advance, and I’ll get to them when I go live.

Looking forward to your questions.”

Post your questions

Post your questions in the comments now, then join the live AMA on Friday, July 24th at 2 PM ET: SHARE QUESTIONS HERE

Privacy experts warn the rules would effectively end anonymous phone service in the US and could cut off millions of people who lack a standard ID.

CNET Reporter, Joe Supan, broke down what that would mean, and he’s coming to the PWN Community to answer your questions.

Joe is a senior writer at CNET covering home technology, broadband, and privacy. He’s joining us live on Friday, July 24th from 2 to 3 PM ET.

Post your questions

Post your questions in the comments now, then join the live AMA on Friday, July 24th at 2 PM ET: SHARE QUESTIONS HERE

Upcoming AMA: Friday, July 24th (2 PM - 3 PM ET)

“I’m Joe Supan, a senior writer at CNET covering home technology, broadband, and privacy. Before CNET, I reported on broadband policy, the digital divide, and privacy issues for Allconnect. My work has been referenced by the Los Angeles Times, Forbes and National Geographic, among others.

I recently reported on the FCC’s proposed Know-Your-Customer requirements, which would force telecom companies to collect a name, physical address, and government ID for every cellphone customer. Privacy experts warn the rules would effectively end anonymous phone service in the US and could disconnect millions of people who lack a standard ID.

Ask me anything about:

• The FCC’s Know-Your-Customer proposal and what it would mean for anonymous phone use

• How the rules could affect journalists, travelers, whistleblowers, and marginalized groups

• Whether telecoms can be trusted with sensitive customer data

• Broadband policy and the digital divide

• Practical steps people can take to protect their privacy

• Anything else on tech, privacy, and surveillance

I’ll be here live on 7/24 from 2 to 3 PM ET answering your questions in real time. Feel free to leave questions in advance, and I’ll get to them when I go live.

Looking forward to your questions.”

Post your questions

Post your questions in the comments now, then join the live AMA on Friday, July 24th at 2 PM ET: SHARE QUESTIONS HERE

A recent investigation revealed that police search data was exposed on public search engines like DuckDuckGo and Bing. This exposure included specific license plates along with confidential investigation details.

Today, the journalists who uncovered this breach are taking your questions live.

Join 404 Media’s Jason Koebler and Joseph Cox from 12 PM to 1 PM ET to discuss mass surveillance, privacy, and how they investigated this story.

👉 Ask your questions here!

If you’ve never heard of Flock, or you’ve been watching the backlash unfold, this is the place to ask what’s actually going on.

Post your questions

Share your questions in the comments now so they can answer them the moment they go live! Share your questions here.

AMA Starts Soon: Tuesday, July 21st (12 PM - 1 PM ET)

“We’re Jason Koebler and Joseph Cox, two of the co-founders of 404 Media, a journalist-owned publication covering technology, surveillance, crime, and the internet.

Jason spent six years as editor-in-chief of Motherboard, where he led editorial and produced award-winning documentaries and reporting on everything from right to repair to ticket scalping.

Joseph is an investigative reporter whose work has triggered hundreds of millions of dollars in fines against major telecoms, shut down data brokers, stopped companies from selling location data tied to abortion clinics, and pushed lawmakers toward new privacy legislation.

We recently reported that Flock, the automatic license plate reader (ALPR) company, exposed some of the license plates cops were searching for and the reasons behind those searches, through DuckDuckGo and Bing.

Ask us anything about:

• The Flock leak and what it reveals about ALPR surveillance

• How license plate readers are being used by law enforcement

• How we approach surveillance and investigative stories

• Working with sources and documents

• Building and running an independent, reader-funded newsroom

• Anything else on tech, privacy, and surveillance

We’ll be here live on Tuesday, July 21st from 12 PM to 1 PM ET answering your questions in real time. Feel free to leave questions in advance, and we’ll get to them when we go live.

Looking forward to your questions.”

Post your questions

Share your questions in the comments now so they can answer them the moment they go live! Share your questions here.

Jason Koebler and Joseph Cox, two of the co-founders of 404 Media, are joining us for a live AMA on Tuesday, July 21st from 12 PM to 1 PM ET.

