u/omers

Props for seeing something that needed fixing and doing it. I used to maintain the PowerShell/EditorSyntax repo but walked away for reasons we won't get into. It's unfortunate that it hasn't been shown any love in many years it seems.

Hiya, fresh day, better mood, and I've had some time to think. First, I'm sorry for how I approached this yesterday.

I think the issue is translation honestly. To a native English speaker, the original post is very clear. There's no ambiguity or assumptions needed. It's using an English language norm that may not translate well to Japanese.

Your bio says you're a developer, so let's use that: If your manager asked "What's the status of the patch?" you'd know they meant either the patch you're currently working on or the one you just released. Nobody would ask "which patch?" because the context already makes it obvious.

When the OP said "the PHP vulnerability," it was equally obvious to native English speakers they meant Php2Shell.

You're arguing for clarity, which is normally a good thing, but you're asking for clarification where it isn't needed. The OP's post is clear enough in English as it is. I think that clarity is being lost when translated to Japanese. That's why we're not seeing eye to eye.

If an executive emailed their security team asking for "a quick summary of the PHP vulnerability," that would be a perfectly normal request... executives don't throw around CVEs. The team would be expected to understand what they meant and respond accordingly, not ask them to clarify something that's already clear from context.

TL:DR; Reddit being mostly English speakers is why I am being upvoted and you're being downvoted. You're right that clarity is important in security but this post is already clear in English and worded exactly how senior management would word it at work where it would be bad to demand more clarity from the manager.

The only reason I said "maybe cybersecurity isn't the right field for you?" is because you said this to OP first:

If you can't even identify which vulnerability you're asking about or provide a link to the news article, cybersecurity might not be the right field for you yet.

Notice how it's basically the exact wording you used, it's called mirroring (or being facetious if that translates to Japanese.) Maybe you didn't mean to say that to OP and it was a translation error, but you did and I was just throwing your own wording back on you. I'm an asshole like that.

As you said in another comment. This isn't worth arguing over anymore. We're not going to see eye to eye. Let's chalk it up to being lost in translation.

I will apologize and say that I have some pent up frustration for other reasons entirely right now and did let some of it out on you.

Dude. They literally said "I have recently hearing about it many times a day" and followed up with "The recent news one". This is /r/cybersecurity101 not /r/cybersecurity or /r/netsec.

You're on a newbie board, on a post by an obvious newbie, and one who is using grammar indicative of English as a second language. Pressing them to name CVE's and be specific when they're asking about "THE RECENT NEWS ONE" while PHP2Shell is absolutely dominating the news both technical and not.

You have to be trolling

By your own logic, the appropriate response would have been "Are you asking about Php2Shell (CVE-2026-109618 & CVE-2026-109619) disclosed earlier this week?"

Instead you made your own assumptions and presented a useless answer.

You're confusing making an educated guess with verifying a technical claim.

OP: "explain me >>>the<<< php security vulnerability"

Followed by

OP: "The recent news one"

From context it's obvious and you're either being obtuse on purpose or you missed it.

Major PHP vuln in the news -> people without knowlege seek it from places like this -> to them it is "THE" vuln

Ignore them. It's obvious you were asking about Php2Shell. Either they are trolling, being an asshole on purpose, or they haven't heard about it in which case they wouldn't have useful answers for you anyway.

If you can't even identify which vulnerability you're asking about or provide a link to the news article, cybersecurity might not be the right field for you yet.

There are two types of people in the world:

1. Those who are able to extrapolate from incomplete data

... There has been a major pair of PHP vulnerabilities with 9.2 CVSS scores grouped together as "Php2Shell" in just the past 2 days. Multiple major websites, government websites, and more were taken offline waiting for patches when it first dropped. It has also been all over the news and social media. Security and IT teams have been scrambling to patch and remediate...

If you couldn't figure out that's what OP was asking about, or you hadn't heard about it, maybe cybersecurity isn't the right field for you?

If someone had asked about "the log4j" vulnerability 2 days after log4shell dropped would you have given a generic list of possible log4j vulns?

Screen blinks occasionally when using Chrome browser. Maybe once per minute on average. Especially when there is video on the website.

This problem existed in a string of driver versions ~2 years ago. Nice to see them bringing back their classic hits /s

Good luck!

goes too much into details/specifics instead of going higher level general responsibilities and tasks

Their resume could be edited down a bit as some things are redundant and do include details that are not important; However, responsibilities and tasks are not what you want on a resume. You want accomplishments. Their resume leans that way already which is actually a good thing.

Your resume should not read like a responsibility matrix or job description. If you were a "Sr. M365/Exchange Administrator" I can already make a bunch of assumptions about your responsibilities and tasks. What I need to know from your resume is why you're better than every other M365/Exchange Administrator.

