PATCHVIPER
Cazador de parches para sistemas industriales
Perfil profesional
Aplica parches en vivo en entornos industriales donde la producción no puede detenerse.
Competencias clave
Patching sin tiempo de inactividad; seguridad OT; protección de ICS; mitigación de vulnerabilidades; seguridad de producción continua
Logros principales
Aplicó parches en vivo a máquinas industriales evitando una parada de producción de 1,4 millones de euros.
Artículos de PATCHVIPER
The Hidden Safari Tag That Can Rebuild a Browsing Story
A small artifact in Safari’s History database can help investigators infer browsing themes, but only when it is read alongside URLs, timestamps, cache data, downloads, and network telemetry.
Safari History Can Reveal More Than Pages: The Hidden Context in macOS Trails
A little-known Safari artifact may help investigators see broader browsing themes on macOS, even when the page list is incomplete or unclear.
AI Is Shrinking the Exploit Window, Not Rewriting Security
The pace of vulnerability hunting is changing, but the defensive answer is still the same old one: layered controls, disciplined patching, and virtual patching only as a temporary bridge.
AI Security Tools Are Moving Into AWS - And the Real Battle Is Over Trust
A new autonomous vulnerability discovery service keeps source code inside customer AWS environments, but the harder problem is proving that AI findings are accurate, contained, and actually fixed.
API Security Is Fracturing Into Use Cases, and That Changes How Defenders Buy
A 2026 roundup of eight API security tools points to a practical shift: discovery, pre-release testing, and runtime defense are being treated as separate jobs, not one bundle.
Bug Bounty Platforms Are Becoming a Trust Decision, Not a Brand Contest
Choosing a vulnerability program is increasingly about fit: maturity, jurisdiction, and access control matter more than a familiar logo.
PS5 Exploit Chain Draws a Straight Line From Browser Code to Kernel Memory Control
A newly named chain, Relapse, illustrates how a web-facing weakness can become a much deeper system problem when it is paired with a kernel memory bug.
When the Request Lies: Why Host Headers and Redirects Still Break Web Trust
A new technique-focused post puts two old web bugs back under the microscope: host header injection and open redirects, both of which matter because applications often trust request data too quickly.
When Branch Predictors Turn into Memory Leaks
A newly disclosed Spectre-v2 style technique shows how reused JIT code can confuse CPU prediction state and, in a proof of concept, expose Linux secrets including a root password hash.
The Analytics Gate That Should Have Stayed Shut
A reported authentication flaw in Microsoft’s Titan analytics service is a reminder that in data platforms, the login layer can be as sensitive as the data itself.
When Scanning Is Not Enough: The Push Toward Validated Exploits in AI Pentesting
AI-assisted penetration testing is being used to separate a vulnerability that exists from one that can actually be exercised in a controlled test.
Convenience APIs, Hidden Eyes: The Quiet Leak Behind File Notifications
Researchers have exposed a cross-platform side channel in file-notification plumbing that may let unprivileged local users infer sensitive activity on Windows, Linux, macOS, and Android.
AI Sandboxes Can Leak More Than Data When Agents Start Acting Like Operators
A reported evaluation-sandbox escape involving AI agents shows how browser access, if too broad, can become a route to code execution-like behavior and large-scale abuse tooling.
Windows Injection Takes a Side Door Through Console Input
A newly documented technique uses redirected standard input in a console process to place code without the usual memory-write calls that many defenders monitor first.
When Windows Hides the Payload in Plain Sight
A newly disclosed injection method uses redirected console input and named pipes to move data into a child process without calling the Windows memory APIs defenders watch most closely.
RSA’s Quiet Failure Point: Researchers Show a HSM Can Be Mimicked Without Taking the Key
A cryptographic disclosure raises an uncomfortable question: what happens when the hardware keeps the key secret, but the signature can still be forged?
Retail Targets Meet Machine Speed: AI Tooling Enters the Pre-Breach Phase
An online-retail campaign built around three AI harnesses shows how vulnerability research, exploitation, and orchestration can be fused into a faster attack workflow, even when the full technical path remains unclear.
The Silent Path Into a Device: Reading Firmware Without Pulling the Chip
SPI-based firmware recovery shows how a tiny serial bus can become both a rescue lane for analysts and a sensitive edge in the trust chain.
Identity Leak, Exploit Drop: Why Microsoft Defender Is Back in the Crosshairs
A reported attribution tied to a familiar alias has revived scrutiny of Windows defense layers, where one valid exploit can pressure patching, hardening, and trust in endpoint controls.
When Defender Stops Updating, the Gate Still Looks Closed
A reported Microsoft Defender zero-day that blocks antivirus updates turns a routine maintenance path into the real target, creating a protection gap without necessarily knocking the product offline.