Post your questions

Share your questions in the comments now so they can answer them the moment they go live! Share your questions here.

Upcoming AMA: Tuesday, July 21st (12 PM - 1 PM ET)

“We’re Jason Koebler and Joseph Cox, two of the co-founders of 404 Media, a journalist-owned publication covering technology, surveillance, crime, and the internet.

Jason spent six years as editor-in-chief of Motherboard, where he led editorial and produced award-winning documentaries and reporting on everything from right to repair to ticket scalping.

Joseph is an investigative reporter whose work has triggered hundreds of millions of dollars in fines against major telecoms, shut down data brokers, stopped companies from selling location data tied to abortion clinics, and pushed lawmakers toward new privacy legislation.

We recently reported that Flock, the automatic license plate reader (ALPR) company, exposed some of the license plates cops were searching for and the reasons behind those searches, through DuckDuckGo and Bing.

Ask us anything about:

• The Flock leak and what it reveals about ALPR surveillance

• How license plate readers are being used by law enforcement

• How we approach surveillance and investigative stories

• Working with sources and documents

• Building and running an independent, reader-funded newsroom

• Anything else on tech, privacy, and surveillance

We’ll be here live on Tuesday, July 21st from 12 PM to 1 PM ET answering your questions in real time. Feel free to leave questions in advance, and we’ll get to them when we go live.

Looking forward to your questions.”

Post your questions

Share your questions in the comments now so they can answer them the moment they go live! Share your questions here.

Lapsus$ ransomware group is claiming a massive breach of GitHub, allegedly compromising 299 employees and over 2.5 million user accounts.

The FBI has built a 22,000 square-foot replica town in Huntsville, Alabama to train law enforcement agents in responding to real-world cyberattacks.

Details below…

Got something worth sharing?

PWN is a community for hackers and security enthusiasts.

We feature the best posts in this newsletter and we’re looking for news stories, writeups, tools, tutorials, discussion threads, and questions that spark real conversation.

We are accepting submissions for: News stories; Tutorials/write-ups; Tools you built or found useful; Discussion threads; or Questions that spark good conversation.

» Create a post, and you could be featured in the next email!

Our community is growing fast, with 935,000 views a month, 33,000 members, and 200+ new people joining daily. Create a post and you could be featured.

U.S. Orders Anthropic to Pull Fable 5 and Mythos 5 Access for Foreign Nationals

The U.S. government dropped an abrupt mandate on Anthropic, ordering the company to suspend access to two of its most advanced AI models for all foreign nationals, citing national security risks.

The directive, issued at 5:21 p.m. ET, is linked to a reported method for bypassing Fable 5’s safety guardrails. Anthropic is cooperating while pushing back on what it describes as an overreaction to a narrowly defined jailbreak. Other models remain accessible, though Fable 5’s architecture means cybersecurity queries are currently rerouted to Claude Opus 4.8. The U.S. Department of Defense had previously flagged Anthropic as a supply chain risk.

Read more

Lapsus$ Claims Massive GitHub Breach Affecting 2.5 Million Accounts

The notorious Lapsus$ group is claiming it has breached GitHub’s internal systems, and given the group’s track record, the security community is taking the claim seriously.

The group alleges it compromised 299 GitHub employees, exposed 117 third-party credentials, and put over 2.5 million user accounts at risk. Lapsus$ has previously confirmed breaches at Nvidia, Microsoft, Samsung, and Uber before going public. GitHub has not confirmed the breach, but the scope of the claimed access raises serious questions about supply chain security for the millions of developers who depend on the platform.

Read more

FBI Built a Fake Town to Simulate Cyberattacks on Critical Infrastructure

The FBI quietly opened a 22,000 square-foot replica town in Huntsville, Alabama designed to help agents practice responding to ransomware attacks and other cyber incidents against real-world infrastructure.

The Kinetic Cyber Range includes fully furnished homes, a hospital, and a mock power company, letting agents simulate scenarios like hospital systems going offline mid-attack. Since opening in February 2025, the facility has trained over 1,400 personnel. The training also covers digital forensics on encrypted devices, with techniques that allow data extraction without disclosing vulnerabilities to manufacturers. Ransomware losses hit $20.9 billion in 2025, making the investment timely.