I just picked a random resume from /r/ITCareerQuestions and it has a bullet that's essentially:

Used ServiceNow to discover IT Assets (certificates, printers, endpoints, etc)

It should really be something like:

Used ServiceNow to identify and document IT assets. This improved inventory accuracy, allowed equipment reassignment over replacement, and eliminated helpdesk time spent locating assets.

You might think the person reviewing your resume can figure that out themselves but they may not be able to if they're an early screener. It also shows you understand why you did things, the impact of your work, and that you were not just occupying a chair.

Edit: spelling

Your resume shows a lot of potential so I felt motivated to actually do a proper review. I will mention that I am not an initial resume screener (HR/recruiters do that) but I have done the 2nd phase technical/requirements screening on hundreds if not thousands of resumes over my career.

Quick impressions/notes

• Good on you for listing actual lab experience and just not "TryHackMe" as a bullet or whatever
• Professional Experience above Projects. On-the job experience is more valuable
• Turn off auto-hyphenation wordbreaks in your doc editor ("en-vironments", "ex-posed, etc)
• Left aligned text is fine for a resume. Fully justified actually makes it harder to scan quickly
• When you're done, get AI to help tighten up your wording and language. I am not going to focus too much on awkward wording except where it really stands out but there's quite a bit of it
  • AI is going to be used to screen your resume, might as well use it to tighten it up
  • Tell the AI to avoid things like emdashes and to maintain your "voice"

Professional Summary

Your first paragraph is weirdly worded. "Builds detection lab...", "Prepares investigation notes..." sounds like describing an app or robot not a person. Go for something more like:

Cybersecurity graduate with internship experience in vulnerability assessment and hands-on lab experience using Wazuh, Suricata, Sysmon, and Windows Event Logs. Built custom detection rules and investigated authentication, process-creation, and network-scanning activity mapped to MITRE ATT&CK. Seeking an entry-level SOC analyst or security operations role.

Also helps separate your actual experience from you lab experience without underselling either.

Technical Skills

I hate these sections and always roll my eyes while reading them but I get their purpose.

• Careful here that you only list things you're actually comfortable discussing in a technical interview. For example, you do not mention Splunk anywhere else, if quizzed about it in an interview, how would you do?
• Get rid of specific event log IDs. No one screening your resume knows/cares what those are. Anyone who does will expect you to know how to figure out any event, not specific ones
  • If you did something interesting with reviewing authentication events, put that in projects or experience
• Get rid of "2022" on Windows Server. It's all the same at the end of the day
  • Again, if you did something interesting specific to 2022, put it somewhere else

Professional Experience

As I said above, move this before the projects.

An experience section should also highlight accomplishments over duties. A duty is what you were responsible for doing while an accomplishment is how your work benefitted the company. Your bullets are better than most resumes I have seen but if you have any stats or tangible things you can list, add them.

Things to focus on: what did you find in your investigations, how did finding those things benefit the company, what did you create, how did your work support others, etc. You should still keep the lines brief and you can still stuff keywords into them but this is the place you should really be puffing yourself up.

I didn't just "clean up email security rules and lists," I "Audited and streamlined email security rules and safe/blocklists removing redundancy, improving detection, simplifying future management, and reducing safelisted traffic without increasing false positives."

Projects

• Put the technology stack on it's own line with a "Tools:" label
• You mention Github experience so if any of this stuff is in Github, include links
  • If not in Github, get stuff there. Include a short README, network diagram, sample rules, screenshots of dashboards, a learning checklist, etc
• First bullet should highlight purpose not setup
• Drop these to 4 bullets each

Example:

Multi-Node SOC Lab with Custom Wazuh XDR/SIEM Detections
Tools: Wazuh XDR/SIEM, Sysmon, Active Directory, Windows, Ubuntu, Kali Linux
Github: <link>

• Built a four-node SOC lab to simulate attacks, centralize endpoint logs, and validate detection rules
• Forwarded Windows Security and Sysmon events into Wazuh to monitor authentication and process-creation activity
• Created and tested Wazuh correlation rules for rapid logon failures and suspicious command-line parameters
• Mapped generated alerts to MITRE ATT&CK techniques and built timelines showing attack activity across endpoints

Education

Even though you blanked it out, it looks like Security+ has a "Targeted" date. Don't do that unless the exam is actually scheduled "Exam Scheduled, Sept 2026" otherwise leave it off entirely. I don't care that you plan to finish a cert, especially a basic one like Security+.

If you want, you can DM me the headers and I can see if I can shed some light on it. You can redact your email address. No pressure though, just an offer.

Are you sure the domain doesn't have an SPF record? Are you looking up the SPF record for the domain of the address in the Return-Path/what's redacted in your Received-SPF header or the From address? SPF is checked on the Return-Path only and the redacted_for_reddit in your post should tell you what that domain was.

