Si das clase igual para un alumno que para 20, algo te estás perdiendo. 😓

Critical UniFi OS bug lets hackers gain root without authentication bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…

Concierto, concierto, no es el mejor. El audio es lamentable. Pero como fiesta, fiesta, es la leche !! 👏🏻👏🏻 #badbunnytour

"El eje de evaluación que faltaba"...es tener en cuenta a los propios estudiantes. Suena de perogrullo pero constituye la base de uno de los estudios más reveladores en cuanto IA educativa de esta semana, en el que se analizó a 10.000 estudiantes durante dos cursos. Una de sus conclusiones clave, que no la única, es que los tutores IA requieren de una evaluación doble paa ser más efectivos, esto es, que no se quede solo en la dimensión pedagógica sino que incluya la conductual: si el estudiante usa realmente ese feedback (RealScore) y lo aplica luego correctamente (SuccScore). Link: arxiv.org/abs/2605.05648

Why even go to college anymore

¿Tus estudiantes copian con IA en los exámenes? Repensando la evaluación. Comparto algunos trucos y recursos. iaenlasaulas.blogspot.com/20…

¿Estás preocupado porque tus estudiantes copian con IA? Comparto una guía práctica para surfear este tsunami.

Vulnerabilidad crítica de SandboxJS permite tomar el control del host Se ha descubierto una falla de seguridad crítica en SandboxJS , una biblioteca de aislamiento de JavaScript muy utilizada en npm CVE-2026-43898, puntuación de gravedad máxima de 10.0 blog.elhacker.net/2026/05/vu…

🚨 WARNING: A malicious Hugging Face repository impersonating #OpenAI’s Privacy Filter model reached #1 trending with about 244,000 downloads in 18 hours while delivering a Rust-based infostealer to Windows users. Read: thehackernews.com/2026/05/fa…

‼️🚨 One of the world's largest Certificate Authorities, DigiCert, was compromised by a malicious screensaver file sent through a customer support chat. Their antivirus blocked the malware four times. The agent kept clicking. The fifth try got through. 27 code signing certificates were stolen and used to sign malware. DigiCert ultimately revoked 60 certificates. Per DigiCert's incident report, filed in Mozilla's CA compliance tracker as Bug 2033170, here is how it unfolded: April 2: an attacker contacted a DigiCert helpdesk agent through the company's customer support chat channel, posing as a customer. The lure was a zip file pitched as a screenshot. Inside the zip was a .scr file. On Windows, .scr files are executables, and this one carried a malicious payload. Opening a file a customer sent through the official support channel is what an agent is supposed to do. Support staff are the one role designed to accept files from strangers. DigiCert's endpoint security blocked four infection attempts. On the fifth, the support analyst's machine was infected. DigiCert detected the infection, ran an investigation, and concluded the incident was contained. Eleven days later, an external researcher tipped DigiCert off about misuse of DigiCert-issued code signing certificates in the wild. That tip led to the discovery of a second compromised machine, belonging to a different support analyst, infected through the same vector. The EDR on that machine had not been functioning correctly, so the original investigation missed it. The second machine gave the attacker access to DigiCert's internal support portal. That portal lets support staff reach limited views of customer accounts, including initialization codes for ordered but not-yet-issued code signing certificates. Combining a stolen initialization code with an approved order let the attacker pull a real, validly issued code signing certificate. They did this 27 times. DigiCert's own list of what went wrong: - File-type filtering on the customer support chat channel did not catch the .scr - EDR coverage was inconsistent and incomplete, creating a blind spot - Initialization codes for code signing certificates were not adequately protected DigiCert says it got lucky. An outside researcher found the malware abuse before DigiCert did. Without that tip, the second machine and the active certificate theft might still be running today.

Ubuntu 26.04 is hacked in ~12 hours after it was released. Security in the Age of AI?

