Cybersecurity Creator x Instructor | Network Security| AI | Memes| I POST EDUCATIVE CONTENT | Turn on Post notis 🔔 | PR/COLLAB 📥
my links 🔗 👇
Joined October 2024
- Tweets29K
- Following191
- Followers54.2K
- Likes8.4K
Pinned Tweet
Cybersecurity Roadmap: Step-by-Step Guide for Aspiring Professionals
Embarking on a cybersecurity journey can be challenging, but with the right plan, you can progress steadily and achieve your goals. Based on my personal journey as a penetration tester in training, here’s a roadmap tailored to aspiring cybersecurity professionals, infused with my insights and practical experiences.
[A thread 📷]
How to become a hacker ethically.
1. Learn Networking - Understand IP addresses, ports, DNS, TCP/IP, and how networks work.
2. Master Linux - Get comfortable with the command line, especially Kali Linux.
3. Learn Programming - Start with Python, then explore Bash and basic JavaScript.
4. Understand Cybersecurity - Study vulnerabilities, web security, authentication, and common attacks.
5. Learn the Tools - Practice with Nmap, Wireshark, Burp Suite, and Metasploit.
6. Build a Home Lab - Practice safely using virtual machines and intentionally vulnerable applications.
7. Use Legal Platforms - Train on TryHackMe, Hack The Box, and PortSwigger Web Security Academy.
8. Build a Portfolio - Document your labs, write-ups, projects, and security findings.
9. Get Certified (if you’ve got the money) - Consider Security+, eJPT, or PNPT as you progress.
Stay Ethical & Never test systems without explicit authorization.
About $2.5 billion left a Binance hot wallet.
One transaction.
167,000 ETH. 1.6 billion USDT. 63 other tokens.
All sent to a brand new address.
The wallet that triggered it was funded through Tornado Cash.
Three deposits of about 0.1 ETH each.
Roughly the price of a nice dinner.
That's the starting capital for the biggest crypto exchange hack in years.
CZ went on X within the hour.
"It does look like a hack on Binance."
Then added "user funds are safe."
Then reminded everyone he doesn't run Binance anymore.
Binance's official statement said "potential security issue."
So the guy who left is confirming the hack.
The company is still calling it a potential security issue.
Then the funny part.
Tether froze about 1.5 billion of the stolen USDT.
Circle froze another 823 million.
Within hours.
Crypto's entire pitch is that nobody can freeze your money.
Two companies just froze two billion dollars before dinner.
Decentralized finance. Centralized off switch.
The hacker still has the ETH.
$600 million in liquidations hit the market in an hour.
And somewhere a wallet funded with a few hundred dollars is sitting on hundreds of millions it can't move.
Code is law.
Until Tether is in the room.
Six US military bases lost their freezers.
Late August.
At least six commissaries. Fort Huachuca. Fort Irwin. Others.
All of them went into defrost mode.
All the frozen food spoiled.
In at least one case the temperature got cranked up overnight.
Staff showed up in the morning to melted food.
The bases said it was a malfunction.
Two months later Reuters reports the Pentagon is treating it as a suspected cyberattack.
Four officials. Cyber Command unit assigned.
Investigators are now talking to French counterparts.
Because in October hackers defrosted 200 French supermarkets the exact same way.
So France wasn't the first.
America just didn't notice it got hit first.
Nobody has confirmed the cause. Reuters can't say how far the investigation got.
Can't say who did it.
Can't say whether the bases even run Danfoss controllers.
One El Centro commissary lists a Danfoss system. Which doesn't prove anything.
Just a coincidence sitting there.
The strongest military on earth has jets. Carriers. Satellites. Cyber Command.
And someone turned the heat up on the chicken nuggets.
Nobody saw it coming.
Because nobody patches the freezer.
Everything after the question mark is a query string, parameters appended to the base URL that the server receives and can log. The base link,[...], is all that is needed to load that specific post. Everything past the ? is extra data riding along for X's own purposes.
This is a well established pattern across platforms, not unique to X. Amazon tag parameters, YouTube si= tracking IDs, TikTok's share tokens, and Facebook's fbclid all work the same way. A redirect chain sends you through the platform's own server first using that identifier before reaching the actual content, generating data about the click before you arrive anywhere.
