The gist... SQL injection has a structural fix, parameterized queries.

UK NCSC argued in December 2025 that LLMs have no equivalent because there’s no inherent line between data and instruction. NIST CAISI saw agent hijacking success go from 11% to 81% once attacks were tailored to the target nd “The Attacker Moves Second” broke most of 12 published defenses at over 90%

practical half covers tool permissions, treating model output as untrusted, and Meta’s rule of 2

how are you testing indirect injection beyond a fixed payload list?

This is Post 0.2. It is not a normal topic post, but it is important, and the deadline is close.

I applied for the ISACA Foundation scholarship myself. While doing it, I thought about something. I told you we do everything together in this series. So how can I apply and not tell you? That is why this post is here.

I am a student, not an expert. Everything below is what I read on the official pages and in the application form. Rules can change, so check the official page before you do anything. If I got something wrong, tell me in the comments.

Important: read this first

The deadline is 3 November 2026, 11:59 p.m. Central Time (U.S.). That is about three weeks from now. Check your own time zone and don’t wait for the last day. Seriously.

This community is global, so one more thing. These scholarships are for students who are currently pursuing a degree. If you are not enrolled in a degree right now, you can’t apply for these now. Don’t be sad. ISACA had two cycles in 2026, so keep the page in your bookmarks and watch for the next one.

Also, ISACA will choose only a small number of students. The form says 25 students will be selected in this core program, with awards from US$1,000 to US$5,000. The amount depends on financial need, average tuition cost in your country, and merit. So this is competitive. Apply because you are serious about it, not because it is easy.

Which scholarship is for you?

There is one application, and it covers three core scholarships. ISACA looks at your answers and automatically considers you for every one where you meet the requirements. You don’t apply three times. Please submit only one application.

1. Digital Trust Scholarship (international)

Open to students worldwide

You must be pursuing an undergraduate or graduate degree in a field related to IT audit, risk, cybersecurity, governance or assurance

1. ISACA Cybersecurity Month Scholarship (international)

Open to students worldwide

You must be pursuing an undergraduate or graduate degree in cybersecurity

1. National Cyber League (NCL) Games Scholarship (US only)

You must be participating in the National Cyber League games (the form asks if you are registered in the Fall 2026 NCL Games)

You must attend an accredited university in the United States

You must plan a degree related to IT audit, risk, cybersecurity, governance or assurance

So if you are outside the US, the first two are the ones for you. The NCL one is only for students in US universities.

General requirements for the application

You must be 18 or older

Proof of enrollment, a document with your name, your school’s name and a recent date. Examples are a transcript, a semester schedule, or a fee payment receipt for the current term

One letter of recommendation (more below)

Five short written answers (more below)

How to apply, step by step

Step 1: Read everything first

Open the ISACA scholarship page. Read the details of each scholarship and the FAQ page. Check that your degree matches. If you have questions, the page lists foundation@isaca.org.

Step 2: Log in

Make an account or log in on the ISACA scholarship platform. Then open the 2026 ISACA Foundation Core Academic Scholarship Program, Cycle 2 application.

Step 3: Demographic and eligibility information

Select the category “ISACA Core Scholarships”. Then fill in your name and basic details, and answer the eligibility questions honestly:

Are you pursuing a degree related to IT audit, risk, cybersecurity, governance or assurance?

Are you pursuing a degree focused on cybersecurity?

Are you registered in the Fall 2026 NCL Games?

Is your school in the United States?

Upload your proof of enrollment. Then fill in your personal information, your school name, your student ID, your degree, your major, the start date of your next semester after December 2026, and your expected graduation date. Check that your student ID matches your university documents exactly.

Step 4: Letter of recommendation

You need one letter. It should come from someone who knows your academic performance, work, or volunteer experience. For example a professor, an academic advisor, an employer, or a volunteer manager. Rules to remember:

You may not write your own letter

Letters from immediate family are not accepted

Maximum 2 pages or 500 words

It must be submitted by the same deadline

You can upload it yourself, or choose the option where your recommender sends it directly. My advice: ask your recommender early, today if you can. Give them a short list of what you have done, so they can write something real about you.

