Articles 25 to 48 of 101 in this category. To search by keyword, go back to the blog hub.
Six US and South Korean agencies detail how Gunra operates: in through firewalls and VPNs, a back door planted inside MFA, and backups wiped before encryption.
By Adrián González · CEO y socio fundador
An attacker pivoted from a wind farm to a heating plant through a private APN assumed to be isolated, stopped a turbine and wiped its tracks — no malware.
By Daniel O'Grady · CIO y socio fundador
A deserialization flaw (CWE-502) in JetBrains TeamCity On-Premises allows unauthenticated remote code execution (CVSS 9.8). Now on CISA's KEV: timeline, detection and CI/CD hardening.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
UNC6671 calls employees on their personal phones, steals the MFA token with AiTM infrastructure and negotiates under four separate brands. What it reveals about defending financial firms.
By Daniel O'Grady · CIO y socio fundador
Progress patched the flaw on 4 June and attacks began on the 29th, the day the analysis went public. CISA added it to KEV on 7 August. What that timeline teaches about your patching deadlines.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Two suppliers can both claim ENS and cover very different things. What the boundary, the category and the audit result actually tell a buying committee.
By Adrián González · CEO y socio fundador
For a SaaS provider selling to Spanish public bodies, ENS arrives as a tender clause with a deadline. Boundary and category decide the cost. How to get both right.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An unauthenticated CVSS 10.0 flaw in Metabase, exploited since 3 August, handed attackers the credentials for connected databases. What to check, how to detect it and who to notify.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Edge devices went from 3% to 22% of exploitation breaches in a year. Why EDR cannot reach firewalls, VPNs and routers, and how to regain visibility without an agent.
By Adrián González · CEO y socio fundador
Verizon cut US$350m from the Yahoo price over two breaches; Marriott inherited Starwood's penalty. What to assess, how to price it and how to get it into the agreement.
By Adrián González · CEO y socio fundador
At Black Hat 2026 an AI system found attack techniques no human had catalogued first. Signature and known-TTP defence now has a much shorter shelf life.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
What does cybersecurity really do for a business? In 2026 it has stopped being an IT cost and become a key to winning contracts, a shield against losses and an engine of trust.
By Adrián González · CEO y socio fundador
Two North Korea-linked npm packages resolve their command server by reading a blank Ethereum transfer. NullReceiver defeats domain takedown — here is what changes for defenders.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Unit 42 documented an actor who wired DeepSeek into an agent and automated a 460-target exploitation campaign. What it really showed, and how to defend against it.
By Adrián González · CEO y socio fundador
A worm started in keyv@6.0.0 and spread on its own to hundreds of npm packages in half an hour: it steals dev and CI secrets and plants hooks that run when the project opens in Claude Code or VS Code.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Broadcom patches three critical VMware vCenter and ESXi flaws (CVSS up to 9.8): auth bypass, RCE and a VM escape. What to prioritise, no workaround.
By Adrián González · CEO y socio fundador
The Pink campaign phones employees posing as IT support, walks them through a fake passkey page and registers its own credential in the real Microsoft 365 account. What breaks and how to close it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Microsoft maps a year of ShinyHunters attacks on Salesforce: no platform exploit, just OAuth abuse, connected apps and stolen vendor tokens. What to review in your SaaS.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Fastjson 1.x has a critical remote code execution flaw under active exploitation, and no 1.x patch is coming. How to find it in your stack —even transitively— and shut the path down.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
A comparison of cybersecurity providers in Spain, with the criteria, the fit of each profile and the evidence to request — including where we are not the right answer.
By Adrián González · CEO y socio fundador
Google disclosed that Gemini was questioned over a hundred thousand times to clone its reasoning. No intrusion, no malware: the IP walked out through the front door.
By Adrián González · CEO y socio fundador
What compliance software must actually deliver for ISO 27001, ENS, NIS2 and DORA: document control, risk, controls, evidence, audit, traceability and where AI genuinely helps.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Three chained FortiSandbox flaws allow unauthenticated remote code execution as root. CISA has already put the CVE on its KEV catalogue. What it means when your security appliance is the way in.
By Adrián González · CEO y socio fundador
On 11 July 2026 trojanised jscrambler releases hit npm with a Rust infostealer that loots cloud credentials, wallets and the secrets behind Cursor, Windsurf, Claude Desktop and MCP servers.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