#proyectosalvación es una delicia. Emotiva, divertida, entretenida y espectacular en pantalla grande. Gracias !! 👏🏻👏🏻

#proyectosalvación es una delicia. Emotiva, divertida, entretenida y espectacular en pantalla grande. Gracias !! 👏🏻👏🏻

🚨BREAKING: WEBSITES CAN NOW DETECT IF YOU'RE AN AI AGENT AND SERVE YOU COMPLETELY DIFFERENT CONTENT. Google DeepMind's paper on AI Agent Traps describes a technique called Dynamic Cloaking. Here's how it works: a web server runs fingerprinting scripts that analyze browser attributes, automation artifacts, IP addresses, and behavioral patterns. If it determines the visitor is an LLM-powered agent rather than a human, it serves a visually identical but semantically different page. The human sees a normal website. The agent sees a trap. These cloaked pages can embed indirect prompt-injection payloads - instructions that tell the agent to exfiltrate environment variables, misuse its tools, or override its safety guidelines. The attack is invisible to human oversight because the human literally never sees the malicious content. This is a direct evolution of techniques originally developed to evade security scanners. Cloaking has existed in web security for years - showing benign content to bots while reserving malicious payloads for real users. Now the target has flipped. The "bot" is the victim, and the attack is specifically calibrated to exploit how AI agents parse and act on information. Dynamic Cloaking is just one of dozens of techniques the paper covers - from memory poisoning to multi-agent systemic attacks to exploiting human overseers. But this one felt most immediate. Any AI agent browsing the web is potentially navigating a minefield of content specifically designed to manipulate it, content that its human operators will never see.

I'm tired of OpenClaw Every 2-3 days I have a major moment which I show to my friends: "look what AI agents can do", but then the other 90% is pure frustration and me cursing at my own AI agent for which I spent hours choosing a beautiful name and profile picture. I was fun at start: I added telegram, added voice input, then adding skills even with just voice prompting was a bliss. Then dementia hit. Facts from 48 hours ago were forgotten. I installed a 3 level memory system. It felt like a huge hack, it barely works, I encounter bugs every day which I'm fixing. Then it breaks with every update. Not all of it, but little things. The WhatsApp integration is just insanity. After putting in every markdown file that it shouldn't reply to my friends (IN CAPITAL LETTERS) it happily started to chat with my wife and my goddaughter. And from today even claude subscription stops working. I feel like a failure! I see all the success stories left and right, YT vids and blog posts "I got it to work and here's what the AI agent does for me", and for me I'm still spending 5x the time fixing my agent than just doing the stuff by hand 🤷

The Drift postmortem is out and I wouldn't believe this if it was a movie. A fake token, a weaponized Solana feature, proxy spies at conferences, malware through IDE vulnerabilities, Circle sleeping through it, and $285M gone in 12 minutes. Let me break down each part. Six months of in-person relationship building. The attackers posed as a quant trading firm, met Drift contributors face-to-face at multiple crypto conferences across countries. Technically fluent, verifiable professional backgrounds, deposited $1M of their own money. They weren't strangers - they were colleagues the team had worked with for half a year. The people at the conferences weren't North Korean. DPRK uses third-party proxies with fully constructed identities - employment histories, credentials, professional networks built over months to withstand scrutiny. After the exploit, their Telegram chats were completely scrubbed. Malware through developer tools. One contributor was compromised after cloning a code repository shared by the group. A known VSCode and Cursor vulnerability meant simply opening a file could silently execute arbitrary code - no prompt, no warning, no permission dialog. A second contributor was induced to download a TestFlight app the group presented as their wallet product. A fake token created from scratch. 10 ETH withdrawn from Tornado Cash funded deployment of CarbonVote Token - a completely fictitious asset with seeded liquidity and wash trading. Drift's oracles treated it as legitimate collateral worth hundreds of millions. A legitimate Solana feature turned into a weapon. "Durable nonces" let you pre-sign transactions that execute later without expiring. The attackers tricked 2 of 5 multisig signers into pre-signing what looked like routine transactions. Those signatures sat dormant for weeks until April 1. Execution: 12 minutes. Pre-signed transactions seized Security Council powers, performed a zero-timelock migration that eliminated the protocol's last line of defense, drained $285M. Then Circle watched. Millions in USDC were swapped from Solana to Ethereum via CCTP for hours during US business hours. Circle has freeze authority. They didn't use it. ZachXBT: "Circle was asleep while many millions of USDC were swapped from the 9-figure Drift hack." Attribution: the same North Korean group (UNC4736) behind the Radiant Capital hack. On-chain fund flows trace back to the same wallets. DPRK has now extracted $6.75B from crypto - more than most VC funds have ever deployed. Cold wallets. Multisig. Timelocks. Stablecoin freeze authority. None of it mattered. The vulnerability wasn't the code. It was six months of trust.