Read more

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 32,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, and The Guardian breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit

On the software side, two tools tackle real gaps in security visibility: one automates open-source intelligence gathering across dark web sources, and another tracks malicious browser extensions that often fly under the radar even after being removed from official stores.

Rounding things out is a practical infrastructure project, a step-by-step video series walking through building a professional malware analysis environment lab using automated deployment tools. View latest member submitted projects.

Details below…

Want to share your project?

PWN is a community for hackers and security enthusiasts.

We feature the best posts in this newsletter and we’re looking for news stories, writeups, tools, tutorials, discussion threads, and questions that spark real conversation.

To submit your project: Create a new post about your project, and use the ‘project’ flair when posting to be automatically submitted!

» Create a post, and you could be featured in the next email!

Our community is growing fast, with 935,000 views a month, 35,000 members, and 200+ new members joining daily. Create a post and you could be featured.

VoidAccess: An Automated Dark Web Intelligence Tool

A community member built a command-line tool that runs a structured dark web investigation in under three minutes, returning actionable intelligence from dozens of sources at once.

The tool searches across the anonymous Tor network, code-sharing platforms, paste sites, and security news feeds simultaneously. In a live demonstration against a major ransomware group’s infrastructure, it surfaced active breach disclosures affecting a Mexican telecoms company and a financial title agency, identified five threat actor aliases, flagged a ransomware-as-a-service storefront with advertised pricing, and mapped nearly 400 shared IP addresses linking different criminal groups together. The results are saved automatically as a structured report. The tool is free, open source, and installable with a single command.

Read more

Malware Lab From Scratch: A Home Security Research Environment

A series of tutorial videos walks through building a professional-grade malware analysis lab at home, culminating in a single-button deployment system.

The creator drew on experience setting up a similar environment professionally, then built a personal version designed to be a practical starting point others can adapt.

The third installment focuses on automation: using a continuous integration pipeline hosted on a code platform to deploy the entire lab setup with one click. All three parts are freely available, and the full project configuration is published openly for anyone who wants to fork it or build on top of it.

Read more

Malicious Extension Sentry: A Browser Extension Threat Tracker

Browser extensions are a surprisingly effective hiding spot for malware, partly because there has never been a reliable, up-to-date list of dangerous ones. This project fills that gap.

Malicious Extension Sentry scrapes official browser stores and security sources daily to compile a continuously updated list of flagged and removed extensions, then exposes that data in a format that plugs directly into existing security workflows. It also ships a command-line auditing tool for checking extensions across a fleet of machines, and a browser extension for real-time monitoring. Crucially, it continues tracking threats even after they have been pulled from the official store, which is often when detection lapses.

Read more

Join PWN on Reddit

PWN is where security people go to stay ahead.

Breach reports, exploits, vendor advisories, and the kind of conversations that make you better at your job, all in one feed.

We’re 32,000+ hackers and cybersecurity enthusiasts strong, with 935,000 monthly views and 200+ new members every day.

You’ll be in the same threads as journalists from Wired Magazine, Electronic Frontier Foundation, 404 Media, Fast Company, and The Guardian breaking the stories firsthand, plus security teams from vendors like Proton, Intigriti, and Hudson Rock sharing research and answering questions directly.

Why join:

• Know what’s hitting before it hits you. Get the breach reports, exploits, and vendor advisories early so you can act before they become your problem.

• Get sharper, not just busier. Skip the noise and learn from people actually doing the work, on the AI exploits, new defenses, and techniques that move your skills forward.

• Make the career move you’ve been planning. Whether it’s your first paycheck in security or your jump from IT into offensive work, you’ll find members who’ve made it and are happy to help you do the same.

• Be the person at work who already knows. Walk into Monday meetings ahead of the ransomware incidents and zero-days landing on your team’s radar, and earn the trust that comes with it.

• Find your people. Trade ideas with hackers and pros who’ll actually answer your questions, in a community that stays high quality because the bots and noise get cleaned up.

Join PWN on Reddit