ai-security · 30 min
The year the three fronts went operational at the same time: agents in real production (Operator GA, Project Vend, MCP in clients), regulation with binding deadlines (DORA, Art. 5, GPAI) and AI at visible scale on both offence (XBOW #1 on HackerOne) and defence (AIxCC, Security Copilot Agents). Annual reference with a catalogue of releases, papers, incidents and cross-links to the year's technical writeups.
· Manuel López Pérez
compliance · 14 min
On 2 February 2026 the Regulation (EU) 2024/1689 prohibitions hit their first anniversary. Twelve months in, no national authority has published an Art. 5 sanction. AESIA closes 2025 with 16 guidelines but no public inspections. CNIL takes jurisdiction over workplace emotion recognition. Contact-centre vendors keep selling emotion. Operational recap of year one, no sermon.
· Manuel López Pérez
news · 11 min
DORA turns one on the 17th. The ESAs published 19 CTPPs in November. DeepSeek slips V4 and ships Engram + an updated R1. Moonshot drops Kimi K2.5 multimodal with agent swarm. Patch Tuesday with a DWM zero-day. Ivanti EPMM pre-auth RCE exploited on 29 January. Trump opens litigation against state AI laws. Hugging Face publishes its open-weights year in review.
· Manuel López Pérez
writeups · 6 min
Comprehensive analysis of security threats in Large Language Models (LLMs), attack techniques like prompt injection, and practical case study from the A.D.I.C. 7 challenge at CyberH2O CTF.
· Manuel López Pérez
ai-security · 14 min
January 2026 marks a year since DeepSeek-R1. The expected V4 doesn't land — DeepSeek publishes the Engram paper (conditional memory) and an updated R1 paper instead. Moonshot AI drops Kimi K2.5 with multimodal and agent swarm. The open-weights frontier pattern is now normal: Chinese labs dominate the Hugging Face rankings. State and the defences it assumes broken.
· Manuel López Pérez
writeups · 7 min
Write-up of the third and final machine from the CyberH2O cyberchallenge, an industrial environment with SNMP, OPC UA, Node-RED and privilege escalation.
· Manuel López Pérez
compliance · 15 min
On 17 January 2026 DORA marks a year of applicability. The ESAs designate 19 critical ICT providers in November 2025, the first TLPT cycle starts to land for 2026-2028, national authorities close the grace period and open active inspection. Operational table of what worked, what is missing, and what is required during 2026.
· Manuel López Pérez
writeups · 6 min
Write-up of the second machine from the CyberH2O cyberchallenge, a hybrid environment with Docker containers and privilege escalation via Portainer.
· Manuel López Pérez
writeups · 6 min
Write-up of the first challenge of the CyberH2O cyberchallenge, focused on OSINT to locate an exposed PLC in a specific municipality.
· Manuel López Pérez
news · 9 min
Cl0p insists a year after Cleo. OpenAI repeats Shipmas. Anthropic closes the year with a Claude refresh. DORA and NIS2 enter the first inspection cycle. Year-end reports from Mandiant, CrowdStrike and Verizon. The year in one table.
· Manuel López Pérez
tutoriales · 10 min
ByBit, the UK retail wave (M&S/Co-op/Harrods), SharePoint ToolShell and Windows 10 end-of-support. Four incidents with explicit criterion — no exhaustive top list, no ranking — and the operational lesson each one leaves for 2026.
· Manuel López Pérez
ai-security · 11 min
Open-weights reasoning as new default, generalist agents in product, MCP poisoning as mature category, agentic misalignment with reproducible metric, AI Act as real compliance gradient, and reasoning models as consolidated surface. Six patterns with cross-links to the monthly technicals.
· Manuel López Pérez
