https://hard2bit.com/en/blog/ Technical analysis, NIS2, DORA, ENS and ISO 27001 guides and operational insights from the Hard2bit team: 24/7 SOC, pentesting, red team and incident response. en Thu, 24 Sep 2026 08:06:50 GMT https://hard2bit.com/en/blog/eviltokens-takedown-chatbot-microsoft-365-inboxes-bec-fraud/ https://hard2bit.com/en/blog/eviltokens-takedown-chatbot-microsoft-365-inboxes-bec-fraud/ Thu, 24 Sep 2026 08:06:50 GMT Microsoft and a coalition of partners have dismantled EvilTokens, the device code phishing kit whose AI analysed stolen mailboxes to set up fraud. What the data shows and which controls work. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/plugin4shell-commit-pinning-bypass-ai-coding-agent-plugins-claude-code-codex-copilot-gemini/ https://hard2bit.com/en/blog/plugin4shell-commit-pinning-bypass-ai-coding-agent-plugins-claude-code-codex-copilot-gemini/ Mon, 21 Sep 2026 08:54:17 GMT Four AI coding agents pinned every plugin to a reviewed commit and none of them checked where the checkout landed. What breaks, who has a patch and what to control in the enterprise. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/owasp-top-10-2025-pentest-audit-scope/ https://hard2bit.com/en/blog/owasp-top-10-2025-pentest-audit-scope/ Thu, 17 Sep 2026 07:41:53 GMT What changed in the OWASP Top 10 2025, why two categories come from a survey rather than the data, what a pentester tests in each one and what to add to the scope of your next web audit. Ciberseguridad https://hard2bit.com/en/blog/honeytokens-decoy-accounts-active-directory-entra-id/ https://hard2bit.com/en/blog/honeytokens-decoy-accounts-active-directory-entra-id/ Wed, 16 Sep 2026 08:15:33 GMT A guide to honeytokens: fake-SPN accounts, accounts that never sign in, credentials planted in SYSVOL and cloud tokens. How to build them, watch them and stop them becoming a risk. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/active-directory-tiering-tier-0-privileged-access-model/ https://hard2bit.com/en/blog/active-directory-tiering-tier-0-privileged-access-model/ Mon, 14 Sep 2026 10:10:58 GMT What tiered administration is, what belongs in Tier 0, why so many organisations skip it, and which controls and evidence prove the model exists. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/patch-gap-chrome-zero-day-chinese-espionage-ai/ https://hard2bit.com/en/blog/patch-gap-chrome-zero-day-chinese-espionage-ai/ Mon, 14 Sep 2026 08:18:59 GMT Proofpoint and Volexity separately document Chinese groups exploiting three Chrome and Windows zero-days in the gap between the Chromium fix and the browser release. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/hard2bit-silver-sponsor-ii-sme-cybersecurity-congress-cybermadrid/ https://hard2bit.com/en/blog/hard2bit-silver-sponsor-ii-sme-cybersecurity-congress-cybermadrid/ Fri, 11 Sep 2026 10:05:00 GMT On 29 September we will have a stand at Digitaliza Madrid and Thilina Manana joins the panel on the human factor and the supply chain. Noticias IT Ciberseguridad https://hard2bit.com/en/blog/direct-send-microsoft-365-empty-sender-internal-spoofing/ https://hard2bit.com/en/blog/direct-send-microsoft-365-empty-sender-internal-spoofing/ Tue, 08 Sep 2026 07:32:42 GMT By leaving the SMTP envelope sender empty, an attacker sidesteps the RejectDirectSend control and slips external mail into Microsoft 365 as if it were internal. Detection and defence. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/dmarc-snapshot-large-spanish-companies-sectors-p-reject/ https://hard2bit.com/en/blog/dmarc-snapshot-large-spanish-companies-sectors-p-reject/ Mon, 07 Sep 2026 09:52:11 GMT We scanned SPF and DMARC across 219 large companies in 8 sectors: 73% block, 38% at reject, 22% with SPF at the edge of the limit. What RFC 9989 requires and how to reach p=reject. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/postgreshell-cve-2026-6471-postgresql-replication-account-loads-code/ https://hard2bit.com/en/blog/postgreshell-cve-2026-6471-postgresql-replication-account-loads-code/ Mon, 07 Sep 2026 06:01:08 GMT PostGREShell (CVE-2026-6471) lets a REPLICATION account load code on the PostgreSQL server. Conditions, trail, detection, and how to patch without breaking logical replication. