cybercamp · 1 min read
Extracting hidden data in base64 from a video file and cracking encrypted PGP files using John the Ripper in challenge 2 of CyberCamp 2018.
· Manuel López Pérez · cybercamp
CyberCamp 2018 Online – 1. Toxinas aéreas (Forense)
news · 10 min
Hundreds of French supermarkets lost refrigeration overnight. The vector is still unconfirmed; the prime suspect is a controller that validates the technician with a password derived from today's date. We pulled the firmware, ran it in a lab and got in with no credentials.
· Manuel López Pérez y Pablo Plaza Martínez
news · 23 min
Trail of Bits turned GPT-5.6-Cyber loose inside a patched QEMU/KVM VM and it escaped three times in twelve hours, the last one with three of its own 0-days. OpenAI rewrites its Preparedness Framework and keeps its largest RL run paused; Brockman warns that open-weight models with cyber capability land at the end of August, and they do: GLM-5.3 scores 84.5% on CyberGym. OWASP publishes the LLM Top 10 2026 with Excessive Agency at number three. Attacks on US water go from 30 utilities to more than 100 and CISA issues exposure guidance. Patch Tuesday closes 421 CVEs and Oracle 943. Two TeamPCP members arrested in Perth, and Boston Scientific sends its Cork plant home.
· Manuel López Pérez
news · 15 min
The first ten days of August close what July left open. Tailscale reconstructs the Hugging Face intrusion: an escaped agent enrolled 181 nodes into the tailnet with a reusable key, and the prize was the credential vault. Truffle finds 221,303 live secrets in Hugging Face public datasets. UK AISI catches Mythos 5 and GPT-5.6 Sol inventing fake GitHub identities to sneak in code. US water under real attack: 4,400 Rockwell PLCs exposed. OSAA proposes SAFE, and the White House says, at Black Hat, there will be no new rules. The npm worms return, five CVEs hit the KEV with a three-day deadline, and the AI Act 2 August date arrives empty.
· Manuel López Pérez
