r/netsec • • Jul 02 '26

Hiring Thread /r/netsec's Q3 2026 Information Security Hiring Thread

17 Upvotes

Overview

If you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.

We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.

Please reserve top level comments for those posting open positions.

Rules & Guidelines

Include the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.

  • If you are a third party recruiter, you must disclose this in your posting.
  • Please be thorough and upfront with the position details.
  • Use of non-hr'd (realistic) requirements is encouraged.
  • While it's fine to link to the position on your companies website, provide the important details in the comment.
  • Mention if applicants should apply officially through HR, or directly through you.
  • Please clearly list citizenship, visa, and security clearance requirements.

You can see an example of acceptable posts by perusing past hiring threads.

Feedback

Feedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)


r/netsec • • 27d ago

r/netsec monthly discussion & tool thread

10 Upvotes

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.


r/netsec • • 3h ago

Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets

Thumbnail mongodb.com
4 Upvotes

r/netsec • • 10h ago

ElectroNG is now open source. ElectronJS Security Scanner.

Thumbnail blog.doyensec.com
21 Upvotes

ElectroNG is now free and open source.


r/netsec • • 8h ago

A malicious game server can crash the Godot clients that join it

Thumbnail axeghost.offprint.app
11 Upvotes

In Godot 4.0 and later, in games using the engine's standard spawning setup, a peer with authority over the relevant spawner - by default the server the client joins - can crash that client with one crafted packet.


r/netsec • • 5h ago

Where a million-request-a-second HTTP/2 flood goes: XDP drop counters from two real attacks

Thumbnail shieldify.ee
6 Upvotes

r/netsec • • 4h ago

I got RCE on the sandboxes of Instinct and Muse!

Thumbnail amirzak.substack.com
4 Upvotes

r/netsec • • 3h ago

Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/

Thumbnail slcyber.io
3 Upvotes

r/netsec • • 3h ago

SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks

Thumbnail hybrid-analysis.blogspot.com
2 Upvotes

r/netsec • • 9h ago

Passing a TPU Through to a Paravirtualized Guest

Thumbnail edera.dev
3 Upvotes

r/netsec • • 3h ago

EDK2 PXE Flaw (CVE-2026-97631): Find What You Run

Thumbnail cloudsleuth.io
1 Upvotes

r/netsec • • 19h ago

New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts

Thumbnail hunio.org
19 Upvotes

I've recently released a blog covering how I discovered a new Kerberos delegation abuse path!

By combining Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial user technique, Constrained Delegation without Protocol Transition can now be abused against SPN-less accounts. I also had to add S4U2Proxy + U2U support to Impacket to get this working. :)

Blog: https://hunio.org/security/abusing-constrained-delegation-without-protocol-transition-against-spn-less-accounts

Impacket PR: https://github.com/fortra/impacket/pull/2324


r/netsec • • 1d ago

I've proven that you don't need quotes or parentheses in JavaScript

Thumbnail blog.ikaes.de
54 Upvotes

You can overwrite the prepareStackTrace property of the Error object by String prototype's functions and invoke them without parentheses. Then by overwriting the Error and Array prototype it is possible to control the arguments. Combining this behavior, together with some JSFuck-inspired tricks, it is possible to generate arbitrary JavaScript strings and run arbitrary JavaScript with only letters + - = and ,


r/netsec • • 1d ago

The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation

Thumbnail acronis.com
24 Upvotes

Our Threat Research Unit published a breakdown of “The Gentlemen” - a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, reportedly after affiliates split off from established groups like LockBit and Qilin. A few things that stood out from the research:

  • They’re offering affiliates up to 90% of ransom revenue - aggressive even by RaaS standards
  • Claimed 800+ victims across the US and Europe, making them one of the top RaaS groups this year
  • Cross-platform ransomware variants targeting Windows, Linux, NAS, and BSD
  • Active use of EDR-killing tooling - one recent incident involved a custom dropper abusing vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers (BYOVD)
  • A breach of the group’s own infrastructure gave researchers rare visibility into their affiliate network, tooling, and ties to the broader ransomware ecosystem

Full technical writeup linked below for anyone who wants to dig into the IOCs and affiliate details.
https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/


r/netsec • • 1d ago

From Arbitrary File Read to Shell: Yet Another RCE in Telerik

Thumbnail tantosec.com
20 Upvotes

r/netsec • • 1d ago

A community translation can run attacker-chosen code in an exported Godot game

Thumbnail axeghost.offprint.app
25 Upvotes

r/netsec • • 1d ago

GhostAction Crosses Paths With PolinRider

Thumbnail blog.gitguardian.com
2 Upvotes

r/netsec • • 1d ago

Choose Your Backend: Three TLS Bugs in GoAhead

Thumbnail foxio.io
13 Upvotes

r/netsec • • 1d ago

How to Intercept HTTP/3 Traffic (QUIC and QPACK Explained)

Thumbnail interceptsuite.com
48 Upvotes

r/netsec • • 1d ago

Reviving GLPI Agent Abuse with ESC17

Thumbnail fenrisk.com
1 Upvotes

r/netsec • • 2d ago

Context Bombs: Making attacking agents pay

Thumbnail agentic.tracebit.com
110 Upvotes

r/netsec • • 1d ago

Connection Reuse leading to desync

Thumbnail xclow3n.com
6 Upvotes

r/netsec • • 2d ago

The AI RCEssion: Why AI-driven security is calling in decades of software tech debt

Thumbnail blog.tedivm.com
17 Upvotes

r/netsec • • 3d ago

Breaking the AWS MCP Python Sandbox

Thumbnail xplo1t-sec.github.io
85 Upvotes

r/netsec • • 4d ago

Contains AI How LLM-Based Penetration Testing Harnesses Work

Thumbnail utkusen.substack.com
93 Upvotes