Trying to start your tech journey or pivot to tech? Awesome . A few tips then. 1. Choose a niche :I can’t over emphasize on this because it might just be what determines wether you stay the course and succeed or get overwhelmed and give up.The tech space is vast.

Day 27 of our 31 days of cloud and AI security. Cybersecurity Awareness Month 2026 has been crazy, and this week PHP topped it. Two critical PHP flaws, nicknamed PHP2Shell, leaked online before the fix was ready. PHP powers a huge chunk of the web, so this was a big deal. Some government, school and hospital sites went offline as a precaution, and Amazon reported exploit attempts four days before the patch even existed. That’s October in one story: the gap between “bug is public” and “bug is exploited” is basically gone. And AI is only speeding that up. AI is making both sides better at their jobs. Defenders use it to triage alerts and find exposed systems faster. Attackers use it to scan, write exploits and run whole campaigns. Reuters reported one attacker using an open-source AI agent to break into more than 100 websites, mostly on autopilot. But right now attackers have the edge, and it’s not because their AI is smarter. It’s because they don’t need permission. Picture a race where one runner starts when the gun goes off and the other has to get a permission slip signed first. The attacker downloads a free agent and goes. The defender needs a security review of the tool, legal sign-off, a data policy, budget and a change window. Those hoops exist for good reasons. But the teams that win next year are the ones that shrink them. Is your company still filling out the permission slip? #aisecurity #php2shell #cloudsecurity

Three things from cyber sec that should worry you this week if you’re in cloud or AI security. #CloudSecurity #AISecurity #InfoSec #CyberSecurity #subtletechie

Day 26 of our 31 days of cloud and AI security. Can AI accidentally expose sensitive information? Yes, and nobody has to hack it for that to happen. Think of an AI assistant like a new intern you handed a master key on day one. Helpful, fast, and happy to open any door you ask. Including the doors you forgot they could open. That’s how most AI leaks happen. The assistant is wired into SharePoint, Jira, Slack, your CRM. Someone asks the right question, or slips instructions into a form, an email or a document, and the assistant pulls data it was technically allowed to reach and hands it over. This isn’t theory. This year researchers showed Microsoft Copilot and Salesforce Agentforce leaking customer data through text typed into public forms, and Atlassian Rovo being turned against internal data with one malicious link. All three were patched. The pattern is the lesson. The fix starts before the prompt. Tighten what the AI can reach, label your sensitive data, and log what it retrieves. If your AI can read it, assume someone can ask for it. #AISecurity #DataSecurity #PromptInjection #CybersecurityAwarenessMonth

Day 25/31 of Cloud + AI Security. What If Your AI App Is Secure but One Dependency Isn’t? You can secure your own application extremely well and still inherit risk from something you did not build. AI applications depend on models, libraries, APIs, plugins, datasets, open-source packages and third-party services. Every one of those becomes part of your trust chain. Where did the model come from? Who maintains the package? Are dependencies being scanned? Are versions controlled? What data is going to third-party APIs? Would you know if one of those components changed or was compromised? Securing your own code is only part of the job. You also need to understand everything your AI application depends on. #aisupplychain #aisecurity #supplychainsecurity #cybersecurityawarenessmonth

This is so apt ..

Day 24/31 of Cloud + AI Security. Sometimes you do not need to attack the AI directly. You attack the information it trusts. If an attacker can manipulate training data, a RAG knowledge base, documents or another trusted data source, they may be able to influence what the AI produces. That is why data integrity matters so much in AI Security. Who can modify the data? Where did it come from? Can we detect changes? Are trusted and untrusted sources separated? Can high-impact outputs be validated? If you can corrupt what the AI trusts, you can influence what the AI produces. #datapoisoning #aisecurity #cybersecurityawarenessmonth

PHP runs close to 70% of the websites on the internet. And this week, we found out there were two critical holes in PHP itself that could potentially let an attacker get into the server without a login or password. Just the right request. That’s PHP2Shell CVE-2026-109618 and CVE-2026-109619 both rated 9.2 critical. These bugs were originally discovered back in August with the help of AI models and were being kept under coordinated disclosure while a fix was being prepared. But Amazon says it saw an exploitation attempt on October 17. That’s FOUR DAYS before the vulnerabilities were publicly disclosed. And once the details became public, exploitation attempts started showing up very quickly. That’s why the message from defenders right now is simple: PATCH. If you’re running PHP, update to: 8.5.12 8.4.27 8.3.36 8.2.35 And if you’re on PHP 8.1 or older, the PHP project is no longer releasing official updates for those branches. Some vendors may backport fixes, but honestly, that should also be your sign that it’s time to move to a supported version. If you or your organization haven’t taken care of this PHP vulnerability yet… you need to PATCH UP. #Cybersecurity #PHP #InfoSec #Vulnerability #PHP2Shell #CloudSecurity #WebSecurity #AI #TechTok #Subtletechie

🤣🤣🤣🤣 i can’t help but agree with this .