If the Return-Path is null (<>) SPF will be checked on the HELO/EHLO hostname instead which will be in one of the Received headers. Though, again, it's whatever the reacted_for_reddit value is.

Few things:

1. Make sure you're definitely looking up TXT records and not SPF records which were proposed as a record type but not used. Some DNS lookup tools still have SPF in the dropdown/tab-complete for some reason
   • Resolve-DNSName domain TXT in PowerShell
   • dig domain txt in bash/zsh
2. It could be a local DNS issue. Try -Server 8.8.8.8 in PowerShell or @8.8.8.8 with dig
3. If the domain is malicious, your network firewall/security may be sinkholing your DNS query. Try doing the lookup using https://dnschecker.org or something similar with TXT selected in the type dropdown

Good chance it's #3 based on the 0.0.0.0

Intuitively that sounds true to me. I am not sure how much I trust any specific statistic though.

Security incidents follow the same "Swiss Cheese" model that is often used to describe things like airplane crashes. I.e., each layer of security is like a piece of Swiss Cheese with holes in it and an incident is when the holes in every layer line up.

With an email threat, the email filter is one layer (or multiple layers depending on how you break down the components of an email filter,) the user and their ability to catch threats is a layer, your firewall/network security appliances are layers if they click a link, your EDR is a layer, etc etc etc. Of course there are more layers than that usually and it's more complex than that but I think we have the jist...

• A misconfiguration in the filter lets a spoofed phishing email through
• The user doesn't recognize the threat and clicks a link
• Link rewriting, MS safelinks, or whatever equivalent doesn't block the click
• The network security appliance doesn't block the click
• The user still isn't recognizing the threat
• A misconfiguration in M365 lets the user go through a malicious device code authentication flow
• Lack of monitoring for device code auth or sending alerts to the wrong team lets it go unnoticed for too long
• Etc

Fix any one of those things and ultimately the threat fails or is caught fast enough to not lead to fall out. It's easy to blame the first piece of cheese but we really can't expect every layer to be 100% perfect. Each one needs to compensate for the weaknesses of the others. I.e., the holes will exist, but hopefully very few of them line up. Even if the filter was configured correctly, maybe it would have missed the email anyway.

You've got a couple things backwards:

1. The Header From is the one that people do see in their email clients and webmail. The Envelope From is the one that you need to look at the headers for (the "Return-Path.")

2. It's SPF that has the limitation of only protecting the Envelope From address and thus the address that most people never see. DAMRC as correctly said "aligns the header From" but that actually means it adds protection to the address that people do see.

DMARC fixes the biggest issues for the most part; However, it's not as widely adopted as SPF, it's often implemented with unenforced p=none policy values for way too long, and plenty of recipient filters don't fully honor the policies anyway opting to quarantine even when a fail says to reject for example.

You're correct about display name spoofing, homonym and other lookalike domain attacks, and such though. That wasn't in scope of OP's question though. There are solutions for those as well but it requires advanced filtering that lots of companies and most everage webmail providers don't have.

For what it's worth, email security is my whole job. I can't cover every edge case, exception, and bit of nuance in a reddit comment though. Answering in broad strokes is necessary to avoid writing a novel. I did write this novel several years ago though on SPF/DKIM/DMARC: https://www.reddit.com/r/sysadmin/comments/aph6ee/lets_talk_about_email_spoofing_and_prevention_alt/. Coupled with all of the comments I answered it covers a lot of what DNS auth records can and can't do.

Sorry, commented and went to bed and didn't see this reply until now :)

The efficacy depends on adoption both on the sender and recipient side for sure. The major email providers like Gmail require it for bulk senders so it at least protects domains people see every day like amazon.com, microsoft.com, apple.com, or whatever. Most enterprise email filtering enforces DMARC out of the box so one would hope most big company recipients are protected as well.

You're right though that it's not perfect and there are plenty of gaps. Unfortunately the ability to "arbitrarily" define the envelope and header from addresses is pretty fundamental to how email works. Our only options are bolt-ons like authentication DNS records. That's why Goolge & Yahoo especially are pushing steadily on senders to implement DMARC properly. (Ignoring Google's ironically sort of half-assed implementation)

We've also got things like BIMI in the pipeline and DKIM2. Which should help but will also boil down to adoption.

Things are still not perfect but they're much better than they were 20+ years ago when you could email just about anyone from any spoofed address. Now at least with the mail providers the majority of people use, most spoofed mail goes to Junk at least

I have email accounts with a bunch of providers and not a single one would put a spoofed email from microsoft.com in my inbox. A couple of them would also catch and block stuff like mcrosoft.com or whatever. We've come a long way but for sure have a long way yet to go.

It's a fundamental part of how email works so it's technically possible. However, Sender Policy Framework (SPF,) DKIM, and DMARC make it unlikely the spoofed message will be delivered. Still possible but more difficult than it used to be. Either requires a badly configured recipient filter, badly configured sender domain authentication, or both.

