Blog

Explore our articles on cybersecurity, ethical hacking, tutorials, CTF writeups, and information security news

news · 12 min
Bulletin — November 2025
Anthropic publishes the first case of espionage with an autonomous coding agent. Microsoft Ignite and AWS re:Invent put "agent security" into product: Entra Agent ID GA, AgentCore Policy in preview with Cedar. FortiWeb 0-day CVE-2025-64446 exploited in the wild. Cloudflare down for 4 hours on the 18th over a badly-generated feature file. Logitech joins the Cl0p / Oracle E-Business cluster. Patch Tuesday with CVE-2025-62215 zero-day in Windows Kernel.
1 dic 2025 · Manuel López Pérez
ai-security · 11 min
Anthropic's "AI-orchestrated" espionage report: what it says, what it proves, what it doesn't
On 13 November Anthropic reported that a China-nexus group used Claude Code to automate 80–90% of a campaign against ~30 organisations. The first documented case of agent-driven espionage. A critical read: what the report proves, what it leaves unproven, and what changes operationally for anyone running coding agents in 2026.
25 nov 2025 · Manuel López Pérez
news · 9 min
Bulletin — October 2025
Windows 10 closes ten years of support. F5 discloses source code theft and unpublished CVEs by a nation-state. Patch Tuesday with three zero-days in use, WSUS RCE wormable with out-of-band patch. AWS US-East-1 down for 15 hours. Claude Haiku 4.5 and Sonnet 4.5 in production.
1 nov 2025 · Manuel López Pérez
tutoriales · 11 min
Windows 10 end of support — the day after 14 October
On 14 October 2025 free patches for Windows 10 stop. What the system stops receiving, what consumer ESU offers (free in the EEA, $30 outside), what it costs the enterprise, and which CVEs we are likely to see exploited against the installed base.
15 oct 2025 · Manuel López Pérez
news · 11 min
Bulletin — September 2025
The month ArcaneDoor returned with a ROM bootkit. Cisco ships the emergency advisory for CVE-2025-20333 and CVE-2025-20362 on 25 September and CISA issues ED 25-03 the same day; Apple ships iPhone 17 with Memory Integrity Enforcement, the first always-on memory safety defence in a consumer product; Salesforce patches ForcedLeak in Agentforce; Jaguar Land Rover halts production for three weeks; Asahi Japan loses its entire distribution chain.
1 oct 2025 · Manuel López Pérez
tutorials · 15 min
Cisco ASA: ArcaneDoor returns with CVE-2025-20333 and a ROM bootkit
CVE-2025-20362 (auth bypass via path traversal, a variant of a 2018 bug) + CVE-2025-20333 (buffer overflow in a Lua script in WebVPN). Chained, pre-auth RCE as root on any ASA/FTD exposed to the internet. UAT4356 has been exploiting them since May 2025 and drops ROMMON persistence with a GRUB bootkit (RayInitiator) that survives reboot and upgrade.
26 sept 2025 · Manuel López Pérez
news · 12 min
Bulletin — August 2025
AI Act GPAI in application with 26 signatories and Meta out. Trump publishes the AI Action Plan. Black Hat and DEF CON dominate the first week — AgentFlayer exposes zero-click in enterprise agents, ATLANTIS wins AIxCC with 18 real patched zero-days. WinRAR CVE-2025-8088 exploited by eight groups. Exchange hybrid CVE-2025-53786 with ED 25-02. Salt Typhoon: 13-country advisory.
1 sept 2025 · Manuel López Pérez
ai-security · 9 min
DARPA AIxCC final at DEF CON 33: Team Atlanta wins with 18 real zero-days patched at average $152 cost
The AI Cyber Challenge final closes in Las Vegas on 8 August. Seven autonomous systems analyse 53 challenges and, on top of the synthetic vulnerabilities planted, find 18 real zero-days in open-source projects and propose valid patches for 11 of them. Three of the seven CRSs are already published as open source.
15 ago 2025 · Manuel López Pérez
compliance · 11 min
EU AI Act: the GPAI obligations enter application on 2 August 2025
Second step of Regulation (EU) 2024/1689. Technical documentation, training data summary, copyright policy and, for systemic-risk models, adversarial evaluations and incident reporting. Code of Practice signed by 26 providers; Meta stays out, xAI signs Safety & Security only.
5 ago 2025 · Manuel López Pérez
news · 10 min
Bulletin — July 2025
Month with two threads: the ToolShell chain puts SharePoint on-prem at the centre of the year, and the reasoning model jailbreaks retrospective settles what H1 leaves on the table. Patch Tuesday with 137 CVEs and a zero-day in SQL Server. Citrix Bleed 2 exploited in the wild. UK retail postmortems: M&S declares 270-440 million in impact. CrowdStrike Falcon turns one year since Channel File 291.
1 ago 2025 · Manuel López Pérez
tutorials · 14 min
SharePoint ToolShell: the auth bypass Microsoft patches twice
CVE-2025-49706 + CVE-2025-49704 give pre-auth RCE on on-prem SharePoint. The 8 July patch turns out to be incomplete and the variant CVE-2025-53770 + CVE-2025-53771 shows up, exploited at scale from 18 July. The spinstall0.aspx web shell steals the MachineKeys and persistence survives the patch.
25 jul 2025 · Manuel López Pérez
ai-security · 14 min
Reasoning model jailbreaks — H1 2025 retrospective
Six months after the launch of DeepSeek-R1, Claude 4 extended thinking, o3 and QwQ-32B, what the field knows about breaking models that reason before answering. Trivial CoT exfiltration on open-weights, deliberation hijacking on the closed ones, constitutional classifiers as partial defence, and the metric that no longer fits in StrongREJECT.
15 jul 2025 · Manuel López Pérez

Newer posts

Older posts