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/badhost-starlette-cve-2026-48710-cisa-kev-fastapi-litellm-mcp/ https://hard2bit.com/en/blog/badhost-starlette-cve-2026-48710-cisa-kev-fastapi-litellm-mcp/ Sat, 05 Sep 2026 13:19:35 GMT CVE-2026-48710, a CVSS 6.5 Starlette flaw, joins the KEV catalogue after being used to break into AI gateways without credentials. Who is exposed, how to detect it and how to patch. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/disable-ntlm-without-breaking-network-audit-kerberos-migration/ https://hard2bit.com/en/blog/disable-ntlm-without-breaking-network-audit-kerberos-migration/ Fri, 04 Sep 2026 13:27:54 GMT Microsoft will block NTLM by default in the next Windows release and tightens NTLMv1 in October 2026. Why it persists on your network, which events to audit and how to remove it in phases. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/troubleshooting-copy-vendor-c-track-courts-third-party-risk/ https://hard2bit.com/en/blog/troubleshooting-copy-vendor-c-track-courts-third-party-risk/ Fri, 04 Sep 2026 08:22:58 GMT US and Canadian courts handed database copies to their case management vendor to debug faults, and an intruder had them for four months. What EU rules require and what to check in your contracts. Normativa & GRC Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/bgp-hijack-virtualizor-malicious-update-root-hypervisors/ https://hard2bit.com/en/blog/bgp-hijack-virtualizor-malicious-update-root-hypervisors/ Thu, 03 Sep 2026 08:59:01 GMT An unauthorised BGP announcement diverted Softaculous traffic for 33 hours, handed the attacker a valid certificate and served a Virtualizor update with root. What failed and what to check. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/artifactory-cve-2026-82329-phantom-join-key-admin-tokens/ https://hard2bit.com/en/blog/artifactory-cve-2026-82329-phantom-join-key-admin-tokens/ Thu, 03 Sep 2026 07:40:12 GMT CVE-2026-82329 lets attackers mint Artifactory admin tokens with no credentials. Patched 28 August, exploited by 1 September, now on CISA's KEV catalogue. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/summer-ddos-norway-id-porten-public-services/ https://hard2bit.com/en/blog/summer-ddos-norway-id-porten-public-services/ Thu, 27 Aug 2026 09:58:51 GMT Three DDoS attacks in three months struck ID-porten, Norway's digital identity gateway. What the campaign reveals, and what any organisation that depends on a shared layer should take from it. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/ddos-protection-businesses-mitigation-architecture/ https://hard2bit.com/en/blog/ddos-protection-businesses-mitigation-architecture/ Thu, 27 Aug 2026 09:55:08 GMT A business guide to DDoS protection: what to contract upstream, what your architecture must do, how to rehearse the response and what NIS2 demands. With 2026 data: 5,343 attacks mitigated every hour. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/incident-response-plan-how-to-build-one/ https://hard2bit.com/en/blog/incident-response-plan-how-to-build-one/ Wed, 26 Aug 2026 08:40:40 GMT In 2025 NIST withdrew the incident response model much Spanish-language guidance still copies. What a plan needs today, the deadlines NIS2, DORA and Spain's ENS impose, and how to test it. Ciberseguridad Normativa & GRC https://hard2bit.com/en/blog/ghostjacking-poisoned-logs-ai-agents-cloudflare-datadog-sentry/ https://hard2bit.com/en/blog/ghostjacking-poisoned-logs-ai-agents-cloudflare-datadog-sentry/ Tue, 25 Aug 2026 09:21:31 GMT The firewall blocked the request and that log entry carried the order in: how GhostJacking hijacks AI agents through the data they trust most. Ciberamenazas Investigación Ciberseguridad https://hard2bit.com/en/blog/bod-26-04-cisa-risk-based-patching-three-days/ https://hard2bit.com/en/blog/bod-26-04-cisa-risk-based-patching-three-days/ Mon, 24 Aug 2026 17:11:47 GMT CISA has replaced flat patching deadlines with a four-variable risk model. What BOD 26-04 demands, and what European organisations can borrow from it. Normativa & GRC Ciberseguridad https://hard2bit.com/en/blog/detecting-abuse-trusted-windows-binaries-lolbins-living-off-the-land/ https://hard2bit.com/en/blog/detecting-abuse-trusted-windows-binaries-lolbins-living-off-the-land/ Sat, 22 Aug 2026 09:22:08 GMT 82% of CrowdStrike's 2025 detections brought no malware: the attacker uses the signed programs you already have. Why antivirus misses them and how to hunt them. Ciberseguridad Ciberamenazas https://hard2bit.com/en/blog/breach-notices-hidden-root-cause-third-party-risk/ https://hard2bit.com/en/blog/breach-notices-hidden-root-cause-third-party-risk/ Fri, 21 Aug 2026 08:09:14 GMT Only 24% of breach notices now disclose the attack vector. What that does to supplier assessment in Europe, and what can still be demanded by contract. Normativa & GRC Ciberamenazas https://hard2bit.com/en/blog/tlpt-under-dora-spain-tiber-es-what-the-regulation-demands/ https://hard2bit.com/en/blog/tlpt-under-dora-spain-tiber-es-what-the-regulation-demands/ Thu, 20 Aug 2026 18:32:48 GMT The TIBER-ES guide dates from January 2022 and never mentions DORA. Since 2025 the same procedure has been mandatory for designated entities, and several of its parts have changed. Normativa & GRC Ciberseguridad https://hard2bit.com/en/blog/detection-engineering-attack-coverage-versus-analytic-robustness/ https://hard2bit.com/en/blog/detection-engineering-attack-coverage-versus-analytic-robustness/ Thu, 20 Aug 2026 09:22:45 GMT MITRE retired ATT&CK's detection fields and replaced them with 697 strategies and 1,758 analytics. That change explains why a coverage percentage measures the map rather than the ground. Ciberseguridad Investigación https://hard2bit.com/en/blog/which-logs-to-send-to-siem-priority-sources-retention-cost/ https://hard2bit.com/en/blog/which-logs-to-send-to-siem-priority-sources-retention-cost/ Wed, 19 Aug 2026 16:39:02 GMT Production SIEMs ingest enough data to cover 90% of MITRE ATT&CK and detect 22%. Which sources to prioritise, which fields to demand and how long to keep them. Ciberseguridad Ciberamenazas Normativa & GRC https://hard2bit.com/en/blog/macos-screen-sharing-cve-2026-65400-root-without-credentials/ https://hard2bit.com/en/blog/macos-screen-sharing-cve-2026-65400-root-without-credentials/ Sun, 16 Aug 2026 17:25:27 GMT A macOS Screen Sharing flaw hands root to anyone who can reach port 5900. Exploitation is active with Monero miners, and the usual hardening offers no protection. Ciberamenazas Noticias IT https://hard2bit.com/en/blog/lazarus-dream-job-zero-day-afd-fudmodule-defence/ https://hard2bit.com/en/blog/lazarus-dream-job-zero-day-afd-fudmodule-defence/ Sun, 16 Aug 2026 10:49:37 GMT Lazarus paired fake job offers and DLL side-loading in a PDF viewer with zero-day CVE-2026-68820 in afd.sys to plant the FudModule rootkit inside European defence firms. Ciberamenazas Noticias IT https://hard2bit.com/en/blog/passkey-attacks-compromised-endpoint-synced-keys/ https://hard2bit.com/en/blog/passkey-attacks-compromised-endpoint-synced-keys/ Sat, 15 Aug 2026 10:13:41 GMT Unit 42, SpecterOps and Mollema got past passkey sign-in without breaking the encryption, starting from an already-compromised endpoint. The weakness is in the implementation. Investigación Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/payroll-pirates-microsoft-365-salary-diversion-aitm/ https://hard2bit.com/en/blog/payroll-pirates-microsoft-365-salary-diversion-aitm/ Fri, 14 Aug 2026 06:12:18 GMT Hundreds of organisations targeted in July 2026: Payroll Pirates steals Microsoft 365 sessions with AiTM phishing, maps HR staff via Microsoft Graph and reroutes salaries. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/gunra-ransomware-joint-advisory-vpn-mfa-backdoor/ https://hard2bit.com/en/blog/gunra-ransomware-joint-advisory-vpn-mfa-backdoor/ Thu, 13 Aug 2026 10:45:47 GMT Six US and South Korean agencies detail how Gunra operates: in through firewalls and VPNs, a back door planted inside MFA, and backups wiped before encryption. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/private-apn-pivot-wind-farm-chp-plant-ot/ https://hard2bit.com/en/blog/private-apn-pivot-wind-farm-chp-plant-ot/ Wed, 12 Aug 2026 06:17:55 GMT An attacker pivoted from a wind farm to a heating plant through a private APN assumed to be isolated, stopped a turbine and wiped its tracks — no malware. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/teamcity-cve-2026-63077-unauthenticated-rce-build-server/ https://hard2bit.com/en/blog/teamcity-cve-2026-63077-unauthenticated-rce-build-server/ Tue, 11 Aug 2026 15:57:11 GMT A deserialization flaw (CWE-502) in JetBrains TeamCity On-Premises allows unauthenticated remote code execution (CVSS 9.8). Now on CISA's KEV: timeline, detection and CI/CD hardening. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/voice-phishing-extortion-multi-brand-unc6671-financial-sector/ https://hard2bit.com/en/blog/voice-phishing-extortion-multi-brand-unc6671-financial-sector/ Tue, 11 Aug 2026 09:28:16 GMT UNC6671 calls employees on their personal phones, steals the MFA token with AiTM infrastructure and negotiates under four separate brands. What it reveals about defending financial firms. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/cve-2026-8037-kemp-loadmaster-patch-to-exploitation-window/ https://hard2bit.com/en/blog/cve-2026-8037-kemp-loadmaster-patch-to-exploitation-window/ Mon, 10 Aug 2026 06:49:28 GMT Progress patched the flaw on 4 June and attacks began on the 29th, the day the analysis went public. CISA added it to KEV on 7 August. What that timeline teaches about your patching deadlines. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/not-all-ens-certificates-are-equal-scope-non-conformities/ https://hard2bit.com/en/blog/not-all-ens-certificates-are-equal-scope-non-conformities/ Sun, 09 Aug 2026 10:54:54 GMT Two suppliers can both claim ENS and cover very different things. What the boundary, the category and the audit result actually tell a buying committee. Normativa & GRC Ciberseguridad https://hard2bit.com/en/blog/who-needs-ens-spanish-public-sector-suppliers-scope/ https://hard2bit.com/en/blog/who-needs-ens-spanish-public-sector-suppliers-scope/ Sun, 09 Aug 2026 10:54:54 GMT The ENS reaches far beyond Spanish public bodies. When a contract, a system and administrative powers line up, private suppliers' systems fall inside it too. Normativa & GRC https://hard2bit.com/en/blog/ens-for-saas-medium-level-scope-certification/ https://hard2bit.com/en/blog/ens-for-saas-medium-level-scope-certification/ Sun, 09 Aug 2026 10:54:54 GMT For a SaaS provider selling to Spanish public bodies, ENS arrives as a tender clause with a deadline. Boundary and category decide the cost. How to get both right. Normativa & GRC Ciberseguridad https://hard2bit.com/en/blog/metabase-zero-day-sqli-bi-data-leak-third-party-risk/ https://hard2bit.com/en/blog/metabase-zero-day-sqli-bi-data-leak-third-party-risk/ Sun, 09 Aug 2026 08:32:55 GMT An unauthenticated CVSS 10.0 flaw in Metabase, exploited since 3 August, handed attackers the credentials for connected databases. What to check, how to detect it and who to notify. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/edr-blind-spots-network-edge-devices-agentless-detection/ https://hard2bit.com/en/blog/edr-blind-spots-network-edge-devices-agentless-detection/ Sun, 09 Aug 2026 07:43:10 GMT Edge devices went from 3% to 22% of exploitation breaches in a year. Why EDR cannot reach firewalls, VPNs and routers, and how to regain visibility without an agent. