News on TeraLevel

NIS2 and DORA: the path from regulation to operational maturity

info@teralevel.com (TeraLevel) — Thu, 19 Feb 2026 10:00:00 +0000

European regulation does not introduce the risk, but it requires organisations to prove they can manage it.

In the previous articles of this series, we analysed the global landscape through the Global Cybersecurity Outlook 2026 and the Spanish 2025 INCIBE report. Both confirmed the same trend: cyber risk is already systemic and operational.

With NIS2 and DORA, that diagnosis becomes a concrete requirement: organisations must demonstrate real capability to manage, respond to and recover from incidents.

Cyber resilience in Spain: from global risk to operational reality

info@teralevel.com (TeraLevel) — Tue, 10 Feb 2026 10:00:00 +0000

If the World Economic Forum described systemic cyber risk at a global level, Spain’s data shows that this risk is already operational.

In our previous article, we examined the international context based on the Global Cybersecurity Outlook 2026. The 2025 Cybersecurity Balance published by INCIBE confirms that these trends are now visible at the national level.

In 2025, INCIBE managed 122,223 cybersecurity incidents, a 26% increase compared to 2024, and identified 237,028 vulnerable systems. The scale is no longer marginal — it is structural.

Cyber resilience in 2026: from technical risk to systemic risk

info@teralevel.com (TeraLevel) — Fri, 30 Jan 2026 10:00:00 +0000

Cybersecurity is no longer a purely technical issue — it has become a systemic risk.

The Global Cybersecurity Outlook 2026, published by the World Economic Forum, outlines a landscape in which cyber incidents no longer affect individual organizations in isolation. Instead, they propagate across entire ecosystems: supply chains, critical infrastructures, and essential services. The combined effects of artificial intelligence, geopolitical fragmentation, and growing reliance on cloud platforms are amplifying the impact of every failure.

SRE and cloud architecture: designing reliability from the ground up

info@teralevel.com (TeraLevel) — Tue, 20 Jan 2026 10:00:00 +0000

Reliability is not added at the end of a project: it is decided in the architecture.

At TeraLevel, we have approached Site Reliability Engineering from three complementary perspectives. We first explored its conceptual foundations in 7 principles of Site Reliability Engineering (SRE). We then examined how those principles can be applied consistently in real production environments in Applying SRE in production: effective practices, common pitfalls, and key metrics. This article completes the series by addressing the third essential dimension: how architecture ultimately determines whether SRE can be sustained in cloud and hybrid environments.

Applying SRE in production: effective practices, common pitfalls, and key metrics

info@teralevel.com (TeraLevel) — Tue, 30 Dec 2025 14:00:00 +0000

Applying SRE principles in practice is where their effectiveness in production is truly determined.

At TeraLevel, we previously published 7 principles of Site Reliability Engineering (SRE), where we reviewed the foundations of Site Reliability Engineering based on IBM’s perspective on SRE. That article focused on the conceptual baseline—the “what” of reliability in production. This piece addresses the “how”: applying those principles consistently in real-world environments, drawing on operational experience and on the guidance IBM provides in its analysis of SRE principles.

2025 Report The cybersecurity paradox: More tools same risks

info@teralevel.com (TeraLevel) — Thu, 18 Dec 2025 18:00:00 +0000

The Myth of “More is Better” in Cybersecurity

The recent State of Pentesting 2025 report has put numbers to an uncomfortable reality for many tech leaders: accumulating security software does not guarantee immunity. According to survey data, 67% of US enterprises experienced a security breach in the past 24 months, even though budgets and tools continue to grow.

The data reveals a worrying correlation between complexity and responsiveness:

Tool Saturation: The average number of security tools in an enterprise is 75 distinct solutions , and in large corporations, this number keeps growing.
Alert Fatigue: Organizations with over 100 tools face an average of 3,074 weekly alerts. This volume of noise makes it humanly impossible to prioritize real threats over false positives.
Real Impact: Of those who suffered a breach, 76% reported an impact on data confidentiality or availability, including unplanned downtime and financial loss.

Simplify to Protect: The TeraLevel Approach

At TeraLevel, we believe security shouldn’t be measured by the weight of the tech stack, but by the efficiency of its implementation. The “alert fatigue” described in the report is a classic symptom of a fragmented and reactive infrastructure.

FBI confirms 630 million stolen passwords and its corporate impact

info@teralevel.com (TeraLevel) — Tue, 16 Dec 2025 18:00:00 +0000

A Massive Breach Redefining Access Risk

The recent confirmation by the FBI regarding the seizure of devices belonging to a single hacker has shaken the cybersecurity landscape. As reported by Forbes, 630 million compromised passwords have been recovered and handed over to the “Have I Been Pwned” (HIBP) service for public identification.

