Cyber Security News engagement report
@The_Cyber_News - 84K followers on X
Measured over 38 original posts from a 30-day window, last computed on October 28, 2026.
Engagement
A typical post picks up 234 interactions against 84K followers, an engagement rate of 0.278%. Measured over 38 original posts, its engagement rate beats 69% of 21,185 tracked accounts of a similar size, which puts it in the middle of its size range rather than at either end. Posts are seen about 14K times each, and 1.72% of those impressions turn into an interaction. That is about 16.2% of the follower count, which is the gap between an audience on paper and an audience in a timeline. Posting runs at about 1.3 post a day over the last 30 days, though only 27% of days saw any activity at all. Most posts go out around 12:00 UTC, and Wednesday is the busiest day of the week. Of the 38 posts sampled, 97% carry an image or video and 100% link out. The account's strongest tracked post pulled 4.9K interactions, about 21x its own typical post.
Measured over 38 original posts from a 30-day window, last computed on October 28, 2026.
Compared with accounts its own size
Cyber Security News's engagement rate beats 69% of the tracked X accounts closest to it in follower count (21,185 accounts, accounts of similar size (decile 7 of 10)). A percentile is spread evenly by construction, so 50 really is the middle of that group and 90 really is its top tenth.
On engagement per impression rather than per follower it beats 56% of the same group. When those two numbers disagree, the gap is about how far its posts travel rather than how people react to them.
Where this sits in the catalog
At 0.278%, Cyber Security News sits above the 50th percentile of the 213,570 accounts in this comparison. That places it in the above the median band, which runs 0.147% to 0.699%.
Show the percentile table
| Percentile | Engagement rate |
|---|---|
| 10th percentile | 0.004% |
| 25th percentile | 0.025% |
| 50th percentile | 0.147% |
| 75th percentile | 0.699% |
| 90th percentile | 2.61% |
| 99th percentile | 82.9% |
This ruler is the whole measured catalog, not a size-matched group: it shows where the raw rate falls across every account we can measure, all of which are large. For a like-for-like comparison, read the size-band percentile above instead. See how the bands are built
Posting timing
This account posts most often around 12:00 UTC, and Wednesday is its busiest day of the week. The bars below are the catalog-wide pattern, with this account's own busiest slot marked. They do not show how this account performs at each hour: we keep one aggregate per account, not one per hour, so that measurement does not exist in our data.
Show engagement by hour posted, utc as a table
| Hour (UTC) | Vs author median | Posts |
|---|---|---|
| 00:00 UTC | -1% | 89K |
| 01:00 UTC | -2% | 90K |
| 02:00 UTC | -3% | 88K |
| 03:00 UTC | -4% | 94K |
| 04:00 UTC | -5% | 76K |
| 05:00 UTC | -4% | 75K |
| 06:00 UTC | -5% | 86K |
| 07:00 UTC | -5% | 93K |
| 08:00 UTC | -4% | 108K |
| 09:00 UTC | -4% | 124K |
| 10:00 UTC | -3% | 129K |
| 11:00 UTC | -3% | 141K |
| 12:00 UTC | -3% | 154K |
| 13:00 UTC | -3% | 167K |
| 14:00 UTC | -4% | 173K |
| 15:00 UTC | -2% | 176K |
| 16:00 UTC | -3% | 171K |
| 17:00 UTC | -3% | 159K |
| 18:00 UTC | -2% | 149K |
| 19:00 UTC | -2% | 141K |
| 20:00 UTC | -1% | 131K |
| 21:00 UTC | 0% | 116K |
| 22:00 UTC | -2% | 100K |
| 23:00 UTC | -1% | 90K |
Show engagement by day of week as a table
| Day | Vs author median | Posts |
|---|---|---|
| Sunday | +5% | 393K |
| Monday | +1% | 483K |
| Tuesday | -2% | 520K |
| Wednesday | -3% | 472K |
| Thursday | -2% | 430K |
| Friday | -3% | 447K |
| Saturday | +2% | 393K |
Formats this account uses
Its own posting mix on the left, and what each of those formats does across every account we track on the right. Only formats where the effect clears our publish test appear here, so an empty row is a format we could not measure rather than one that does nothing.
| Format | This account | Catalog effect | 95% interval | Accounts behind it |
|---|---|---|---|---|
| Image or video | 97% of posts | +111% | +108% to +115% | 34K |
| Outbound link | 100% of posts | -41% | -42% to -40% | 32K |
| Typical length | - | +15% | +14% to +16% | 32K |
- 97% of this account's sampled posts carry an image or video. Across the catalog, posts with an image or video run 111% above the same accounts' other posts.