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/cyber-due-diligence-ma-technology-risk/ https://hard2bit.com/en/blog/cyber-due-diligence-ma-technology-risk/ Sat, 08 Aug 2026 09:41:25 GMT Verizon cut US$350m from the Yahoo price over two breaches; Marriott inherited Starwood's penalty. What to assess, how to price it and how to get it into the agreement. Normativa & GRC Ciberseguridad https://hard2bit.com/en/blog/ai-invents-novel-attacks-offensive-research-defence/ https://hard2bit.com/en/blog/ai-invents-novel-attacks-offensive-research-defence/ Sat, 08 Aug 2026 09:23:10 GMT At Black Hat 2026 an AI system found attack techniques no human had catalogued first. Signature and known-TTP defence now has a much shorter shelf life. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/business-value-cybersecurity-company/ https://hard2bit.com/en/blog/business-value-cybersecurity-company/ Fri, 07 Aug 2026 07:42:22 GMT What does cybersecurity really do for a business? In 2026 it has stopped being an IT cost and become a key to winning contracts, a shield against losses and an engine of trust. Normativa & GRC Ciberseguridad https://hard2bit.com/en/blog/nullreceiver-hidden-c2-blockchain-ethereum-npm/ https://hard2bit.com/en/blog/nullreceiver-hidden-c2-blockchain-ethereum-npm/ Fri, 07 Aug 2026 06:25:14 GMT Two North Korea-linked npm packages resolve their command server by reading a blank Ethereum transfer. NullReceiver defeats domain takedown — here is what changes for defenders. Ciberamenazas Ciberseguridad Investigación https://hard2bit.com/en/blog/deepseek-ai-agent-autonomous-attacks-hermes-agent/ https://hard2bit.com/en/blog/deepseek-ai-agent-autonomous-attacks-hermes-agent/ Thu, 06 Aug 2026 06:56:28 GMT Unit 42 documented an actor who wired DeepSeek into an agent and automated a 460-target exploitation campaign. What it really showed, and how to defend against it. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/npm-worm-keyv-mini-shai-hulud-hooks-claude-code-vscode/ https://hard2bit.com/en/blog/npm-worm-keyv-mini-shai-hulud-hooks-claude-code-vscode/ Wed, 05 Aug 2026 07:54:02 GMT A worm started in keyv@6.0.0 and spread on its own to hundreds of npm packages in half an hour: it steals dev and CI secrets and plants hooks that run when the project opens in Claude Code or VS Code. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/cyber-resilience-act-24-hour-reporting-exploited-vulnerabilities/ https://hard2bit.com/en/blog/cyber-resilience-act-24-hour-reporting-exploited-vulnerabilities/ Tue, 04 Aug 2026 07:11:45 GMT The Cyber Resilience Act switches on its reporting regime on 11 September: 24 hours to flag an exploited vulnerability. It binds product makers, not only NIS2 operators. Normativa & GRC https://hard2bit.com/en/blog/vmware-vcenter-esxi-vmsa-2026-0006-critical-flaws-patch/ https://hard2bit.com/en/blog/vmware-vcenter-esxi-vmsa-2026-0006-critical-flaws-patch/ Mon, 03 Aug 2026 08:47:43 GMT Broadcom patches three critical VMware vCenter and ESXi flaws (CVSS up to 9.8): auth bypass, RCE and a VM escape. What to prioritise, no workaround. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/pink-vishing-passkey-enrolment-hijack-microsoft-365/ https://hard2bit.com/en/blog/pink-vishing-passkey-enrolment-hijack-microsoft-365/ Mon, 03 Aug 2026 07:20:29 GMT The Pink campaign phones employees posing as IT support, walks them through a fake passkey page and registers its own credential in the real Microsoft 365 account. What breaks and how to close it. Ciberamenazas Ciberseguridad https://hard2bit.com/en/blog/ai-act-article-50-ai-transparency-chatbots-deepfakes/ https://hard2bit.com/en/blog/ai-act-article-50-ai-transparency-chatbots-deepfakes/ Fri, 31 Jul 2026 06:47:26 GMT On 2 August 2026 Article 50 of the EU AI Act starts to apply. It is not only about big tech: if you run a chatbot or publish AI-generated content, the transparency duty is yours too. Normativa & GRC Noticias IT https://hard2bit.com/en/blog/salesforce-oauth-abuse-shinyhunters-connected-apps/ https://hard2bit.com/en/blog/salesforce-oauth-abuse-shinyhunters-connected-apps/ Thu, 30 Jul 2026 15:50:42 GMT Microsoft maps a year of ShinyHunters attacks on Salesforce: no platform exploit, just OAuth abuse, connected apps and stolen vendor tokens. What to review in your SaaS. Ciberamenazas Ciberseguridad