Eduardo Cendejas

Doctor en Ciencias Computacionales, Hacker Ético Certificado y Desarrollador (web, escritorio, ios y android )

[European Commission @EU_Commission]

🏷️ AI content is getting labels.

Just like energy ratings or safety certifications help you make informed choices.

From Aug 2026, EU law will require clear labelling on:
🔸deepfakes
🔸AI-generated content
🔸chatbots

[Datacurve @datacurve]

GLM 5.2 is now on DeepSWE as the top open-source model on our leaderboard.

With a pass@1 score of 44% at max effort, GLM 5.2 is indisputable #1 open-source model besting Kimi K2.7 Code by 17%.

[Datacurve @datacurve]

Claude Fable 5 debuts at #1 on DeepSWE.

It outscores the previous best by 3% and sets a new state-of-the-art on our long-horizon coding benchmark.

[The Hacker News @TheHackersNews]

UPDATE 🠖 FortiBleed looks bigger than first reported.

Update: Hudson Rock says FortiBleed targeted 73,932 Fortinet firewall URLs across 194 countries, affecting 21,632 domains.

The bigger risk: exposed FortiGate SSL VPNs may be used as listening posts to capture more credentials and keep the access loop going.

Read the full update: https://t.co/r8VrvtdCie

[Nicolás Schürmann @_nasch_]

🚀 GLM-5.2 acaba de meterse en la conversación grande.

Según Artificial Analysis, GLM-5.2 (max) aparece como el 4º modelo con mayor Intelligence Index, detrás de Claude Fable 5, Claude Opus 4.8 y GPT-5.5; y con un costo por tarea muy inferior al de los modelos top: $0.41 vs $1.07 de GPT-5.5 y $3.25 de Claude Fable 5.

Estamos en un gran momento para trabajar con IA.

https://t.co/UdSICTrfHh

[The Hacker News @TheHackersNews]

OpenAI is adding “LOCKDOWN MODE” to #ChatGPT.

It won’t stop prompt injections.

It’s built to reduce what attackers want next: a way to leak your data out.

The mode limits tools that connect to the web or external services, including browsing, images, deep research, agent mode, and file downloads.

Read ➝ https://t.co/KE86vymkrG

[The Hacker News @TheHackersNews]

🚨 73 Microsoft GitHub repos just went dark.

They were hit by Miasma, a self-replicating supply chain attack spreading through trusted open-source channels.

Azure and MicrosoftDocs repos were among those impacted.

Read this: https://t.co/J1Pyrr4mlR

[Christian Van Der Henst✨ @cvander]

We’ll be safe in Latam from this.

Me imagino al dron enredado en los cables eléctricos, de internet, el teléfono, el ethernet de la cuadra para compartir netflix como un solo household.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[Socket @SocketSecurity]

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.

Newly confirmed compromised artifacts:

@​opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)

mistralai: 2.4.6 on PyPI

guardrails-ai: 0.10.1 on PyPI

additional @​squawk/* packages on npm

guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.​pyz, writes it to /tmp/transformers.​pyz, and runs it with python3 without integrity verification.

The git-tanstack.​com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”

The page also linked to a YouTube video and you can probably guess which one.

[The Hacker News @TheHackersNews]

🚨 WARNING: The self-spreading “Mini Shai-Hulud” worm compromised npm & PyPI packages tied to TanStack, Mistral AI, Guardrails AI, OpenSearch & more.

The attack used GitHub OIDC token hijacking and cache poisoning to spread credential-stealing malware across 42 TanStack packages and 84 versions.

Check your dependencies immediately → https://t.co/33fxlrOPzz

[The Hacker News @TheHackersNews]

🚨 WARNING: A malicious Hugging Face repository impersonating #OpenAI’s Privacy Filter model reached #1 trending with about 244,000 downloads in 18 hours while delivering a Rust-based infostealer to Windows users.

Read: https://t.co/VFuIgbu3EI

[International Cyber Digest @IntCyberDigest]

‼️🚨 Security researcher ggwhyp demonstrated a full-chain Firefox exploit on Windows.

He opens an HTML page, Firefox runs the code, cmd.exe spawns, Calculator opens. Signature of a browser-to-OS exploit.

Prepared for Pwn2Own. ZDI rejected it. According to the researcher, it was responsibly disclosed to Mozilla.

[Supermicro @Supermicro]

Want to see AI Factories in action?
Watch ServeTheHome’s latest video breakdown to see how Supermicro and NVIDIA deliver turnkey AI infrastructure at scale.

[The Hacker News @TheHackersNews]

⚠️ Attackers poisoned Hugging Face & ClawHub (OpenClaw) with 575+ malicious skills from just 13 accounts.

🔸 Fake helpful AI tools that install trojans, miners & stealers (Windows + macOS)
🔸 Use hidden commands & indirect prompt injection

Quick action: Never install random AI skills or models. Always verify the source.

Read: https://t.co/CmdDBXuzTy

[Computer Hoy @computerhoy]

Hackers a la caza de Linux: tras Copy Fail, un nuevo malware se infiltra en npm, PyPI y GitHub para robar credenciales https://t.co/AcRCXlK1rg

[Claude @claudeai]

We’ve agreed to a partnership with @SpaceX that will substantially increase our compute capacity.

This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API.

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[International Cyber Digest @IntCyberDigest]

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

[Eduardo Cendejas @EACC1977]

¿El comienzo de fin dee codigo abierto? https://t.co/qNUrkhb6sc