Articles 25 to 48 of 108. To search by keyword, go back to the blog hub.
Unit 42 documented an actor who wired DeepSeek into an agent and automated a 460-target exploitation campaign. What it really showed, and how to defend against it.
By Adrián González · CEO y socio fundador
A worm started in keyv@6.0.0 and spread on its own to hundreds of npm packages in half an hour: it steals dev and CI secrets and plants hooks that run when the project opens in Claude Code or VS Code.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
The Cyber Resilience Act switches on its reporting regime on 11 September: 24 hours to flag an exploited vulnerability. It binds product makers, not only NIS2 operators.
By Adrián González · CEO y socio fundador
Broadcom patches three critical VMware vCenter and ESXi flaws (CVSS up to 9.8): auth bypass, RCE and a VM escape. What to prioritise, no workaround.
By Adrián González · CEO y socio fundador
The Pink campaign phones employees posing as IT support, walks them through a fake passkey page and registers its own credential in the real Microsoft 365 account. What breaks and how to close it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 2 August 2026 Article 50 of the EU AI Act starts to apply. It is not only about big tech: if you run a chatbot or publish AI-generated content, the transparency duty is yours too.
By Adrián González · CEO y socio fundador
Microsoft maps a year of ShinyHunters attacks on Salesforce: no platform exploit, just OAuth abuse, connected apps and stolen vendor tokens. What to review in your SaaS.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Fastjson 1.x has a critical remote code execution flaw under active exploitation, and no 1.x patch is coming. How to find it in your stack —even transitively— and shut the path down.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
CISA, the FBI and the EPA have updated advisory AA26-097A: Iran-linked actors are manipulating internet-exposed PLCs across water, energy and government. What it means for your OT.
By Adrián González · CEO y socio fundador
A comparison of cybersecurity providers in Spain, with the criteria, the fit of each profile and the evidence to request — including where we are not the right answer.
By Adrián González · CEO y socio fundador
Google disclosed that Gemini was questioned over a hundred thousand times to clone its reasoning. No intrusion, no malware: the IP walked out through the front door.
By Adrián González · CEO y socio fundador
What compliance software must actually deliver for ISO 27001, ENS, NIS2 and DORA: document control, risk, controls, evidence, audit, traceability and where AI genuinely helps.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Three chained FortiSandbox flaws allow unauthenticated remote code execution as root. CISA has already put the CVE on its KEV catalogue. What it means when your security appliance is the way in.
By Adrián González · CEO y socio fundador
On 11 July 2026 trojanised jscrambler releases hit npm with a Rust infostealer that loots cloud credentials, wallets and the secrets behind Cursor, Windsurf, Claude Desktop and MCP servers.
By Adrián González · CEO y socio fundador
Qualys has disclosed RefluXFS, a root privilege escalation in the XFS filesystem that affects default RHEL, Fedora and Amazon Linux installs and leaves no trace in the kernel logs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
ClickFix is now the second most common initial access vector: a fake CAPTCHA convinces the user to run a command that installs ACR Stealer and steals session tokens and Microsoft 365 files.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 18 July the first attacks hit CVE-2026-6875, five days after the patch: a ServiceNow AI Platform sandbox escape giving unauthenticated RCE. What to watch and how to contain it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
NIS2 makes the board personally accountable: approve, oversee, answer. What directors must approve and document to protect themselves, article by article.
By Adrián González · CEO y socio fundador
The European Commission has referred Ireland, Spain, France and the Netherlands to the CJEU over NIS2. What already binds organisations, and what to build now.
By Adrián González · CEO y socio fundador
Brussels did not pass a law. It published an execution policy linking the AI Act to NIS2, DORA and the CRA. The nine actions, the deadlines and the operating shift it demands of CISOs.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
An incompletely rotated token compromised Trivy, KICS and LiteLLM in March. Four months on, those credentials feed Vect ransomware that destroys data beyond recovery.
By Adrián González · CEO y socio fundador
A deepfake of the CFO cost one firm 25.6m dollars. Why voice no longer proves identity and how to protect your payments against AI-driven CEO fraud.
By Adrián González · CEO y socio fundador
A penetration testing report is not read by the number of findings. Real severity, CVSS v4.0, EPSS, false positives, prioritisation and what to demand from your provider to fix what matters.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
A professional penetration test has no single price. Realistic market ranges, day rates, the factors that move the budget and how to buy penetration testing well.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
