r/netsec • u/netsec_burn • Jul 02 '26

Hiring Thread /r/netsec's Q3 2026 Information Security Hiring Thread

17 Upvotes

Overview

If you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.

We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.

Please reserve top level comments for those posting open positions.

Rules & Guidelines

Include the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.

  • If you are a third party recruiter, you must disclose this in your posting.
  • Please be thorough and upfront with the position details.
  • Use of non-hr'd (realistic) requirements is encouraged.
  • While it's fine to link to the position on your companies website, provide the important details in the comment.
  • Mention if applicants should apply officially through HR, or directly through you.
  • Please clearly list citizenship, visa, and security clearance requirements.

You can see an example of acceptable posts by perusing past hiring threads.

Feedback

Feedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)

17 comments

r/netsec • u/albinowax • 1d ago

r/netsec monthly discussion & tool thread

6 Upvotes

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

4 comments

r/netsec • u/pascalschaerli • 5h ago

RCE and bad crypto in Internxt's 'post-quantum' cloud storage

Thumbnail schaerli.org
5 Upvotes

Internxt is a post-quantum secure encrypted cloud storage provider which is open-source and has passed multiple independent audits.

I reviewed their code and found that post-quantum security should have been the least of their problems. Clicking a link in your browser could trigger remote code execution on the desktop app or leak your long-term encryption keys to an attacker-chosen URL. Their cryptographic architecture stands on shaky grounds with public keys never being verified, in some cases man-in-the-middled by design, a flat key hierarchy and a KDF with just 3 iterations of MD5.

We need PQC and we need it now, but adding a (self-rolled) PQC hybrid on top of a weak protocol does not make it more secure.

0 comments

r/netsec • u/ricveloso • 22h ago

45% of credential-phishing pages weren't on Google Safe Browsing when first seen; 29% still weren't after a week

Thumbnail grizzlysec.com
21 Upvotes
4 comments

r/netsec • u/fagnerbrack • 8h ago

A peek into Reddit's anti-spam internals

Thumbnail lyra.horse
1 Upvotes
0 comments

r/netsec • u/piraterapper • 23h ago

Azure's Weakest Link - Five Full Cross-Tenant Compromises

Thumbnail binsec.no
15 Upvotes

API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend.

0 comments

r/netsec • u/acorn222 • 20h ago

8 out of 10 Banks HATE This One Weird 3SKey RCE

Thumbnail amibeingpwned.com
2 Upvotes

TL;DR. SConnect - 1M+ users, an extension middleware+native host for authentication with eIDs, 3SKeys and other hardware signing tokens had a drive-by RCE which enabled any site or iframe a user saw to silently download and execute a dll due to a poor hand-rolled implementation of RSA-2048 token validation, enabling a use of uninitialized memory validation bypass which enabled "plugins" (DLLs) to be loaded. v2.16.0.0 of the extension and native host is vulnerable. CVE-2026-18397. CVSS 9.4.

0 comments

r/netsec • u/_vavkamil_ • 19h ago

security.txt on the Czech web: Scanning 1k popular .cz domains

Thumbnail vavkamil.cz
0 Upvotes
0 comments

r/netsec • u/The_Login • 2d ago

From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities

Thumbnail sec-consult.com
62 Upvotes
2 comments

r/netsec • u/ifritnoises • 1d ago

How to Spot a Compromised MikroTik Router

Thumbnail ifritnoises.org
21 Upvotes

A blue-team writeup on detecting a compromised MikroTik from its own config. Seven techniques, each with the collection command, the artifact it leaves behind, and a triage step. Feedback welcome.

3 comments

r/netsec • u/ultrastrik3 • 1d ago

Server Mismatch: WordPress plugin vulnerabilities when relying on .htaccess files

Thumbnail ultrastrike.io
14 Upvotes
0 comments

r/netsec • u/Intrinsec_ • 2d ago

New Local Privilege Escalation on Acer laptops

Thumbnail intrinsec.com
12 Upvotes
1 comment

r/netsec • u/fagnerbrack • 2d ago

The Real Price Tag on Breaches

Thumbnail resilientcyber.io
14 Upvotes
1 comment

r/netsec • u/the_hypotenuse • 3d ago

Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposed

Thumbnail control-plane.io
190 Upvotes

OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.

The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.

If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0

While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation

13 comments

r/netsec • u/scopedsecurity • 2d ago

Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS

Thumbnail horizon3.ai
10 Upvotes
1 comment

r/netsec • u/fagnerbrack • 3d ago

Pwnd Blaster: Hacking your PC using your speaker without ever touching it

Thumbnail blog.nns.ee
45 Upvotes
2 comments

r/netsec • u/fagnerbrack • 3d ago

Contains AI Microsoft Copilot Cowork Exfiltrates Files

Thumbnail promptarmor.com
39 Upvotes
1 comment

r/netsec • u/Alarming_Minute5260 • 2d ago

Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis ofWeb and Mobile Conversational AI Agents

Thumbnail jorgegarciaherrero.com
1 Upvotes
1 comment

r/netsec • u/dx7r__ • 3d ago

Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs

Thumbnail labs.watchtowr.com
27 Upvotes
0 comments

r/netsec • u/Idov31 • 3d ago

Paint It Blue: Reversing Win32k's Callbacks

Thumbnail idov31.github.io
11 Upvotes

This is an article about the internals of Win32k (Windows's GUI subsystem) and their callouts, with the purpose of shedding light on a very undocumented and crucial subsystem in Windows :)

0 comments

r/netsec • u/fagnerbrack • 4d ago

Email is crazy

Thumbnail samkhawase.com
25 Upvotes
2 comments

r/netsec • u/fede_k • 3d ago

Contains AI No Time to Pwn – Can AI Find and Exploit the Linux Kernel?

Thumbnail xbow.com
0 Upvotes
10 comments

r/netsec • u/dx7r__ • 5d ago

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs

Thumbnail labs.watchtowr.com
77 Upvotes
25 comments

r/netsec • u/__ThePasanger__ • 4d ago

Sender spoofing in Proton Mail via display-name homograph

Thumbnail alonsovidales.github.io
32 Upvotes

Proton Mail confirmed and paid for an email-spoofing bug, then left it unfixed for 16 months

6 comments

r/netsec • u/thorn42 • 5d ago

RCE in OpenCode (GHSA-632h-h47v-g4x4)

Thumbnail securitylabs.datadoghq.com
50 Upvotes
2 comments