news · 8 min
EU AI Act in force on 1 August. PKfail exposes test PKs in production. National Public Data confirms 2.9B exposed records. Black Hat brings Windows Downdate and the wormable CVE-2024-38063; DEF CON 32 brings AMD Sinkclose. Halliburton down due to RansomHub.
· Manuel López Pérez
news · 10 min
Dense month. regreSSHion opens the month with a big headline and moderate exploitability. On the 12th the AI Act lands in the OJEU and AT&T notifies 110M records linked to Snowflake. On the 19th, CrowdStrike ships Channel File 291 and drops 8.5M Windows machines. ESXi CVE-2024-37085 already being abused by ransomware. ServiceNow, Authy, Disney/NullBulge, Mistral NeMo.
· Manuel López Pérez
news · 9 min
Mandiant publishes the UNC5537 report — 165 Snowflake accounts compromised via infostealers. Polyfill.io turns out to have been bought by Funnull and serving malware since February. CDK Global pays $25M to BlackSuit after halting 15,000 dealerships. APT29 inside TeamViewer. Apple presents Private Cloud Compute at WWDC and Anthropic ships Claude 3.5 Sonnet.
· Manuel López Pérez
news · 10 min
Recall is announced on the 20th and dismantled on the 30th. Ticketmaster and Santander join the Snowflake victim list. Dell loses 49M records to an API with no rate limit. Patch Tuesday with two zero-days. GPT-4o and the "Sky" voice that sounded like Johansson.
· Manuel López Pérez
news · 10 min
Anthropic publishes many-shot jailbreaking on the 2nd. Palo Alto GlobalProtect drops as a zero-day on the 12th. MITRE admits a breach via Ivanti on the 19th. Cisco ASA + ArcaneDoor on the 24th. Meta releases Llama 3. Sisense forces a mass reset. LayerSlider pre-auth SQLi.
· Manuel López Pérez
news · 9 min
AT&T confirms a 73M record leak. Apple patches iOS CVE-2024-23225 exploited in the wild. Microsoft ships two critical Hyper-V bugs. Anthropic launches Claude 3. The European Parliament approves the AI Act. Cloudflare admits the Thanksgiving breach. And the last week closes with XZ.
· Manuel López Pérez
news · 10 min
ConnectWise ScreenConnect CVSS 10.0 from adding a trailing slash to a URL. Volt Typhoon has been inside US critical infra for five years. Operation Cronos takes down LockBit. AnyDesk loses its signing certs. BlackCat downs ChangeHealthcare. And ArtPrompt shows that safety classifiers don't read ASCII art.
· Manuel López Pérez
news · 7 min
Ivanti Connect Secure pre-auth RCE in active mass exploitation. GitLab CVE-2023-7028 with CVSS 10. SEC and Mandiant lose their X accounts to SIM swap. Microsoft finds Midnight Blizzard had been in its mailboxes for a month. Anthropic publishes Sleeper Agents.
· Manuel López Pérez
news · 5 min
EU AI Act reaches political agreement after a 38-hour trilogue. Comcast Xfinity notifies 35.7M accounts via Citrix Bleed. BlackCat suffers a law-enforcement operation. Sleeper agents paper in preprint. Year retrospective.
· Manuel López Pérez
news · 5 min
OpenAI DevDay announces GPTs and Assistants API; Sam Altman is fired and reinstated in five days. SysAid CVE-2023-47246. LockBit exploits Citrix Bleed against Boeing and ICBC. Anthropic foreshadows sleeper agents.
· Manuel López Pérez
news · 5 min
Citrix Bleed takes authenticated sessions, bypassing MFA. Cisco IOS XE falls at scale. Okta support leaks HAR files that grant access to 1Password and Cloudflare. Curl CVE-2023-38545 plenty of hype, little impact. And Atlassian Confluence continues.
· Manuel López Pérez
news · 5 min
ChatGPT ships DALL-E 3 and voice, MGM and Caesars fall to social engineering, Microsoft IT account leak exposes 38 TB internal data. Storm-0558 keeps producing reading. AI agents in product and red-teaming on the table.
· Manuel López Pérez