Staying clear of it is simple. Strip everything from the ? onward before sharing or clicking a link. on its own loads the identical post with zero tracking payload attached.
For anyone who wants this automated rather than manual, browser extensions like ClearURLs do this stripping automatically for known tracking parameters across every major platform the moment you copy or click a link, without needing to manually edit anything each time.
The link works exactly the same without the tracker. The tracker was never required for the content to load.
Someone just sent you a sticker.
You didn't open it. Didn't click it. Didn't do anything.
Code ran on your iPhone anyway.
Saifeldeen Aziz presented this at OffensiveCon Tokyo October 28.
Zero-click vulnerability. In Telegram stickers.
CVSS 9.8. Almost maximum severity.
The bug lives in rlottie. The library Telegram uses to render animated stickers.
A numeric truncation bug. Bad input. Buffer overflow. Code execution.
March 2026. Telegram told the Zero Day Initiative those checks don't matter.
Our servers validate every sticker. All of them. Before they reach your phone.
So the ZDI downgraded the score from 9.8 to 7.0.
Because the servers block bad stickers.
Aziz spent a year on Telegram.
Found new bugs. Found the logic flaws in how Telegram delivers stickers.
Chained them together.
Bypassed the server-side checks.
Made code that was supposed to be unreachable actually reachable.
Ran code on Telegram for iOS.
All zero-click. No interaction. Just a sticker in your chat.
Telegram says he's wrong.
His abstract says the flawed code still ships.
Telegram disputes the risk.
Aziz's question sits at the end.
If one company's servers are the only defense against a zero-click bug.
Is that a fix.
A design risk.
Or a backdoor.
Because right now someone can compromise your phone.
With a sticker.
And nobody has to ask permission.
You said you were gonna take your cybersecurity journey seriously at the start of the year
How’s that going so far?
Yoooooooo
Introducing Reality-Aware Rendering in @Simulon, a completely new way to create with the real world.
Place neural assets with your phone and act out the scene. When you stop recording, Simulon renders the take, reading everything in it (what you do, what you say and the place around you), and your assets respond to all of it.
The final is regenerated from your recording: a new performance of the scene, not a copy of the footage.
Available now on iPhone. Coming to Android soon.
The EU Council just voted to let companies steal your data.
Officially.
They call it "legitimate interest."
What it means. Your data. Your personal information. Training AI models.
Without asking you.
Without your consent.
Without anything except the company deciding their profit matters more than your privacy.
GDPR used to require consent or a legal basis. Clear. Specific. Yours or theirs.
Now the EU Council says legitimate interest is enough.
The company decides the balance. The company weighs the scales. The company always wins.
Sensitive data ends up in the training set by accident.
Medical records. Financial history. Biometric data.
The company says removing it costs too much effort.
So they keep it.
Train their models on it.
Move on.
Max Schrems calls it digital expropriation.
Europeans own their data. The EU Council just handed it to American and Chinese tech companies.
Google. OpenAI. Meta. Tencent. ByteDance. Alibaba.
They already hold massive amounts of European personal data.
Now they can use it. No consent. No permission. No apology.
The European Parliament still has to approve it.
But the Council backed it. Which means the momentum is there.
The data you thought was protected.
Is about to become someone else's property.
And the company gets to decide if it's worth asking you first.
They will decide no.
The EU Council, the body representing EU member state governments has approved a position that would let companies train AI on Europeans’ personal data without consent.
It would make AI training a recognised “legitimate interest” under GDPR one of the legal bases companies can use to process personal data without asking for permission under the current framework, AI training on personal data generally requires consent or a clear, specific legal basis this proposal shifts that.
what “legitimate interest” means in practice: the company decides that its interest in using your data outweighs your interest in not having it used.
The draft also proposes letting companies keep sensitive personal data that ends up in training sets “accidentally” if removing it would require “disproportionate effort.” with safeguards, but still.
Who benefits: companies that already hold large amounts of European personal data which are mostly American and Chinese AI firms.
