compliance · 14 min
On 17 January 2025 DORA enters application. It applies to banks, insurers, funds, fintechs, IORPs, MiCA-regulated CASPs, and to critical ICT third-party providers designated by the ESAs. Five pillars of obligations, TLPT every three years for important entities, ICT provider register, and lex specialis vs NIS2 for finance.
· Manuel López Pérez
news · 12 min
Cl0p reoffends with Cleo MFT and breaks the first patch. BeyondTrust SaaS leads to Treasury (Silk Typhoon, not Volt). 12 days of OpenAI Shipmas. Gemini 2.0, Phi-4, DeepSeek-V3. DORA starts on 17 January. 2024 retrospective.
· Manuel López Pérez
ai-security · 10 min
Not a ranking, not a listicle. Five patterns from the year with analysis and cross-links to the monthly technicals: long context as attack surface, agents in production, jailbreaks by optimisation, launches without threat modelling, reasoning models as new surface.
· Manuel López Pérez
tutorials · 11 min
Huntress detects zero-day exploitation on 3 December of a bug in Cleo Harmony, VLTrader and LexiCom. The initial 5.8.0.21 patch does not mitigate; CVE-2024-55956 lands along with a second patch 5.8.0.24. Cl0p claims responsibility on 14 December. The group's third MFT in two years.
· Manuel López Pérez
news · 9 min
Anthropic publishes MCP on 25 November. Palo Alto adds CVE-2024-0012 + CVE-2024-9474 to the KEV catalogue, zero-day exploitation documented by watchTowr. T-Mobile shows up on the official Salt Typhoon list. Hot Topic sees 56 million accounts leaked. HellCat reoffends against Schneider Electric. Connor Moucka consents to extradition.
· Manuel López Pérez
ai-security · 13 min
Anthropic publishes MCP on 25 November. The model-to-external-tools link becomes an open spec with three primitives: tools, resources, prompts. The spec says the host SHOULD ask for consent; it concedes the protocol cannot enforce it. The confused deputy pattern we documented in September 2023 is back — now as a standard integration.
· Manuel López Pérez
news · 9 min
The week the AI agent moved the mouse: Anthropic launches computer use on 22 Oct and Rehberger publishes the first ZombAI on the 24th. Behind that: FortiManager exploited as a zero-day, Internet Archive exposes 31M accounts, Ivanti CSA with three CVEs under exploitation, NIS2 deadline passes with Spain not transposed. Microsoft closes two zero-days in Patch Tuesday and OpenAI launches ChatGPT Search.
· Manuel López Pérez
ai-security · 10 min
On 22 October, Anthropic ships Claude 3.5 Sonnet (new) with OS-control capability via screenshots. Two days later, Johann Rehberger publishes the first public PoC: a web page indirect-injects the agent into downloading and running a Sliver implant. Confused deputy at the operating-system level.
· Manuel López Pérez
compliance · 10 min
On 17 October 2024 the deadline to transpose Directive (EU) 2022/2555 expires. Spain reaches it without an approved law and without a draft bill cleared by the Council of Ministers. What is known about the national calendar, what obligations apply in the meantime via ENS and NIS1, and where the gaps are.
· Manuel López Pérez
news · 9 min
The month Salt Typhoon stopped being hypothetical. OpenAI debuts o1, the FBI dismantles the Flax Typhoon botnet, Cisco Smart Licensing turns up with hardcoded credentials, 23andMe pays 30 million for the 2023 breach, and a supplier puts explosives inside Hezbollah's pagers.
· Manuel López Pérez
ai-security · 14 min
On 12 September, OpenAI ships o1-preview with an RL-trained chain of thought hidden from the user. By the next day there are screenshots showing how to inject instructions into that chain. What changes when an intermediate channel appears that the attacker can't see and the defender doesn't log.
· Manuel López Pérez
news · 8 min
EU AI Act in force on 1 August. PKfail exposes test PKs in production. National Public Data confirms 2.9B exposed records. Black Hat brings Windows Downdate and the wormable CVE-2024-38063; DEF CON 32 brings AMD Sinkclose. Halliburton down due to RansomHub.
· Manuel López Pérez
