news · 9 min
Windows 10 closes ten years of support. F5 discloses source code theft and unpublished CVEs by a nation-state. Patch Tuesday with three zero-days in use, WSUS RCE wormable with out-of-band patch. AWS US-East-1 down for 15 hours. Claude Haiku 4.5 and Sonnet 4.5 in production.
· Manuel López Pérez
news · 11 min
The month ArcaneDoor returned with a ROM bootkit. Cisco ships the emergency advisory for CVE-2025-20333 and CVE-2025-20362 on 25 September and CISA issues ED 25-03 the same day; Apple ships iPhone 17 with Memory Integrity Enforcement, the first always-on memory safety defence in a consumer product; Salesforce patches ForcedLeak in Agentforce; Jaguar Land Rover halts production for three weeks; Asahi Japan loses its entire distribution chain.
· Manuel López Pérez
news · 12 min
AI Act GPAI in application with 26 signatories and Meta out. Trump publishes the AI Action Plan. Black Hat and DEF CON dominate the first week — AgentFlayer exposes zero-click in enterprise agents, ATLANTIS wins AIxCC with 18 real patched zero-days. WinRAR CVE-2025-8088 exploited by eight groups. Exchange hybrid CVE-2025-53786 with ED 25-02. Salt Typhoon: 13-country advisory.
· Manuel López Pérez
news · 10 min
Month with two threads: the ToolShell chain puts SharePoint on-prem at the centre of the year, and the reasoning model jailbreaks retrospective settles what H1 leaves on the table. Patch Tuesday with 137 CVEs and a zero-day in SQL Server. Citrix Bleed 2 exploited in the wild. UK retail postmortems: M&S declares 270-440 million in impact. CrowdStrike Falcon turns one year since Channel File 291.
· Manuel López Pérez
news · 10 min
Project Vend shows that letting a Claude agent run a vending machine for a month ends in tungsten cubes and an identity crisis. EchoLeak (CVE-2025-32711) marks the first zero-click prompt injection with an assigned CVE against Microsoft 365 Copilot. AWS re:Inforce, Apple WWDC25 with Foundation Models, Citrix Bleed 2 exploited as zero-day, and M&S and Co-op keep picking up shards after the April wave.
· Manuel López Pérez
news · 11 min
Anthropic launches Claude 4 with a system card reporting blackmail at 96%. Coinbase acknowledges breach via bribed support contractors. Adidas leaks support data via third parties. Verizon publishes the DBIR 2025 with third-party participation doubled. Mandiant closes the Snowflake arc a year on. M&S returns slowly. Spain's NIS2 transposition still hasn't entered Congress.
· Manuel López Pérez
news · 9 min
M&S falls on 25 April via social engineering against the TCS helpdesk — Co-op follows on the 29th with the same vector — Harrods contains on 1 May. Llama 4 arrives with LMArena controversy. GPT-4.1 ships on the 14th, Gemini 2.5 Pro on 25 March. 4chan hacked on the 14th. Patch Tuesday with a CLFS zero-day exploited by RansomEXX.
· Manuel López Pérez
news · 11 min
Invariant publishes the first paper on MCP tool poisoning. Patch Tuesday with six zero-days, two NTFS and one MMC via PipeMagic. iOS 18.4 ships on the 31st with 150+ CVEs. Chrome CVE-2025-2783 exploited by Operation ForumTroll. tj-actions/changed-files compromised and leaking secrets from 23,000 repos. Oracle Cloud denies a breach that CloudSEK documents. Signalgate.
· Manuel López Pérez
news · 14 min
The AI Act Art. 5 enters application on 2 Feb and Vance buries the multilateral consensus in Paris on 11 Feb. TraderTraitor exfiltrates $1.5B from ByBit via Safe{Wallet}. Apple withdraws ADP in the UK. Anthropic releases Claude 3.7 Sonnet with visible reasoning. Storm-2372 scales device code phishing. DOGE enters and exits Treasury via court order.
· Manuel López Pérez
news · 11 min
DORA starts on 17 January. Trump rescinds Biden's AI Executive Order on inauguration day. DeepSeek-R1 opens the open-weights reasoning category. OpenAI launches Operator, the first commercial generalist agent. Ivanti Connect Secure zero-day. Fortinet FortiOS auth bypass exfiltrates configs from 15,000 firewalls. SonicWall SMA1000 deserialization. BeyondTrust/Treasury forensics closes. Patch Tuesday with 159 CVEs and 8 zero-days.
· Manuel López Pérez
news · 12 min
Cl0p reoffends with Cleo MFT and breaks the first patch. BeyondTrust SaaS leads to Treasury (Silk Typhoon, not Volt). 12 days of OpenAI Shipmas. Gemini 2.0, Phi-4, DeepSeek-V3. DORA starts on 17 January. 2024 retrospective.
· Manuel López Pérez
news · 9 min
Anthropic publishes MCP on 25 November. Palo Alto adds CVE-2024-0012 + CVE-2024-9474 to the KEV catalogue, zero-day exploitation documented by watchTowr. T-Mobile shows up on the official Salt Typhoon list. Hot Topic sees 56 million accounts leaked. HellCat reoffends against Schneider Electric. Connor Moucka consents to extradition.
· Manuel López Pérez