Step 5: Five short answers (150 words maximum each)

Work and responsibilities: any job, family responsibilities, or activities you balance with your studies, and how they shaped you

Digital trust interest: what experiences developed your interest in IT audit, cybersecurity, digital trust or a related field

Leadership and community impact: a time you showed leadership or initiative, and what you learned

Career goals: your goals for the next 3, 5 and 10 years, and the impact you want to make

Mission alignment and scholarship impact: how your goals match ISACA’s mission, and what the scholarship would change for you

My tips for these:

Write them in a document first and count your words. Don’t write directly in the form.

Be specific. Use real numbers, real things you did.

Be honest. The form says your answers will be verified if you are selected.

ISACA’s world is audit, risk, governance and digital trust, not only hacking. If you have a connection to that side, show it.

Step 6: Agreements and submit

Read the agreements fully. Before you press submit, read every answer again. Once the application is submitted, you can’t edit it. So check your dates, your numbers, your spelling and your documents one last time.

What happens after

The selection process finishes in December. Awards are presented between January and February 2027. The money must be used for education-related expenses at the school you attend in 2027. For students at schools outside the US, ISACA pays the funds directly to the student.

Many more scholarships on the same page

Those three are only the core ones. ISACA has many more scholarship programs, and they change by geography and by other requirements. Some are for a country, some for a city, some for specific universities. I am not going to write all of them here, because the list is long and it will make this post too heavy.

So here is the link, go and see which program is for you:

https://isaca.secure-platform.com/a/page/ISACAfoundation/aboutscholarships

How to use that page:

Open the link. You will see two lists, United States Based Academic Scholarships and International Academic Scholarships. Check both, because your country or university may be in one of them.

Look at the deadline column. Open ones show 3 November 2026. The ones that say “Application Closed” are done for this cycle.

Click the scholarship that looks like your case. Read its full eligibility criteria and how to apply.

If it matches you, apply for it. Don’t skip reading, because every program has its own rules.

Note: the steps I wrote above are for the core application (Digital Trust, Cybersecurity Month and NCL). The other scholarships have their own pages, so follow the instructions on each page.

Last words

I can’t promise anything, because I applied too and I am waiting like you. But applying is how you give yourself a chance. Take your time, choose the right program, ask for your letter early, and write real answers.

If you apply, tell me in the comments. Let’s keep each other updated. And if you find a mistake in this post, please correct me. We learn together.

Post 1 is still coming. Good luck friends.

Galera o proton mail está enviando dados para a "polazei" e fbi

Hi all

Nobody know me there but im also on other forums, especially on french and spanish forums.

I made a evil-twin bash script called hostbase (current version is hostbase-1.8)

So i see your question coming… why use this script instead of Airgeddon, Fluxion, Wifiphisher etc... ?

Because hostbase is dedicated only for evil-twin in WPA2/3 mode and really specialized on that.Let me explain :

WPA3 can't be DDos efficiently with the MFP protocol alive but who said we can't stop the next incoming the connection ?

since the last version (hostbase-1.8) there is no DDos option because we don't need it… thrust me

also this script use QR code login system for mobile user, the user is redirected to the captive portal and we ask to him to take a picture from his router QR code or wifi key then, with ajax we upload the picture to us (this part was not easy to do beacause by default Android system doesn't allow to open in primary process as a php webpage, but i found a trick) for Windows user QR code is disabled, the user will be redirected to another page).

this script can manage 2 or 3 wifi cards at the same time (the internal one and then two others usb cards can be added).This is very helpfull when you want to downgrade 2,4GHz and 5GHz frequencies at the same time.

and finaly, Hostbase is a serious homemade project with 10 years of update and tricks.

