TryHackMe

An online platform that makes it easy to break into and upskill in cyber security, all through your browser.

[TryHackMe @tryhackme]

🚨 Attackers break out in just 29 minutes. Can your team keep up? Join our FREE Live Breach webinar to explore incident response, common mistakes, and realistic simulations.

📅 Tuesday, 10 Nov | 3 PM GMT
🔗 Save your seat: https://t.co/SGe02BxC4h

[TryHackMe @tryhackme]

🚨 New threat just dropped! Drupal Commerce CVE-2026-118539 is yours to exploit. 🔓
Break in, trace the attack, and verify the fix.

💜 Now live on TryHackMe MAX: https://t.co/Jj2zCRGZQb

[TryHackMe @tryhackme]

Pentesting vs Red Teaming. ⚔️ Same target, different missions.But what’s the actual difference? 👀
We've broken it down for you. 👇 🔥 Time to put your offensive skills to the test. Start hacking: https://t.co/Fw89JP0uiH

[TryHackMe @tryhackme]

@maj_tremor 🔥🧱

[TryHackMe @tryhackme]

been waiting his whole life for this question.

[TryHackMe @tryhackme]

🧵 Here’s what you’ll practise in Detecting Persistent Account Manipulation:

🔎 Detect account manipulation used for persistence
👤 Identify suspicious local and domain account changes
📋 Use Windows Event Logs and DFIR artefacts to investigate account-based persistence

[TryHackMe @tryhackme]

🔑 The quietest persistence isn’t malware. It’s a new account, a reset password, or one extra group membership. Learn to spot account manipulation before the attacker comes back 👉

[TryHackMe @tryhackme]

🧵 The hardest persistence to catch doesn’t look like an attack. It looks like IT. A new user. A re-enabled account. One extra group membership. No malware to flag, just a legitimate mechanism used by someone who shouldn’t have it.

Check who has access, not just what is running. 🔑

[TryHackMe @tryhackme]

protecting your streak is technically incident response 😉

[TryHackMe @tryhackme]

@0xEnigmma Then come back to it in a years time and you will see how far you have come 💚

[TryHackMe @tryhackme]

imagine how good you’ll be a year from now

[TryHackMe @tryhackme]

@Great_guyfr For sure, we back you 🔥

[TryHackMe @tryhackme]

@NathanOyewole Yes you do!!

[TryHackMe @tryhackme]

@springjben RIP all vibe coded apps 💀

[Ben Spring @springjben]

Almost 50% of AI-generated code is vulnerable... yup you read that right...

It means most companies are introducing MORE vulnerabilities than EVER, at a time when it’s never been easier for threat actors to pentest at scale. Especially scary given they’re shipping more than ever, and few actually read what AI is generating.

To explain the attached image: the line graph on the right shows that from 2023 to 2026, syntax errors (grey line) improved a lot, while secure code generation only marginally improved (red line). The table on the left shows the security pass rate (higher is better). Veracode, who put the report together, tested code snippets generated by different models to see how much of it was vulnerable.

Some vulnerability categories are far more common than others. e.g. SQLi had a high security pass rate at 83% (bc its easier to identify just by code), but XSS' pass rate was 15%. It means we'll see more of one vulnerability category over time.

In fact, even prompting "make this more secure" or "fix X vulnerability" in many cases found that it made the app less secure.

This means that:
1️⃣ More vulns are being shipped than ever
2️⃣ AI can’t reliably fix its own security flaws
3️⃣ You need to test at both the code and app level
4️⃣ And test regularly, triggered by critical actions like deploys.
NoScope does exactly this.

I'll link the research in the comments - including a presentation that goes over this in more depth we gave a few weeks ago.

When I heard almost 50% of AI-generated code was vulnerable, I didn’t believe it. So I read the research and tested it myself..

@tryhackme

[TryHackMe @tryhackme]

@XhadB you mean king of the hill 😉

[TryHackMe @tryhackme]

@s_hdigsg111 You should 👏

[TryHackMe @tryhackme]

@SarkyUsman You can, and it will be amazing!

[TryHackMe @tryhackme]

@curious_ether See! Keep pushing 🚀

[TryHackMe @tryhackme]

🕵️ Every attacker leaves footprints. Can YOU find them? 👣 We've rounded up 5 beginner-friendly Digital Forensics & Incident Response (DFIR) projects to help you think like an investigator and sharpen your hands-on cyber skills. 💻

👉 Save this for your next lab session and go get hacking: https://t.co/A0cJsIw5Y1