With the events of the last couple weeks in Cybersec, I hope it’s getting clearer that AI isn’t coming for ALL your jobs. If anything, AI is creating more RISKS. And more risks means we need more hands on deck to fight the bad guys. #CybersecurityAwarenessMonth

Day 23/31 of Cloud + AI Security. A company can think it knows where AI is being used while employees are quietly using tools nobody approved. That is Shadow AI. Maybe someone is using a free AI assistant to summarize internal documents. Someone else is using an AI coding tool. Another person connects an AI service to company files. Now security has less visibility, company data may be moving into unknown systems, third-party integrations are increasing, and nobody may know what those tools can access or retain. The answer is not simply “ban AI.” The better approach is approved tools, clear policies, visibility, data controls and education. You cannot secure AI usage you do not even know exists. #ShadowAI #AISecurity #DataSecurity #CybersecurityAwarenessMonth

What an interesting couple of days it has between in cyber sec ,😤😤😤 and to think it’s CYBERSECURITY AWARENESS month .😩😩😩 #CyberSecurity #PHP2Shell #cybersecurityawareness

NIST. ISO. OWASP. MITRE. If you are getting into AI Security, it can feel like you are supposed to learn all of them at once. You are not. The easier way is to understand what each one helps you do. NIST AI RMF helps structure AI risk management. ISO/IEC 42001 helps organizations build and manage an AI management system. OWASP GenAI Security gets much closer to the technical risks practitioners need to understand. Do not ask which one is “best.” Ask what problem you are trying to solve. Frameworks become useful when you know where they fit. Day 22/31 of Cloud + AI Security. #AISecurity #iso42001 #owasp #cybersecurityawarenessmonth

AI Security can get overwhelming very quickly if you start by trying to memorize every risk list you see. I would start with the patterns instead. Manipulation. Can someone influence how the AI behaves? Data. Can the system expose information it should not? Access. What can the AI actually reach or do? Trust. Can someone manipulate the information the AI relies on? Dependencies. What models, APIs, libraries or services are you trusting? Once you understand those five patterns, frameworks like OWASP start making a lot more sense. Understand the security problem first. Learn the terminology later . Day 21/31 of Cloud + AI Security. #AISecurity #OWASP #GenAI #CybersecurityAwarenessMonth

All gems on this one. Point number one is something I preach to my mentees a lot. Stay a beginner for as long as you can. There is no rush wanting to sell yourself as an expert and all.. Focus on becoming so good and knowledgeable that folks point to you as the go to person even when you are not there .

Every company is racing to ship AI right now: chatbots, agents, copilots wired into internal data. Somebody has to make sure that thing can’t be tricked into leaking customer records or handing over the keys. That’s the AI Security Engineer. You’re securing the models, the data they learn from, and the pipelines that push them into production. Prompt injection, data leaks, model theft. You try to break it before someone else does. Pay sits around $153K on average in the US, with the top end past $200K. Getting in isn’t easy. Most people come from security or cloud first and pick up the ML side after. But the demand is real: cyber job ads asking for AI skills doubled in a year. Do you see yourself in this role someday? Tell me below. Day 21 drops tomorrow. #AISecurity #CloudSecurity #CyberSecurityCareers #TechCareers #LLMSecurity #SubtleTechie

Connecting AI to private company data can make it far more useful - but it also gives us more to secure. With RAG, the AI can retrieve information from internal documents, policies, customer data or knowledge bases and use that information to answer questions. Now the security questions start immediately. Can one user retrieve another user’s information? Who decides what the AI can access? Could sensitive data leak through the response? Can malicious instructions be hidden inside retrieved content? What happens if the knowledge base is poisoned? And are we logging what the system actually retrieves? Every new source of information you connect to AI increases its usefulness - and increases the importance of access control, data protection and monitoring. Day 19/31 of Cloud + AI Security. #aisecurity #datasecurity #cybersecurityawarenessmonth

Yes - and that is what makes prompt injection such an interesting security problem. Direct prompt injection is when somebody gives the AI malicious instructions directly. Indirect prompt injection is when those instructions are hidden inside content the AI later reads - a webpage, email, document or file. And the risk gets much bigger when the AI can access private data or use tools that let it take actions. There is no single magic prompt that solves this. Limit permissions. Restrict tool access. Validate inputs and outputs. Use human approval for sensitive actions. Design around the possibility that malicious instructions will eventually reach the model. The real question is not only "Can the AI be manipulated?" It is "What can it do if it is?" Day 18/31 of Cloud + AI Security. #PromptInjection #AISecurity #GenAI #CybersecurityAwarenessMonth