Corea del Norte creó una empresa de trading falsa. Con esta empresa participaron en conferencias donde conocieron a las víctimas. Mantuvieron reuniones en persona y sesiones de trabajo con Drift Protocol. Intercambiaron mensajes por Telegram durante meses. Los norcoreanos incluso llegaron a depositar 1 millón de dólares propios para que todo pareciera un negocio legítimo. Después de seis meses de conversaciones les hicieron clonar un repositorio y abrir un archivo que, por una vulnerabilidad en VS Code/Cursor, ejecutaba código malicioso de forma silenciosa. En cuanto se activó el exploit lograron robar 280 millones de dólares. Inmediatamente borraron todos los rastros. Desaparecieron los mensajes de Telegram y cualquier huella de malware. No quedó evidencia. Seis meses de infiltración y construcción de confianza. Ingeniería social en su máxima expresión.

🛡️ Akira: ransomware que puede paralizar empresas en menos de una hora El grupo Akira ha reducido su tiempo de ataque al punto de comprometer una empresa y cifrar información crítica en menos de una hora. Para un negocio, eso significa una ventana mínima para detectar, contener y responder. El impacto puede alcanzar operación, ventas, cobranza, atención a clientes y continuidad del servicio. ⚠️ ¿Qué pasó? Investigadores de Halcyon encontraron que Akira ha perfeccionado su operación para entrar rápido, robar datos y cifrar archivos en muy poco tiempo. El grupo ha aprovechado VPN sin MFA, es decir, accesos remotos sin doble verificación, además de fallas sin corregir y accesos comprados a terceros. También aplica exfiltración, que es sacar información antes del cifrad. Y lo hacen para aplicar doble extorsión: cobrar por recuperar archivos y además amenazar con publicar los datos robados. Halcyon también detectó que Akira desarrolla desencriptadores funcionales, herramientas para recuperar archivos, porque eso aumenta la probabilidad de pago. 💡 ¿Qué lecciones deja este caso? Pidan a TI activar MFA en VPN, correo y cuentas administrativas. Revisen hoy parches pendientes en respaldos, firewalls y accesos remotos. Mantengan respaldos fuera de la red principal y prueben restauración real. Limiten privilegios de acceso por puesto y función. Capaciten al personal para reportar alertas, bloqueos o accesos inusuales de inmediato.

