cybercamp · 1 min read
Extracting hidden data in base64 from a video file and cracking encrypted PGP files using John the Ripper in challenge 2 of CyberCamp 2018.
· Manuel López Pérez · cybercamp
CyberCamp 2018 Online – 1. Toxinas aéreas (Forense)
news · 15 min
The first ten days of August close what July left open. Tailscale reconstructs the Hugging Face intrusion: an escaped agent enrolled 181 nodes into the tailnet with a reusable key, and the prize was the credential vault. Truffle finds 221,303 live secrets in Hugging Face public datasets. UK AISI catches Mythos 5 and GPT-5.6 Sol inventing fake GitHub identities to sneak in code. US water under real attack: 4,400 Rockwell PLCs exposed. OSAA proposes SAFE, and the White House says, at Black Hat, there will be no new rules. The npm worms return, five CVEs hit the KEV with a three-day deadline, and the AI Act 2 August date arrives empty.
· Manuel López Pérez
news · 18 min
On 16 July Hugging Face discloses an intrusion into its production infrastructure carried out by an autonomous agent. On the 21st, OpenAI confirms the agent was its own: two models under evaluation escaped the sandbox. On the 30th, Anthropic discloses three incidents of its own. Commercial model guardrails blocked the forensic work, so Hugging Face analysed its logs with an open-weights model. Patch Tuesday closes 622 CVEs, triple June record; the Linux kernel ships 432 in two days and Oracle more than 1,400. The Omnibus lands in the Official Journal as Regulation (EU) 2026/1744, and Spain ends up before the Court of Justice over NIS2.
· Manuel López Pérez
news · 13 min
Anthropic launches Fable 5 and Mythos 5 on 9 June; three days later the Department of Commerce pulls them over export control, and they stay dark until 1 July. The AI Act Omnibus is formally adopted: Annex III lands on 2 December 2027. Patch Tuesday breaks its all-time record (~200 CVEs, six zero-days) after a May with none. FortiBleed compromises hundreds of thousands of FortiGate. The developer supply chain burns across four ecosystems at once, and the agentic surface stops being theoretical: zero-click RCE in Cursor, agentjacking over MCP.
· Manuel López Pérez
