Hey everyone,

I’m currently a beginner in cybersecurity and bug bounty, and I’m seriously interested in pursuing this field professionally. I’d really appreciate some advice from people who have been working in cybersecurity, penetration testing, AppSec or bug bounty hunting for a while.

I’m particularly interested in web application security, penetration testing and bug bounty hunting, and I’m trying to figure out the best way to build a strong foundation and progress from there.

I’m considering reading the following books:

1. Real World Bug Hunting: A Field Guide to Web Hacking by Peter Yaworski
2. Linux Basics for Hackers, 2nd Edition by OccupyTheWeb
3. Penetration Testing: A Hands On Introduction to Hacking by Georgia Weidman
4. Black Hat Python, 2nd Edition by Justin Seitz and Tim Arnold
5. Web Hacking 101: How to Make Money Hacking Ethically by Peter Yaworski
6. Hacking: The Art of Exploitation, 2nd Edition by Jon Erickson
7. The Web Application Hacker’s Handbook, 2nd Edition by Dafydd Stuttard and Marcus Pinto
8. The Basics of Hacking and Penetration Testing, 2nd Edition by Patrick Engebretson
9. The Hacker Playbook 3: Practical Guide to Penetration Testing by Peter Kim
10. OWASP Testing Guide 4.0 by the OWASP project
11. The Hacker Playbook 2: Practical Guide to Penetration Testing by Peter Kim
12. Hacking: Practical Guide for Beginners by Jeff Simon

My main question is: Are these books still relevant in 2026, and will the knowledge in them remain useful over the next few years?

I understand that some of these books are quite old, especially The Web Application Hacker’s Handbook, Hacking: The Art of Exploitation and the older Hacker Playbook editions. I’m not expecting books to teach me the latest tools or every modern vulnerability, but I’m wondering whether the underlying concepts are still worth learning.

If some of these are outdated or redundant, which ones would you recommend skipping? And are there newer books or resources that would be better choices?

A little about my background

I’m a Civil Engineering graduate, so I don’t come from a traditional CS background. However, computers, programming and technology have always been a huge interest of mine.

I’ve also worked as a freelancer for around 2 years, mainly in backend development and data science.

I already have some technical foundation:

• I can code in Python and JavaScript

• I have a basic understanding of networking

• I have some Linux knowledge

• I can read and understand code in languages such as C and C++, although I’m not equally proficient in all of them

Interestingly, around 4 years ago I actually found a bug in Udemy and reported it. Unfortunately, it was marked as a duplicate 😅. But that experience really got me interested in vulnerability research.

I’ve tried learning cybersecurity through Udemy courses and YouTube, but I’ve found that many courses spend a lot of time teaching extremely basic concepts and don’t go deep enough into practical understanding. I’m looking for something more hands on and structured.

I don’t want to simply memorize tools, follow tutorials or run automated scanners without understanding what’s actually happening underneath. I want to understand how systems work, why vulnerabilities exist, how to identify them manually and eventually develop the ability to find vulnerabilities myself.

So, if you were starting from my position, what would you learn and in what order?

For example:

1. What fundamentals should I learn before seriously getting into penetration testing and bug bounty?
2. Which areas of networking, Linux, programming, web technologies, databases, authentication, HTTP, etc. should I be comfortable with?
3. Which of the books above are still worth reading in 2026?
4. Which ones are outdated, redundant or not worth my time?
5. Are there any newer books, labs, platforms or other resources you would recommend?
6. At what point should I start doing CTFs, labs and actual bug bounty programs?
7. What would a realistic learning roadmap look like for someone with my existing background?

I’m willing to put in the time. I’m not looking for shortcuts or a quick “become a hacker in 30 days” type of roadmap. I want to build solid fundamentals and genuine practical skills.

I’d really appreciate advice from people who have actually been through this journey. Especially interested in hearing from experienced pentesters, bug bounty hunters and security researchers about what they would learn differently if they were starting today.

Thanks in advance to anyone willing to share their experience or point me in the right direction!

I was arguing with someone in social media, i had my name and last name on it. And then when i changed tabs and went to my twitter, my name and username were changed on insults, i was shocked couldn’t believe how it happened because I didn’t open any link or make any call or anything like that.
Then i refreshed the page and it went to how it was before.
Should i be concerned or is there a trick someone can use in page source from chrome to someone’s twitter?

Do HR folks value the Google cert, and how does it compare with other certs?

Does anyone know what is causing this? I'm not able to figure out which program or add-on keeps causing this.

Bitdefender message below:

Phishing attempt detected

one minute ago

Feature:

Online Threat Prevention

We blocked this phishing page for your protection: http://188.126.89.75:8888/ping.txt Phishing pages attempt to obtain sensitive information such as login credentials or credit card details by disguising as trustworthy entities. The stolen data can be then used for financial gain.

Add to exceptions

I got an email from an address I don't recognize with a PDF attached, which the sender is claiming is related to a project I'm working on. I did open the email in an Outlook web browser but didn't click on the attachment. However my initial (probably stupid) instinct was to forward the email to my supervisor and ask if it was legit. I clicked "forward" and when I saw the pdf attached to my draft email (duh) I got worried that maybe that somehow exposed me to some risk. Again, I didn't preview or download the pdf at all, just clicked forward. I deleted the draft with the forwarded email and just wrote to my supervisor separately, but should I be worried?