compliance · 15 min
First real step of Regulation (EU) 2024/1689. On 2 February, the prohibitions on unacceptable practices and the AI literacy duty enter application. Table of the eight categories with article, real product affected and deadline, plus the Art. 5.2 exceptions and Art. 2 extraterritoriality.
· Manuel López Pérez
news · 11 min
DORA starts on 17 January. Trump rescinds Biden's AI Executive Order on inauguration day. DeepSeek-R1 opens the open-weights reasoning category. OpenAI launches Operator, the first commercial generalist agent. Ivanti Connect Secure zero-day. Fortinet FortiOS auth bypass exfiltrates configs from 15,000 firewalls. SonicWall SMA1000 deserialization. BeyondTrust/Treasury forensics closes. Patch Tuesday with 159 CVEs and 8 zero-days.
· Manuel López Pérez
ai-security · 13 min
On 20 January DeepSeek ships R1 with paper, repo and Hugging Face weights under MIT. It is the first time a reasoning model with RL-trained chain-of-thought is available as open weights. The CoT between <think></think> tags is plain text — inspectable, and attackable.
· Manuel López Pérez
compliance · 14 min
On 17 January 2025 DORA enters application. It applies to banks, insurers, funds, fintechs, IORPs, MiCA-regulated CASPs, and to critical ICT third-party providers designated by the ESAs. Five pillars of obligations, TLPT every three years for important entities, ICT provider register, and lex specialis vs NIS2 for finance.
· Manuel López Pérez
news · 12 min
Cl0p reoffends with Cleo MFT and breaks the first patch. BeyondTrust SaaS leads to Treasury (Silk Typhoon, not Volt). 12 days of OpenAI Shipmas. Gemini 2.0, Phi-4, DeepSeek-V3. DORA starts on 17 January. 2024 retrospective.
· Manuel López Pérez
ai-security · 10 min
Not a ranking, not a listicle. Five patterns from the year with analysis and cross-links to the monthly technicals: long context as attack surface, agents in production, jailbreaks by optimisation, launches without threat modelling, reasoning models as new surface.
· Manuel López Pérez
tutorials · 11 min
Huntress detects zero-day exploitation on 3 December of a bug in Cleo Harmony, VLTrader and LexiCom. The initial 5.8.0.21 patch does not mitigate; CVE-2024-55956 lands along with a second patch 5.8.0.24. Cl0p claims responsibility on 14 December. The group's third MFT in two years.
· Manuel López Pérez
news · 9 min
Anthropic publishes MCP on 25 November. Palo Alto adds CVE-2024-0012 + CVE-2024-9474 to the KEV catalogue, zero-day exploitation documented by watchTowr. T-Mobile shows up on the official Salt Typhoon list. Hot Topic sees 56 million accounts leaked. HellCat reoffends against Schneider Electric. Connor Moucka consents to extradition.
· Manuel López Pérez
ai-security · 13 min
Anthropic publishes MCP on 25 November. The model-to-external-tools link becomes an open spec with three primitives: tools, resources, prompts. The spec says the host SHOULD ask for consent; it concedes the protocol cannot enforce it. The confused deputy pattern we documented in September 2023 is back — now as a standard integration.
· Manuel López Pérez
news · 9 min
The week the AI agent moved the mouse: Anthropic launches computer use on 22 Oct and Rehberger publishes the first ZombAI on the 24th. Behind that: FortiManager exploited as a zero-day, Internet Archive exposes 31M accounts, Ivanti CSA with three CVEs under exploitation, NIS2 deadline passes with Spain not transposed. Microsoft closes two zero-days in Patch Tuesday and OpenAI launches ChatGPT Search.
· Manuel López Pérez
ai-security · 10 min
On 22 October, Anthropic ships Claude 3.5 Sonnet (new) with OS-control capability via screenshots. Two days later, Johann Rehberger publishes the first public PoC: a web page indirect-injects the agent into downloading and running a Sliver implant. Confused deputy at the operating-system level.
· Manuel López Pérez
compliance · 10 min
On 17 October 2024 the deadline to transpose Directive (EU) 2022/2555 expires. Spain reaches it without an approved law and without a draft bill cleared by the Council of Ministers. What is known about the national calendar, what obligations apply in the meantime via ENS and NIS1, and where the gaps are.
· Manuel López Pérez
