Vibe Coding Security: 5 Questions to Ask Before Trusting an AI-Built App
Vibe coding has arrived in Spanish businessesSince the term was coined in early 2025, AI-assisted development — often called vibe coding — has spread...
Cybersecurity
Cybersecurity
System protection, vulnerabilities and incident prevention.
CRA Compliance for Mobile Apps: A 2027 Guide for EU Businesses
Why the Cyber Resilience Act changes mobile app developmentFor years, cybersecurity in software was treated as a technical nicety: something you bolte...
Unbound 1.26.1: Critical DNSSEC Flaw and Server Defence
A critical DNS resolver flaw you cannot ignoreIf your infrastructure runs Unbound as a DNS resolver, the release of version 1.26.1 deserves your immed...
Cisco ISE Zero-Day: Why Patch Now and Harden After
A maximum-severity flaw that is already being usedCisco has issued emergency fixes for Identity Services Engine (ISE) and ISE Passive Identity Connect...
WooCommerce Plugin Flaw: Web Shells and Server Defence
A single outdated plugin, a whole server exposedMost WordPress compromises we investigate at ALMC.es do not start with a sophisticated zero-day. They...
OAuth Token Leak: Supply Chain Lessons for Server Security
When a browser extension becomes the weakest linkIn September 2026, security researchers uncovered a supply chain incident involving a popular browser...
Browser Extensions Are a Supply Chain Risk: Lessons from the Twitch OAuth Leak
When a browser add-on becomes the weakest linkBrowser extensions are convenient, but they also run with extensive privileges inside the browser. A rec...
Browser Extension Leaks OAuth Tokens: Lessons for Server Security
When a Browser Extension Becomes a Supply Chain RiskA popular Twitch viewing extension, distributed through the official Chrome and Firefox add-on sto...
Artifactory Under Siege: Lessons for Server Security
When a Repository Becomes a BackdoorIn the summer of 2026, a series of intrusions against self-hosted JFrog Artifactory instances demonstrated how qui...
Supply Chain Phishing: When Your Email Provider Becomes the Attack Vector
The Trezor incident: a wake-up call for third-party riskWhen a hardware wallet manufacturer like Trezor discloses that attackers breached an external...