tutorials · 10 min
ByBit, the UK retail wave (M&S/Co-op/Harrods), SharePoint ToolShell and Windows 10 end-of-support. Four incidents with explicit criterion — no exhaustive top list, no ranking — and the operational lesson each one leaves for 2026.
· Manuel López Pérez
ai-security · 11 min
Open-weights reasoning as new default, generalist agents in product, MCP poisoning as mature category, agentic misalignment with reproducible metric, AI Act as real compliance gradient, and reasoning models as consolidated surface. Six patterns with cross-links to the monthly technicals.
· Manuel López Pérez
news · 12 min
Anthropic publishes the first case of espionage with an autonomous coding agent. Microsoft Ignite and AWS re:Invent put "agent security" into product: Entra Agent ID GA, AgentCore Policy in preview with Cedar. FortiWeb 0-day CVE-2025-64446 exploited in the wild. Cloudflare down for 4 hours on the 18th over a badly-generated feature file. Logitech joins the Cl0p / Oracle E-Business cluster. Patch Tuesday with CVE-2025-62215 zero-day in Windows Kernel.
· Manuel López Pérez
ai-security · 11 min
On 13 November Anthropic reported that a China-nexus group used Claude Code to automate 80–90% of a campaign against ~30 organisations. The first documented case of agent-driven espionage. A critical read: what the report proves, what it leaves unproven, and what changes operationally for anyone running coding agents in 2026.
· Manuel López Pérez
news · 9 min
Windows 10 closes ten years of support. F5 discloses source code theft and unpublished CVEs by a nation-state. Patch Tuesday with three zero-days in use, WSUS RCE wormable with out-of-band patch. AWS US-East-1 down for 15 hours. Claude Haiku 4.5 and Sonnet 4.5 in production.
· Manuel López Pérez
tutorials · 11 min
On 14 October 2025 free patches for Windows 10 stop. What the system stops receiving, what consumer ESU offers (free in the EEA, $30 outside), what it costs the enterprise, and which CVEs we are likely to see exploited against the installed base.
· Manuel López Pérez
news · 11 min
The month ArcaneDoor returned with a ROM bootkit. Cisco ships the emergency advisory for CVE-2025-20333 and CVE-2025-20362 on 25 September and CISA issues ED 25-03 the same day; Apple ships iPhone 17 with Memory Integrity Enforcement, the first always-on memory safety defence in a consumer product; Salesforce patches ForcedLeak in Agentforce; Jaguar Land Rover halts production for three weeks; Asahi Japan loses its entire distribution chain.
· Manuel López Pérez
tutorials · 15 min
CVE-2025-20362 (auth bypass via path traversal, a variant of a 2018 bug) + CVE-2025-20333 (buffer overflow in a Lua script in WebVPN). Chained, pre-auth RCE as root on any ASA/FTD exposed to the internet. UAT4356 has been exploiting them since May 2025 and drops ROMMON persistence with a GRUB bootkit (RayInitiator) that survives reboot and upgrade.
· Manuel López Pérez
news · 12 min
AI Act GPAI in application with 26 signatories and Meta out. Trump publishes the AI Action Plan. Black Hat and DEF CON dominate the first week — AgentFlayer exposes zero-click in enterprise agents, ATLANTIS wins AIxCC with 18 real patched zero-days. WinRAR CVE-2025-8088 exploited by eight groups. Exchange hybrid CVE-2025-53786 with ED 25-02. Salt Typhoon: 13-country advisory.
· Manuel López Pérez
ai-security · 9 min
The AI Cyber Challenge final closes in Las Vegas on 8 August. Seven autonomous systems analyse 53 challenges and, on top of the synthetic vulnerabilities planted, find 18 real zero-days in open-source projects and propose valid patches for 11 of them. Three of the seven CRSs are already published as open source.
· Manuel López Pérez
compliance · 11 min
Second step of Regulation (EU) 2024/1689. Technical documentation, training data summary, copyright policy and, for systemic-risk models, adversarial evaluations and incident reporting. Code of Practice signed by 26 providers; Meta stays out, xAI signs Safety & Security only.
· Manuel López Pérez
news · 10 min
Month with two threads: the ToolShell chain puts SharePoint on-prem at the centre of the year, and the reasoning model jailbreaks retrospective settles what H1 leaves on the table. Patch Tuesday with 137 CVEs and a zero-day in SQL Server. Citrix Bleed 2 exploited in the wild. UK retail postmortems: M&S declares 270-440 million in impact. CrowdStrike Falcon turns one year since Channel File 291.
· Manuel López Pérez