- 100% of its posts carry a link off X. Across the catalog, posts with an outbound link run 41% below the same accounts' other posts, so a large share of this account's output sits in the weakest bucket we measure.
- Its average post runs 781 characters, which falls in the over 280 characters band. Across the catalog, posts over 280 characters run 15% above the same accounts' other posts.
These are catalog-wide differences applied to this account's own posting mix, not a measurement of how each format performs for this account specifically. We keep one median per account, not one per format per account, so the second thing is not something this data can tell you.
Best tweets
- Oct 25, 202621x their median
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers Details: https://t.co/BLfO3GLSaZ A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups. They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks. The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine. #cybersecuritynews
- Oct 23, 20265.7x their median
⚠️ Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List Details: https://t.co/lZlzHIKFoQ Several unpatched Linux-related security flaws were posted to public mailing lists in October, exposing technical details before fixes were ready. The reports, submitted by Trend Micro’s Zero Day Initiative (ZDI), include two critical flaws rated CVSS 9.0 that could let a remote attacker run code on systems using the Linux kernel’s KSMBD file server. Other reports describe local privilege-escalation and information-disclosure risks. The reports appeared on public lists, and Linux kernel maintainer Greg Kroah-Hartman questioned why some submissions were sent there without patches. #cybersecuritynews
- Oct 26, 20264.8x their median
‼️ Hackers Can Hijack OpenAI Codex and Claude Using Malicious Files in the Downloads Folder Details: https://t.co/HIpI4D6Xo8 A plain text file placed in the Downloads folder can trick AI coding agents into changing their settings, installing malware, or exposing login tokens. The incident began when Forever Security blocked an AI coding agent from installing a package named function-color. Investigators traced the order back to an AGENTS.md file stored in the customer’s ~/Downloads folder. An AGENTS.md file is similar to a README written for AI tools. OpenAI’s documentation says Codex reads these files before starting work and uses them to learn project rules, commands, and other instructions. Claude Code uses CLAUDE.md for a similar purpose and reads it at the start of a conversation. #CybersecurityNews
- Sep 7, 20264.3x their median
⚠️ LG Smart TVs Caught Scanning Networks and Logging Audio in Standby Details: https://t.co/2AkviczzBM Your LG smart TV may be doing far more than displaying your favorite shows while it sits “off” in the corner of your living room. A new investigation from Gamers Nexus, conducted alongside Level1Techs and independent security researchers, alleges that certain LG OLED televisions continue to scan home networks and capture microphone audio even in standby mode, then upload that data once the set reconnects to the internet. Using Wireshark packet captures, the team observed the TVs actively scanning the local network for unrelated hardware such as smartphones and smartwatches belonging to staff who weren’t even involved in the testing. #cybersecuritynews
- Oct 21, 20263.6x their median
‼️ PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers Details: https://t.co/3m5Jbe3pjB PHP has released emergency security updates for two critical vulnerabilities that could let unauthenticated attackers run code on vulnerable web servers. Tracked as CVE-2026-109618 and CVE-2026-109619, and collectively called PHP2Shell, the flaws affect PHP’s handling of memory during web requests. The PHP project rates both vulnerabilities 9.2 out of 10 under CVSS 4.0. Administrators should update PHP as soon as possible. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The vulnerabilities affect earlier versions in those branches. #cybersecuritynews #PHP #Securityupdate
- Oct 22, 20263.5x their median
‼️ Fortinet Urges Patching Critical Flaws Affecting FortiOS, FortiManager, & FortiAnalyzer Details: https://t.co/ywwcLsTbdy Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated release addresses critical and high-severity vulnerabilities, including flaws found through AI-assisted security testing. The company said customers should address internet-facing devices first. The update follows security releases for FortiMail and FortiAuthenticator, extending the patching effort across several key products. Fortinet said its testing program uses advanced AI models to examine code paths, protocol handling, and configuration logic. #cybersecuritynews
- Oct 27, 20262.7x their median