That said, some providers like Gmail will deliver the spoofed messages to Junk in most cases rather than blocking them which I guess is a partial success. If the recipient checks their junk, falls for the lure, releases it, etc. They would need to also ignore the red warning banner Google puts on it though

Blades are an actual distinct type of server. They're server units but slotted into a shared chassis/enclosure. It lets them share things like power and cooling. I.e., the chassis gets racked with power and all the shared non-compute stuff, and then blades get slotted into the chassis.

A lot of blades look like a pretty typical 1-2U server on their faces. If the guy came from a blade dominated environment they would have slotted blades instead of racked servers and they're likely just reusing that vocab even though it's not accurate to normal servers.

There is (or was) also networking gear that followed a similar design like BlackDiamond from Extreme Networks. One place I worked early in my career used Extreme Networks and the chassis was like half a rack tall and the switches and stuff slotted into it vertically.

Can I ask why you don't want an in-line/gateway solution?

But wouldn't you have been surpassed by your juniors once they get promoted as manager

I guess it depends what you mean by "surpassed"?

They could absolutely end up above me on an org chart if they move into management, but I wouldn't really see that as them surpassing me. We'd be on different career paths and I'm a hell of a lot further down mine.

A manager has authority over people and responsibility for them. My progression as a senior IC is more about having authority and responsibility for my area of focus. Plus autonomy, being seen as a principal expert, and having influence over decisions.

At the company I work for, and many tech firms, authority/responsibility/ownership isn't tied to management titles. As an example: Our CEO recently raised some concerns about a security product and policy that ultimately I am responsible for to our CTO. The CTO could have gone to my Director who could have gone to my Manager, but why? The person with the answers, the person who will provide options, the person who will oversee executing those options, is me. So the CTO phoned... me.

Side note as I'm sure some will be thinking about it... Compensation: It's not uncommon for high level ICs to out earn managers (ignoring executives,) especially in tech/engineering/etc.

I would also add that I'm not entirely opposed to management. Like I could see myself as a director or something late-career. I just have no interest in coaching people because they're constantly late, mediating interpersonal conflicts between employees, writing PIPs, spending half or more of my time on personnel matters, etc.

I'm better suited to manage strategy and projects than people specifically, though I could manage people's contributions to those projects or manage managers and be fine xD

Are you aware of the WordPress Hardening Guide? https://developer.wordpress.org/advanced-administration/security/hardening/

It's not completely self-contained but it covers all of the major themes and gives starting points for Googling.

Some good webserver resources:

• Apache Security Tips: https://httpd.apache.org/docs/2.4/misc/security_tips.html
• How to Harden NGINX: https://www.acunetix.com/blog/web-security-zone/hardening-nginx/

A cheap $5-10/month virtual private server from a company like Linode or DigitalOcean would be a good place to practice (both also have guides for setting up web servers which include security steps.) Or you could do it on a VM at home so it's not facing the internet if you're super new to it... /r/Homelab as a good starting place.

Cybersecurity is a huge field with dozens of different disciplines. Add to that every company being different and everyone having different goals and I'm not sure you'll get much value from answers to this.

I for example have no interest in managing people. Team Lead -> Manager -> Director -> VP or whatever is not my ambition. I am quite happy to be an individual contributor and my goals are more about greater ownership over processes/policies/products, being seen as a principal expert, training/mentoring more junior employees (without being their manager,) etc.

So, my career path and growth has been exactly that. I worked my way up from tech support -> helpdesk -> sys admin -> sys engineer -> security analyst -> security engineer. There were a few more steps than that, but that's the jist. I've been a Sr. Security Engineer for years at this point. I'm continuing to build expertise in my areas of focus, authority and ownership, and autonomy rather than striving for management.

MSPs and MSSPs are almost always the bottom of the pay scale. One of many reasons people tend to get out of them quickly. That said, they're also one of the few places that will actually hire true entry level security people.

Treat it like an extension of your education. Take the experience and look for something outside of the managed service space. The MSP time will help with the hunt.

You're somewhat underpaid for security roles but not atypically for an MSP.

But no system is scanning your comments in the background and banning you, its still user report driven. Its the tic toc generation infesting reddit and reporting everything that triggers them.

Unfortunately this is not true. This is the most recent ModNews post from the admins about their automated detection systems: https://www.reddit.com/r/modnews/comments/1up0jfx/how_reddit_is_reducing_exposure_to_harmful_or/

From their own stats:

• Blocking 23 million spam views per day before they ever reach a human user.

and

• Enforcement in Seconds: The average time between detection and enforcement on harmful content containing hate or violence is down to under five seconds.

Lots of comments from mods about how it sucks at context (flagging discussions of fictional events,) doesn't show mods what it removed, is leading to algospeak on reddit, etc.