Blog

Explore our articles on cybersecurity, ethical hacking, tutorials, CTF writeups, and information security news

tutorials · 17 min
ByBit / Safe{Wallet}: how Lazarus stole $1.5B by flipping a flag from operation=0 to operation=1
On 21 February 2025, TraderTraitor drains 401,347 ETH from ByBit's cold wallet. The multi-sig has no bug, the blockchain has no bug: what breaks is the visualisation chain. JavaScript injected into app.safe.global from a Safe developer machine compromised by a malicious Docker project 17 days earlier. The signer sees a routine transfer; what they sign is a delegatecall that rewrites slot 0 of the proxy.
25 feb 2025 · Manuel López Pérez
ai-security · 39 min
AI Security 2024 — annual dossier
Twelve months across ten axes. 2024 is the year AI infrastructure emerged as a category with its own CVEs, agents moved from the lab to product (Claude Computer Use, MCP, Salesforce Agentforce), regulation became applicable (EU AI Act in force 1 August, NIS2 deadline 17 October, NIST AI 600-1), and jailbreaks professionalised with reproducible metrics (ArtPrompt, Many-shot, Skeleton Key). Underneath, Recall shipped without threat modeling and got pulled, Arup lost $25M on a deepfake video call, and the pre-positioning chain of incidents (Volt Typhoon, Salt Typhoon, Storm-0558 fallout) runs through the whole year. Canonical annual reference.
15 feb 2025 · Manuel López Pérez
compliance · 15 min
EU AI Act — Art. 5 enters application: eight prohibited practices in the EU from 2 February 2025
First real step of Regulation (EU) 2024/1689. On 2 February, the prohibitions on unacceptable practices and the AI literacy duty enter application. Table of the eight categories with article, real product affected and deadline, plus the Art. 5.2 exceptions and Art. 2 extraterritoriality.
5 feb 2025 · Manuel López Pérez
news · 11 min
Bulletin — January 2025
DORA starts on 17 January. Trump rescinds Biden's AI Executive Order on inauguration day. DeepSeek-R1 opens the open-weights reasoning category. OpenAI launches Operator, the first commercial generalist agent. Ivanti Connect Secure zero-day. Fortinet FortiOS auth bypass exfiltrates configs from 15,000 firewalls. SonicWall SMA1000 deserialization. BeyondTrust/Treasury forensics closes. Patch Tuesday with 159 CVEs and 8 zero-days.
1 feb 2025 · Manuel López Pérez
ai-security · 13 min
DeepSeek-R1: the first reasoning model with open CoT and what changes for AI security
On 20 January DeepSeek ships R1 with paper, repo and Hugging Face weights under MIT. It is the first time a reasoning model with RL-trained chain-of-thought is available as open weights. The CoT between <think></think> tags is plain text — inspectable, and attackable.
25 ene 2025 · Manuel López Pérez
compliance · 14 min
DORA applicable from 17 January: Regulation (EU) 2022/2554 and the five operational pillars
On 17 January 2025 DORA enters application. It applies to banks, insurers, funds, fintechs, IORPs, MiCA-regulated CASPs, and to critical ICT third-party providers designated by the ESAs. Five pillars of obligations, TLPT every three years for important entities, ICT provider register, and lex specialis vs NIS2 for finance.
20 ene 2025 · Manuel López Pérez
news · 12 min
Bulletin — December 2024
Cl0p reoffends with Cleo MFT and breaks the first patch. BeyondTrust SaaS leads to Treasury (Silk Typhoon, not Volt). 12 days of OpenAI Shipmas. Gemini 2.0, Phi-4, DeepSeek-V3. DORA starts on 17 January. 2024 retrospective.
1 ene 2025 · Manuel López Pérez
ai-security · 10 min
AI security 2024 in review: five patterns that stick
Not a ranking, not a listicle. Five patterns from the year with analysis and cross-links to the monthly technicals: long context as attack surface, agents in production, jailbreaks by optimisation, launches without threat modelling, reasoning models as new surface.
30 dic 2024 · Manuel López Pérez
tutorials · 11 min
Cleo MFT CVE-2024-50623: Cl0p closes the year with its third managed file transfer
Huntress detects zero-day exploitation on 3 December of a bug in Cleo Harmony, VLTrader and LexiCom. The initial 5.8.0.21 patch does not mitigate; CVE-2024-55956 lands along with a second patch 5.8.0.24. Cl0p claims responsibility on 14 December. The group's third MFT in two years.
12 dic 2024 · Manuel López Pérez
news · 9 min
Bulletin — November 2024
Anthropic publishes MCP on 25 November. Palo Alto adds CVE-2024-0012 + CVE-2024-9474 to the KEV catalogue, zero-day exploitation documented by watchTowr. T-Mobile shows up on the official Salt Typhoon list. Hot Topic sees 56 million accounts leaked. HellCat reoffends against Schneider Electric. Connor Moucka consents to extradition.
1 dic 2024 · Manuel López Pérez
ai-security · 13 min
Confused deputy revisited: Model Context Protocol and the protocol-level version of the bug
Anthropic publishes MCP on 25 November. The model-to-external-tools link becomes an open spec with three primitives: tools, resources, prompts. The spec says the host SHOULD ask for consent; it concedes the protocol cannot enforce it. The confused deputy pattern we documented in September 2023 is back — now as a standard integration.
28 nov 2024 · Manuel López Pérez
news · 9 min
Bulletin — October 2024
The week the AI agent moved the mouse: Anthropic launches computer use on 22 Oct and Rehberger publishes the first ZombAI on the 24th. Behind that: FortiManager exploited as a zero-day, Internet Archive exposes 31M accounts, Ivanti CSA with three CVEs under exploitation, NIS2 deadline passes with Spain not transposed. Microsoft closes two zero-days in Patch Tuesday and OpenAI launches ChatGPT Search.
1 nov 2024 · Manuel López Pérez

Newer posts

Older posts