Max Schrems’s framing: “digital expropriation.” Europeans’ data being taken and handed to companies without the people it belongs to having a say.
where it stands: the EU Council approved their position. the European Parliament must still agree. this is not law yet but the Council’s backing is a significant step.
Discord is about to put your public messages on Google.
Not next year. This November. Mid-December to be exact.
Every Discoverable Server gets a web page November 16.
Every server with 1,000+ members that Discord deems public enough.
63,000 of them.
Starting mid-December those messages show up in search results.
Someone Googles a question about gaming strategy. Your answer appears.
Someone Googles a niche community topic. Your take shows up.
All searchable. All indexed. All permanent.
Discord says only future messages. Not past ones.
Only public channels. Not private servers or DMs.
Only usernames removed. Not the content.
Discord frames this as convenience. Hard to find good answers on Discord. Now they're on Google.
What Discord doesn't say is someone scraped 4 billion Discord messages already.
Spy.pet. November 2023. Started selling access to profiles and message archives.
620 million users. 14,000 servers. All harvested. All for sale.
Discord did nothing. Still hasn't.
Now Discord is doing the exact thing Spy.pet does.
Except officially. Except Google sanctioned. Except you can opt out.
For now.
Go to Settings. Data and Privacy. Toggle it off.
But only new messages stay private. Old ones are already out there.
And when employers search your name. When recruiters search your opinions. When the internet searches what you said.
Your Discord comments are now part of your digital record.
Forever.
Abdulkadir | Cybersecurity retweeted
Hacked Oct 19, noticed Oct 23. That four-day gap matters more than the 2.58M headline.
On a customer database, what shortens it:
- alert on bulk reads and exports, not only failed logins
- keep mail credentials in a separate store from CRM data
- plant canary rows that page you when anyone touches them
- reset exposed passwords the day you confirm, not the day you announce
Sony got hacked on October 19.
Discovered it October 23.
Announced it October 27.
2.58 million So-net and plala customers.
Names. User IDs. Email addresses. Phone numbers. Birth dates.
54,401 email-password combinations.
16 bank account records. Full account numbers. Bank names.
Sony said the good news.
No credit cards stolen.
No PINs stolen.
We don't store those.
Which is great. Except someone has your bank account number and knows which bank it's at.
That's half the authentication right there.
Sony shut down the affected servers.
Reset passwords October 27.
Eight days after the hack.
Told everyone to watch out for suspicious communications.
Because now criminals have enough information to impersonate you.
But don't worry. Sony says no subsequent harm has been identified.
Yet.
The servers are offline. The connections are blocked. Internet services continue.
Which means Sony's infrastructure was so segmented that breaching one part didn't collapse the whole thing.
Also means for four days before they told anyone.
The hackers had full access.
Copying names. Copying emails. Copying passwords. Copying bank details.
Sony's timeline is always the same.
Breach happens. Days pass. Company discovers it. More days pass. Company announces it.
By then the data is everywhere.
2.58 million people just learned their bank account information is on the dark web.
Sony's apology is already in the mail.
Sony got hacked on October 19.
Discovered it October 23.
Announced it October 27.
2.58 million So-net and plala customers.
Names. User IDs. Email addresses. Phone numbers. Birth dates.
54,401 email-password combinations.
16 bank account records. Full account numbers. Bank names.
Sony said the good news.
No credit cards stolen.
No PINs stolen.
We don't store those.
Which is great. Except someone has your bank account number and knows which bank it's at.
That's half the authentication right there.
Sony shut down the affected servers.
Reset passwords October 27.
Eight days after the hack.
Told everyone to watch out for suspicious communications.
Because now criminals have enough information to impersonate you.
But don't worry. Sony says no subsequent harm has been identified.
Yet.
The servers are offline. The connections are blocked. Internet services continue.
Which means Sony's infrastructure was so segmented that breaching one part didn't collapse the whole thing.
Also means for four days before they told anyone.
The hackers had full access.
Copying names. Copying emails. Copying passwords. Copying bank details.
Sony's timeline is always the same.
Breach happens. Days pass. Company discovers it. More days pass. Company announces it.
By then the data is everywhere.
2.58 million people just learned their bank account information is on the dark web.
