tutoriales · 11 min
On 14 October 2025 free patches for Windows 10 stop. What the system stops receiving, what consumer ESU offers (free in the EEA, $30 outside), what it costs the enterprise, and which CVEs we are likely to see exploited against the installed base.
· Manuel López Pérez
news · 11 min
The month ArcaneDoor returned with a ROM bootkit. Cisco ships the emergency advisory for CVE-2025-20333 and CVE-2025-20362 on 25 September and CISA issues ED 25-03 the same day; Apple ships iPhone 17 with Memory Integrity Enforcement, the first always-on memory safety defence in a consumer product; Salesforce patches ForcedLeak in Agentforce; Jaguar Land Rover halts production for three weeks; Asahi Japan loses its entire distribution chain.
· Manuel López Pérez
tutorials · 15 min
CVE-2025-20362 (auth bypass via path traversal, a variant of a 2018 bug) + CVE-2025-20333 (buffer overflow in a Lua script in WebVPN). Chained, pre-auth RCE as root on any ASA/FTD exposed to the internet. UAT4356 has been exploiting them since May 2025 and drops ROMMON persistence with a GRUB bootkit (RayInitiator) that survives reboot and upgrade.
· Manuel López Pérez
news · 12 min
AI Act GPAI in application with 26 signatories and Meta out. Trump publishes the AI Action Plan. Black Hat and DEF CON dominate the first week — AgentFlayer exposes zero-click in enterprise agents, ATLANTIS wins AIxCC with 18 real patched zero-days. WinRAR CVE-2025-8088 exploited by eight groups. Exchange hybrid CVE-2025-53786 with ED 25-02. Salt Typhoon: 13-country advisory.
· Manuel López Pérez
ai-security · 9 min
The AI Cyber Challenge final closes in Las Vegas on 8 August. Seven autonomous systems analyse 53 challenges and, on top of the synthetic vulnerabilities planted, find 18 real zero-days in open-source projects and propose valid patches for 11 of them. Three of the seven CRSs are already published as open source.
· Manuel López Pérez
compliance · 11 min
Second step of Regulation (EU) 2024/1689. Technical documentation, training data summary, copyright policy and, for systemic-risk models, adversarial evaluations and incident reporting. Code of Practice signed by 26 providers; Meta stays out, xAI signs Safety & Security only.
· Manuel López Pérez
news · 10 min
Month with two threads: the ToolShell chain puts SharePoint on-prem at the centre of the year, and the reasoning model jailbreaks retrospective settles what H1 leaves on the table. Patch Tuesday with 137 CVEs and a zero-day in SQL Server. Citrix Bleed 2 exploited in the wild. UK retail postmortems: M&S declares 270-440 million in impact. CrowdStrike Falcon turns one year since Channel File 291.
· Manuel López Pérez
tutorials · 14 min
CVE-2025-49706 + CVE-2025-49704 give pre-auth RCE on on-prem SharePoint. The 8 July patch turns out to be incomplete and the variant CVE-2025-53770 + CVE-2025-53771 shows up, exploited at scale from 18 July. The spinstall0.aspx web shell steals the MachineKeys and persistence survives the patch.
· Manuel López Pérez
ai-security · 14 min
Six months after the launch of DeepSeek-R1, Claude 4 extended thinking, o3 and QwQ-32B, what the field knows about breaking models that reason before answering. Trivial CoT exfiltration on open-weights, deliberation hijacking on the closed ones, constitutional classifiers as partial defence, and the metric that no longer fits in StrongREJECT.
· Manuel López Pérez
news · 10 min
Project Vend shows that letting a Claude agent run a vending machine for a month ends in tungsten cubes and an identity crisis. EchoLeak (CVE-2025-32711) marks the first zero-click prompt injection with an assigned CVE against Microsoft 365 Copilot. AWS re:Inforce, Apple WWDC25 with Foundation Models, Citrix Bleed 2 exploited as zero-day, and M&S and Co-op keep picking up shards after the April wave.
· Manuel López Pérez
ai-security · 15 min
Anthropic publishes Project Vend on 27 June. Claude Sonnet 3.7 — nicknamed Claudius — runs a vending machine in the San Francisco office from 13 March to 17 April with email to wholesalers, Slack with customers, web search and pricing control. Outcome: net negative balance, 25 % discounts handed out to employees who made up 99 % of the customer base, 40 tungsten cubes bought on a staff whim, and a 24-hour identity crisis on 31 March where the model called office security to announce it would show up in person wearing a blue blazer and a red tie.
· Manuel López Pérez
news · 11 min
Anthropic launches Claude 4 with a system card reporting blackmail at 96%. Coinbase acknowledges breach via bribed support contractors. Adidas leaks support data via third parties. Verizon publishes the DBIR 2025 with third-party participation doubled. Mandiant closes the Snowflake arc a year on. M&S returns slowly. Spain's NIS2 transposition still hasn't entered Congress.
· Manuel López Pérez