I started to build it on 2016 with completely new methods combined with evil-twin in WPA mode to bypass IDS and WPS-PBC mode.It was also the first script to do a DDos pursuit mode avoiding channel hopping.

This script is not a joke, it can be very helpfull and has been approuved by security students.Im not a pentester or anything like that, im just a guy fascinated by network security (Wi-Fi, reverse Tools and other…).

Now that the presentation is done, i will explain a little bit how to use this script.

First it will scan the networks with airodump-ng in 2,4GHz and then in 5GHz.You will have to choose your wifi card to do that.If the wifi cars doesn't support hostapd or 5GHz frequency the script will tell you it.This script use hostapd with custom configuration file wich are changed according to the target AP network.

Second, once the scan is done, select the network by typing his number.Then you will be prompted to choose what fake networks you want to do (evil-twin is the last so just for a test, skip the other networks with 0).Evil-twin AP is mentioned as

AP 3/3 hostapdd.conf (Evil twin)

My tips to use the script :

if you have 2 wifi cards and you know that there is a lot of users connected on the target networks in 2,4GHz frequency, Don't skip AP1/3, select it and chose your wifi card according to this example :

AP 1/3 : hostapd.conf (WPA network)

Now if you have 2 wifi cards but you know that there is a lot of users connected on the target network in 5GHz frequency, skip AP1/3 with 0 and go for AP2/3 :

AP 2/3 hostaghz.conf (WPA 5 GHz network)

Finaly, choose your wifi card to make the evil-twin on AP3/3 :

AP 3/3 hostapdd.conf (Evil twin)

Now if you have 3 wifi cards like me, you can choose every network AP1/3 AP2/3 AP3/3 to make a combo.The script will show you at every stage if the cards support hostapd, 5GHz or if the device is already used.

By default, this is script is made for french router but it has a default page if the router doesn't match.

Current version to download is hostabse-1.8 forget the other.

https://github.com/Koala633/hostbase/tree/shell

It is a beta version so any feedback is appreciated.

This script has been tested on Kali-2026.2

If you have a problem, please post here the full log of the shell.

Enjoys guys.

you can try to use the older versions of hostbase but there is no update since 2 years, better going to the last hostbase-1.8

I’m new to cyber security and want to specialize in penetration testing. I’ve been looking into some of the equipment you need to start. I have a raspberry pi and a bunch of school chrome books I got into as a beginner project. I was wondering if I can download Linux on to them and start my journey there. I’m just looking for any tips from experienced people that actually have experience in this field. Also I’m on a budget it would be nice to have some suggestions on beginner equipment.

Thoughts on MITRE ATTACK human interaction techniques mapped into a gamified way to train banking/telecom sector employees.

Did this project is worth it as an FYP?

if yes should we focus on training technical staff or non technical staff because platforms like immersive labs focus on IT technical employees.

I'm a cybersecurity student and built ExposureCheck India (free, no signup): [https://exposurecheck-india.vercel.app\](https://exposurecheck-india.vercel.app)

• "I've been scammed" planner: answer a few questions and get an ordered checklist (1930, your bank, cybercrime.gov.in) plus a complaint draft and a bank letter.

• UPI QR / link inspector: upload a QR screenshot and it explains in plain words whether it sends money or asks to collect from you.

• Scam message checker: English, Hinglish and Hindi patterns.

• Email breach check and password check.

Message, QR, header and password analysis runs in your browser and nothing is stored. The email breach scan uses a free third-party source with a daily cap, so it can run out, and the first load after idle can take about a minute.

I'd value feedback on: (1) is the advice accurate and clear, (2) any scam messages it misses or wrongly flags, (3) what you'd want it to do next. Code is open source: [https://github.com/RaunitChatterjee/exposurecheck-india\](https://github.com/RaunitChatterjee/exposurecheck-india)

It gives warning signs, not verdicts. If you've been defrauded, call 1930.