Sony's apology is already in the mail.
Sony has suffered a massive data breach affecting around 2.58 million So-net and plala customers.
Sony Network Communications says hackers accessed its member database on October 19. Leaked information includes:
• Names
• User IDs
• Email addresses
• Other customer information
• 16 bank account records, including account numbers and bank names
The company says it has not found any leaked credit card numbers or expiration dates, and it does not store customers’ bank PINs.
Sony says the affected servers have been shut down and the unauthorized connections blocked, while internet services continue to operate.
Abdulkadir | Cybersecurity retweeted
This is the methodology he used. Killa is something else.
The Bitcoin got stolen!!!!!!!
Someone finally did it.
Twenty hours of silence. Counter ticking. Nobody touching it.
Then someone actually figured out the exploit chain on a live server.
With real Bitcoin sitting there.
And took it.
The exploit works. Not in theory. Not in a lab. On a real vulnerable PHP server running in production.
Every security researcher who said "these are the worst vulnerabilities in decades" just got vindicated.
The government who told people to unplug their servers just got vindicated.
The NSA who published emergency mitigation guidance just got vindicated.
But mostly the attacker just got Bitcoin.
The counter on stealmybitcoin.com stopped ticking.
The challenge is over.
PHP 8.2 and 8.3 with patches. Still secure. Untouched.
PHP 8.1 and older. No patches available. Ever.
One just got exploited on a live server.
Now we know for certain. The hype is real.
The vulnerabilities work. The exploit chains chain.
And someone out there knows how to do it.
Which means everyone will know how to do it within a week.
Then every vulnerable PHP server gets compromised.
Then the attacks scale.
Then the infrastructure starts going dark again.
The developer created the perfect incentive structure.
Real money. Real vulnerability. Real challenge.
Someone won.
Everyone else just realized the danger was never academic.
Abdulkadir | Cybersecurity retweeted
Garrett Langley is the CEO of Flock.
Sold 80,000 surveillance cameras to police.
Then got caught in leaked audio at a police chiefs conference.
Told them the backlash wasn't real.
It's bots. Russian bots.
His wife said never apologize. So he's not going to.
He'd prefer to never do media again.
The backlash dropped 95 percent since July.
Then 50 percent overnight.
Why.
Ukraine bombed a Russian data center.
Which proved it was Russian bots all along.
Not journalists. Not researchers. Not people who watched cops use Flock to stalk women.
Not students asking why their university tracks them.
Not the entire internet saying surveillance bad.
Just bots. Russians. Paid actors saying privacy matters.
Langley's evidence is audio from a private conference.
Leaked to 404 Media.
Which proves how good his security is.
His wife told him never apologize.
His legal team told him stop doing interviews.
So he did the opposite.
Went to a police conference.
Told police chiefs the backlash isn't real.
Then someone recorded it.
Then the recording leaked.
Now his address is on the internet.
Which happened because the backlash that isn't real.
Got more real.
His wife said never apologize.
He's not apologizing.
Just blaming bots.
Ukrainian drone strikes on Russian data centers.
And the fact that people keep noticing his company lets police stalk whoever they want.
That's not real either.
That's just misinformation.
Ngl those tough English and networking concepts becomes super easy the moment you just start practicing.
Once you’ve studied enough. Find real devices and start practicing on and if that’s outside your reach. Packet tracer exists.
Goodluck.
Network engineering feels so difficult to learn because people spend too much time reading about it and not enough time actually doing it.
Most concepts I read about seem foreign to me until I configure them on a physical switch and see how they work in real time.
I'm not saying networking isn't hard, but the more I practice, the more things click, and the more I enjoy it.
If you don't have physical equipment, please download Cisco Packet Tracer and start building networks. Configure VLANs, practice routing, assign IP addresses, break things and troubleshoot them. Don't just read about networking when you can experiment with it yourself.
You can build entire network topologies and practice a huge range of concepts without spending money on hardware. Physical equipment will still teach you things Packet Tracer can't, but it's a great place to start.
I'm nowhere close to being a professional network engineer, and I still have a lot to learn. I'm just glad I got to work with physical equipment early instead of spending all my time reading PDFs about how networking works.
