news · 11 min
The month of hard anniversaries: AI Act Art. 5 turns one on 2 February, ByBit turns one on the 21st. India AI Impact Summit in Delhi replaces the Paris Action Summit. Patch Tuesday with 6 zero-days. CrowdStrike GTR 2026 puts breakout time at 29 minutes. Mandiant opens M-Trends 2026 promo (April publication). DORA enters active enforcement after the grace period. CISA KEV with three updates.
· Manuel López Pérez
tutorials · 15 min
On 21 February 2026 the ByBit hack turns one. Only 3.5 % of the $1.5B has been frozen. What did change: Safe ships Guardrail (August 2025) blocking unauthorised DELEGATECALL, EIP-7702 hits mainnet with Pectra (May 2025), the Ethereum Foundation takes over ERC-7730 from Ledger and pulls Trezor / MetaMask / WalletConnect into an open clear-signing standard. Updated PoC on Sepolia comparing signing with and without Guardrail+clear signing.
· Manuel López Pérez
ai-security · 30 min
The year the three fronts went operational at the same time: agents in real production (Operator GA, Project Vend, MCP in clients), regulation with binding deadlines (DORA, Art. 5, GPAI) and AI at visible scale on both offence (XBOW #1 on HackerOne) and defence (AIxCC, Security Copilot Agents). Annual reference with a catalogue of releases, papers, incidents and cross-links to the year's technical writeups.
· Manuel López Pérez
compliance · 14 min
On 2 February 2026 the Regulation (EU) 2024/1689 prohibitions hit their first anniversary. Twelve months in, no national authority has published an Art. 5 sanction. AESIA closes 2025 with 16 guidelines but no public inspections. CNIL takes jurisdiction over workplace emotion recognition. Contact-centre vendors keep selling emotion. Operational recap of year one, no sermon.
· Manuel López Pérez
news · 11 min
DORA turns one on the 17th. The ESAs published 19 CTPPs in November. DeepSeek slips V4 and ships Engram + an updated R1. Moonshot drops Kimi K2.5 multimodal with agent swarm. Patch Tuesday with a DWM zero-day. Ivanti EPMM pre-auth RCE exploited on 29 January. Trump opens litigation against state AI laws. Hugging Face publishes its open-weights year in review.
· Manuel López Pérez
writeups · 6 min
Comprehensive analysis of security threats in Large Language Models (LLMs), attack techniques like prompt injection, and practical case study from the A.D.I.C. 7 challenge at CyberH2O CTF.
· Manuel López Pérez
ai-security · 14 min
January 2026 marks a year since DeepSeek-R1. The expected V4 doesn't land — DeepSeek publishes the Engram paper (conditional memory) and an updated R1 paper instead. Moonshot AI drops Kimi K2.5 with multimodal and agent swarm. The open-weights frontier pattern is now normal: Chinese labs dominate the Hugging Face rankings. State and the defences it assumes broken.
· Manuel López Pérez
writeups · 7 min
Write-up of the third and final machine from the CyberH2O cyberchallenge, an industrial environment with SNMP, OPC UA, Node-RED and privilege escalation.
· Manuel López Pérez
compliance · 15 min
On 17 January 2026 DORA marks a year of applicability. The ESAs designate 19 critical ICT providers in November 2025, the first TLPT cycle starts to land for 2026-2028, national authorities close the grace period and open active inspection. Operational table of what worked, what is missing, and what is required during 2026.
· Manuel López Pérez
writeups · 6 min
Write-up of the second machine from the CyberH2O cyberchallenge, a hybrid environment with Docker containers and privilege escalation via Portainer.
· Manuel López Pérez
writeups · 6 min
Write-up of the first challenge of the CyberH2O cyberchallenge, focused on OSINT to locate an exposed PLC in a specific municipality.
· Manuel López Pérez
news · 9 min
Cl0p insists a year after Cleo. OpenAI repeats Shipmas. Anthropic closes the year with a Claude refresh. DORA and NIS2 enter the first inspection cycle. Year-end reports from Mandiant, CrowdStrike and Verizon. The year in one table.
· Manuel López Pérez
