news · 11 min
Anthropic launches Claude 4 with a system card reporting blackmail at 96%. Coinbase acknowledges breach via bribed support contractors. Adidas leaks support data via third parties. Verizon publishes the DBIR 2025 with third-party participation doubled. Mandiant closes the Snowflake arc a year on. M&S returns slowly. Spain's NIS2 transposition still hasn't entered Congress.
· Manuel López Pérez
news · 9 min
M&S falls on 25 April via social engineering against the TCS helpdesk — Co-op follows on the 29th with the same vector — Harrods contains on 1 May. Llama 4 arrives with LMArena controversy. GPT-4.1 ships on the 14th, Gemini 2.5 Pro on 25 March. 4chan hacked on the 14th. Patch Tuesday with a CLFS zero-day exploited by RansomEXX.
· Manuel López Pérez
news · 11 min
Invariant publishes the first paper on MCP tool poisoning. Patch Tuesday with six zero-days, two NTFS and one MMC via PipeMagic. iOS 18.4 ships on the 31st with 150+ CVEs. Chrome CVE-2025-2783 exploited by Operation ForumTroll. tj-actions/changed-files compromised and leaking secrets from 23,000 repos. Oracle Cloud denies a breach that CloudSEK documents. Signalgate.
· Manuel López Pérez
news · 14 min
The AI Act Art. 5 enters application on 2 Feb and Vance buries the multilateral consensus in Paris on 11 Feb. TraderTraitor exfiltrates $1.5B from ByBit via Safe{Wallet}. Apple withdraws ADP in the UK. Anthropic releases Claude 3.7 Sonnet with visible reasoning. Storm-2372 scales device code phishing. DOGE enters and exits Treasury via court order.
· Manuel López Pérez
news · 11 min
DORA starts on 17 January. Trump rescinds Biden's AI Executive Order on inauguration day. DeepSeek-R1 opens the open-weights reasoning category. OpenAI launches Operator, the first commercial generalist agent. Ivanti Connect Secure zero-day. Fortinet FortiOS auth bypass exfiltrates configs from 15,000 firewalls. SonicWall SMA1000 deserialization. BeyondTrust/Treasury forensics closes. Patch Tuesday with 159 CVEs and 8 zero-days.
· Manuel López Pérez
news · 12 min
Cl0p reoffends with Cleo MFT and breaks the first patch. BeyondTrust SaaS leads to Treasury (Silk Typhoon, not Volt). 12 days of OpenAI Shipmas. Gemini 2.0, Phi-4, DeepSeek-V3. DORA starts on 17 January. 2024 retrospective.
· Manuel López Pérez
news · 9 min
Anthropic publishes MCP on 25 November. Palo Alto adds CVE-2024-0012 + CVE-2024-9474 to the KEV catalogue, zero-day exploitation documented by watchTowr. T-Mobile shows up on the official Salt Typhoon list. Hot Topic sees 56 million accounts leaked. HellCat reoffends against Schneider Electric. Connor Moucka consents to extradition.
· Manuel López Pérez
news · 9 min
The week the AI agent moved the mouse: Anthropic launches computer use on 22 Oct and Rehberger publishes the first ZombAI on the 24th. Behind that: FortiManager exploited as a zero-day, Internet Archive exposes 31M accounts, Ivanti CSA with three CVEs under exploitation, NIS2 deadline passes with Spain not transposed. Microsoft closes two zero-days in Patch Tuesday and OpenAI launches ChatGPT Search.
· Manuel López Pérez
news · 9 min
The month Salt Typhoon stopped being hypothetical. OpenAI debuts o1, the FBI dismantles the Flax Typhoon botnet, Cisco Smart Licensing turns up with hardcoded credentials, 23andMe pays 30 million for the 2023 breach, and a supplier puts explosives inside Hezbollah's pagers.
· Manuel López Pérez
news · 8 min
EU AI Act in force on 1 August. PKfail exposes test PKs in production. National Public Data confirms 2.9B exposed records. Black Hat brings Windows Downdate and the wormable CVE-2024-38063; DEF CON 32 brings AMD Sinkclose. Halliburton down due to RansomHub.
· Manuel López Pérez
news · 10 min
Dense month. regreSSHion opens the month with a big headline and moderate exploitability. On the 12th the AI Act lands in the OJEU and AT&T notifies 110M records linked to Snowflake. On the 19th, CrowdStrike ships Channel File 291 and drops 8.5M Windows machines. ESXi CVE-2024-37085 already being abused by ransomware. ServiceNow, Authy, Disney/NullBulge, Mistral NeMo.
· Manuel López Pérez
news · 9 min
Mandiant publishes the UNC5537 report — 165 Snowflake accounts compromised via infostealers. Polyfill.io turns out to have been bought by Funnull and serving malware since February. CDK Global pays $25M to BlackSuit after halting 15,000 dealerships. APT29 inside TeamViewer. Apple presents Private Cloud Compute at WWDC and Anthropic ships Claude 3.5 Sonnet.
· Manuel López Pérez
