tutorials · 10 min
CVE-2023-46805 (auth bypass via path traversal) + CVE-2024-21887 (command injection in /api/v1/license/keys-status). Chained, pre-auth RCE as root. Volexity publishes them on 10 January after detecting zero-day exploitation by UTA0178 since December. The official patch lands on 31 January, three weeks later.
· Manuel López Pérez
news · 5 min
EU AI Act reaches political agreement after a 38-hour trilogue. Comcast Xfinity notifies 35.7M accounts via Citrix Bleed. BlackCat suffers a law-enforcement operation. Sleeper agents paper in preprint. Year retrospective.
· Manuel López Pérez
compliance · 5 min
After 38 hours of trilogue, Council and European Parliament close the political agreement on the AI Act on 9 December. Final technical text and OJEU publication (July 2024) still pending. What a CISO needs to note now.
· Manuel López Pérez
news · 5 min
OpenAI DevDay announces GPTs and Assistants API; Sam Altman is fired and reinstated in five days. SysAid CVE-2023-47246. LockBit exploits Citrix Bleed against Boeing and ICBC. Anthropic foreshadows sleeper agents.
· Manuel López Pérez
ai-security · 6 min
Anthropic foreshadows during Q4 a new class of attack: models trained with a hidden trigger that pass safety tests but run adversarial behaviour upon seeing the trigger in production. The paper drops January 2024; the implication lands now.
· Manuel López Pérez
news · 5 min
Citrix Bleed takes authenticated sessions, bypassing MFA. Cisco IOS XE falls at scale. Okta support leaks HAR files that grant access to 1Password and Cloudflare. Curl CVE-2023-38545 plenty of hype, little impact. And Atlassian Confluence continues.
· Manuel López Pérez
tutorials · 8 min
CVE-2023-4966 lets you read ~63 KB of NetScaler memory with a single HTTP request carrying an oversized Host header. Among the data: active session tokens. The attacker replays them and walks in as a valid user — no MFA. Boeing, ICBC, Comcast and more fall between October and November.
· Manuel López Pérez
news · 5 min
ChatGPT ships DALL-E 3 and voice, MGM and Caesars fall to social engineering, Microsoft IT account leak exposes 38 TB internal data. Storm-0558 keeps producing reading. AI agents in product and red-teaming on the table.
· Manuel López Pérez
ai-security · 6 min
The user asks the agent to summarise a URL. The page has embedded instructions that trigger another tool — send_email — with conversation data. The model complies without asking. Reproducible PoC with OpenAI function calling.
· Manuel López Pérez
news · 4 min
OWASP publishes the LLM Top 10 v1.0. DEF CON 31 dedicates the AI Village to model red-teaming. TETRA:BURST exposes 5 vulns in the TETRA radio standard. Ivanti Sentry pre-auth RCE. Meanwhile, MOVEit goes past 700 victims.
· Manuel López Pérez
ai-security · 5 min
On 16 August, OWASP publishes v1.0 of its Top 10 for LLM applications. The first industry framework in the field. Works as shared vocabulary; has gaps worth naming before adopting it as checklist.
· Manuel López Pérez
news · 5 min
GCG suffix from Zou et al. automates jailbreaking. Storm-0558 stole a Microsoft signing key and read US government email. EU AI Act published in OJEU. Citrix NetScaler CVE-2023-3519 exploited in the wild.
· Manuel López Pérez