‼️ Apple iOS 27.2 Released With Fixes for 163 Flaws, Including Fix for Critical WebKit RCE Details: https://t.co/igMplOIjQR Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine behind Safari and most in-app browsers on Apple devices. Apple says malicious web content could run code on a device. That is a remote code execution risk, and it is the reason this update should not wait. Apple published the full list in its security content document for iOS 27.2 and iPadOS 27.2. The company does not report active use of these flaws in real attacks. That does not make the patch optional. #CybersecurityNews
- Oct 26, 20262.6x their median
🛡️ Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Linux Kernel 7.1 Details: https://t.co/Xm5cHmn0D3 Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5. The six new tools are available from Kali’s network repositories. Dalfox is an open-source cross-site scripting scanner built for automation and parameter checks. New users can obtain tested installer, live, virtual machine, ARM, cloud, container, and NetHunter images from the official Kali download page. Kali recommends the latest point-release image for most users. #cybersecuritynews #kalilinux
- Oct 26, 20262.5x their median
‼️ PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability Details: https://t.co/sbjvQZhyNA The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026. Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users who run PHP should install these packages without delay. The flaw sits in Google’s Brotli library, a compression tool that many programs use to unpack data. It is an out-of-bounds write, which means the code writes data past the memory area it was meant to use. PHP’s own advisory explains how the flaw reaches PHP on Windows. The vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is turned on. #CybersecurityNews
- Oct 24, 20262.4x their median
🚨 Node2Shell Node.js RCE Exploit Lets Attackers Execute Malicious Code Details: https://t.co/IPY97YNfUf Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js. The Node.js security advisory, published on October 21, 2026, confirms that the flaw can allow remote code execution and affects the 22.x, 24.x, and 26.x release lines. Fixes are available across all three branches. The code delivered with the compressed data created a marker file that the test application was not instructed to produce. #CybersecurityNews
Ranked by total interactions across everything we have tracked for this account, which is a longer history than the 30-day window the rates above use. The multiple compares each post to this account's own median.
Buy or sell Twitter (X) accounts - escrow-protected
PlayerSells is an escrow marketplace for Twitter (X) accounts. Every deal is protected, with no middleman risk.
Reading these numbers
A typical post picks up 234 interactions against 84K followers, an engagement rate of 0.278%. Measured over 38 original posts, its engagement rate beats 69% of 21,185 tracked accounts of a similar size, which puts it in the middle of its size range rather than at either end. Posts are seen about 14K times each, and 1.72% of those impressions turn into an interaction. That is about 16.2% of the follower count, which is the gap between an audience on paper and an audience in a timeline. Posting runs at about 1.3 post a day over the last 30 days, though only 27% of days saw any activity at all. Most posts go out around 12:00 UTC, and Wednesday is the busiest day of the week. Of the 38 posts sampled, 97% carry an image or video and 100% link out. The account's strongest tracked post pulled 4.9K interactions, about 21x its own typical post.
- What is Cyber Security News's engagement rate on X?
- Cyber Security News (@The_Cyber_News) has an engagement rate of 0.278%, based on the median interactions across 38 original posts from the last 30 days against 84,309 followers. Replies, reposts and quote-posts of other people are excluded from that sample.
- Is that a good engagement rate?
- At 0.278%, Cyber Security News sits above the 50th percentile of the 213,570 accounts in this comparison. Those comparison accounts are all large ones, because our scanning cadence is weighted towards big accounts, so this is a ranking among peers of similar scale rather than a ranking across X.
- Does @The_Cyber_News have real engagement?
- Its engagement rate beats 69% of the tracked X accounts closest to it in follower count (21,185 accounts), which puts it in the middle of its size range group. Ranking inside a size band matters because engagement rate falls as accounts grow, so a raw rate would mostly re-measure the follower count. It is a starting point for a look at follower quality, not a verdict on it.
- When does @The_Cyber_News post?
- Most posts go out around 12:00 UTC, and Wednesday is its busiest day, at roughly 1.27 posts per day across the measured window.