Peter es un grande, pero su afirmación planteada en el post sugiere que el notable incremento en reportes de seguridad remitidos a la lista del kernel Linux —de 2-3 por semana hace dos años, pasando por aproximadamente 10 semanales hasta alcanzar 5-10 diarios en la actualidad— podría poner en riesgo la sostenibilidad de ciertos proyectos de software de código abierto. Sin embargo, un examen técnico riguroso de los datos disponibles indica lo contrario: este fenómeno representa un avance estructural en la capacidad de auditoría de vulnerabilidades, que fortalece la resiliencia del ecosistema en lugar de debilitarlo. En primer lugar, es esencial distinguir la fase inicial de ruido —denominada “AI slop” en 2024-2025— de la realidad observada desde inicios de 2026. Willy Tarreau, mantenedor clave del kernel, documentó en LWN.net que “la mayoría de estos reportes son correctos”, hasta el punto de requerir la incorporación de más colaboradores para su gestión. Greg Kroah-Hartman, responsable de la rama estable del kernel, ha confirmado públicamente este cambio de paradigma: “Algo ocurrió hace un mes y el panorama cambió. Ahora recibimos reportes reales”. Estos no son artefactos alucinatorios, sino hallazgos verificables que derivan de modelos de lenguaje avanzados aplicados sistemáticamente a codebases complejas. El resultado neto es una auditoría colectiva a escala industrial que humanos solos no podrían replicar con la misma exhaustividad. Este patrón no es inédito. Herramientas previas de análisis automático —fuzzers como syzkaller, analizadores estáticos como Coverity o sanitizadores como ASan— generaron oleadas similares de reportes en su momento. En cada caso, el volumen inicial se tradujo en código más robusto, reducción de CVEs críticos y una mejora mensurable en la calidad. La inteligencia artificial representa únicamente la versión escalada y accesible de ese mismo proceso, democratizando la detección de defectos que antes permanecían latentes en proyectos mantenidos por voluntarios. En segundo lugar, el cuello de botella se ha desplazado de manera previsible: ya no radica en la identificación de problemas (hoy prácticamente commodity), sino en el triaje y remediación. Esta transición, lejos de ser letal, es un síntoma de éxito. La industria ha respondido con recursos concretos. En marzo de 2026, la Linux Foundation anunció una asignación de 12,5 millones de dólares procedentes de Anthropic, AWS, Google, Microsoft, OpenAI y otros, gestionados por Alpha-Omega y OpenSSF, destinados precisamente al desarrollo de herramientas de triage, formación y soporte para maintainers ante el flujo de reportes generados por IA. Paralelamente, el propio kernel cuenta ya con revisores automáticos (como Sashiko, de Google) que detectan defectos que revisores humanos pasan por alto. Proyectos que eventualmente no logren adaptarse a esta nueva dinámica de seguridad no sucumbirán por causa de la IA, sino porque ya operaban en un modelo de sostenibilidad frágil. El ecosistema de código abierto siempre ha dependido de la escasez de atención humana; la inteligencia artificial expone esa limitación histórica y, al mismo tiempo, ofrece los medios para superarla: más ojos, más parches verificables y una mayor profesionalización. En síntesis, el incremento observado no augura la extinción de proyectos abiertos, sino su evolución hacia un estándar de seguridad más riguroso y sostenible. Lejos de constituir una amenaza existencial, constituye una oportunidad técnica de primer orden: mayor detección de vulnerabilidades reales, menor superficie de ataque y una distribución más equilibrada de la carga de mantenimiento. El open source no se extingue; se refina. No me va a responder en la vida, pero un saludo, crack.

Your Netflix "4K" stream and a 4K disc put the same number of pixels on your screen. But the disc version of a two-hour movie is about 70 gigabytes. The stream is about 14. Same pixels, roughly five times less data filling them. You see it first in dark scenes. The stream doesn't have enough data to tell dark grey from black, so your TV just mashes it all into chunky blocks. Then you notice sunsets looking like a paint-by-numbers, with visible stripes where smooth color should be. Film grain is probably the biggest casualty. Directors add that slightly textured look on purpose to make movies feel cinematic. Streaming compression reads it as noise and wipes it. That's where the weirdly plastic, waxy look on a good OLED comes from. One comparison I can't stop thinking about. A regular 1080p Blu-ray (the older HD format, not even 4K) pushes about 40 megabits of data per second to fill 2 million pixels. A 4K stream pushes 15-25 to fill 8 million pixels. Four times the pixels. Less data. A plain HD disc from 2008 can look sharper than a brand new 4K stream. Sound is worse. Netflix sends "Dolby Atmos" audio at about 768 kilobits per second, compressed, with parts of the original permanently deleted. A disc sends TrueHD Atmos at up to 18,000, lossless, nothing removed. Up to 23x more sound data. If dialogue sounds flat when you're streaming, that's not your speakers. Netflix is getting better at this. As of late 2025, 30% of their streaming runs on a newer compression method called AV1, the same picture at a third less data. They also strip film grain out before compressing, then rebuild it on your TV during playback. Saves over a third on file size for most content, and up to two-thirds for really grainy movies. The rebuilt grain looks solid. The tradeoff won't go away, though. Netflix has to deliver a file that works over spotty rural Wi-Fi and gigabit fiber, adjusting quality frame by frame to whatever your connection can handle. A disc reads plastic. Same quality every time.