What is alarming about this news is not just the volume, but the source and the “freshness” of the data:

Cisco Warns of Critical RCE Vulnerability in React and Next.js

info@teralevel.com (TeraLevel) — Mon, 15 Dec 2025 18:00:00 +0000

Red Alert: “React2Shell” Threatens Web Applications

As reported by Hispasec based on the Cisco advisory, we are facing one of the most severe vulnerabilities of the year: CVE-2025-55182. With a CVSS score of 10.0, this flaw allows Remote Code Execution (RCE) without authentication on servers running modern React and Next.js components.

The situation is critical due to the widespread adoption of these frameworks. It is estimated that up to 40% of cloud environments could be affected. Advanced threat groups are already actively exploiting this flaw (known as “React2Shell”) to compromise infrastructures, leveraging insecure deserialization in the React Server Components Flight protocol.

Npm Malware Uses Prompt Injection to Bypass Cybersecurity AIs

info@teralevel.com (TeraLevel) — Mon, 15 Dec 2025 18:00:00 +0000

A Twist in Supply Chain Security

As reported by Hispasec, Koi Security has revealed a worrying evolution in software supply chain attacks. A malicious package has been detected in the npm registry, named eslint-plugin-unicorn-ts-2, introducing a novel evasion technique: hidden instructions designed to manipulate Artificial Intelligence-based security scanners.

Unlike traditional code obfuscation methods, this malware includes blocks of inert text with specific instructions for Large Language Models (LLMs). Through “Prompt Injection” techniques, the code asks the security AI to ignore the malicious content and flag it as benign, attempting to override the judgment of modern automated defense tools.

OWASP Releases Top 10 risks for Agentic AI Security

info@teralevel.com (TeraLevel) — Mon, 15 Dec 2025 18:00:00 +0000

When AI Moves from “Speaking” to “Acting”: New Security Challenges

The global cybersecurity community has taken a crucial step this week. As reported by PR Newswire, the OWASP GenAI Security Project has officially released the “Top 10 for Agentic Applications.” This document is the result of over a year of research with collaboration from bodies such as NIST and the European Commission.

The distinction is vital: while the LLM Top 10 focused on text response manipulation, this new list addresses the risks of Autonomous Agents (Agentic AI). These systems do not just generate content; they make decisions, use tools, and execute actions within enterprise infrastructure. Risks such as “Agent Behavior Hijacking” or “Tool Misuse” transform AI into an active attack vector within the corporate perimeter.

Shai Hulud V2: The Sophisticated Attack Testing The Security Of GitHub Actions Workflows

info@teralevel.com (TeraLevel) — Tue, 09 Dec 2025 18:00:00 +0000

The “Shai Hulud v2” Attack and the Supply Chain

The “Shai Hulud v2” malware campaign marks a turning point in supply chain attacks, compromising hundreds of packages across the npm and Maven ecosystems. This incident underscores the growing sophistication of threats that directly target development infrastructure.

Its main attack vector is the exploitation of GitHub Actions Workflows, abusing the pull_request_target trigger to inject malicious code into critical repositories. The malware employs a stealthy two-stage infection process: an initial script that installs the Bun runtime, followed by an obfuscated payload that operates without leaving traces in build logs.

The Top 10 AWS re:Invent 2025 Cloud Operations Announcements

info@teralevel.com (TeraLevel) — Tue, 09 Dec 2025 18:00:00 +0000

Key AWS Cloud Operations Innovations

AWS re:Invent 2025 marked a significant leap in Cloud Operations capabilities, focusing on generative AI observability and accelerated incident resolution through Artificial Intelligence (AIOps). These announcements directly address the challenge of managing complexity and the exponential data volume in the modern cloud environment.

The core innovations focus on:

AI Observability: CloudWatch now offers detailed insights into generative AI workloads (latency, token usage) and traceability of agent workflows (Amazon Bedrock, LangChain), requiring no manual instrumentation.
AIOps and Incident Management: CloudWatch Investigations now integrates automated incident report generation and “5 Whys” analysis based on the AWS COE methodology, transforming reactive response into continuous improvement.
Data Centralization: New cross-account and cross-region capabilities were announced to centralize logs (CloudTrail, CloudWatch Logs) and database metrics, simplifying management and reducing ingestion costs.
DevOps Integration: CloudWatch Application Signals added a GitHub Action to embed observability directly into pull requests and CI/CD pipelines, enabling developers to identify performance regressions within their development environment.

These tools aim to increase efficiency, reduce operational complexity, and empower teams to manage complex distributed systems.

OpenVPN Releases Critical Patches Addressing DoS and Security Bypass Vulnerabilities

info@teralevel.com (TeraLevel) — Tue, 09 Dec 2025 00:00:00 +0000

Critical Alert in OpenVPN: DoS and Security Bypass

OpenVPN has issued a critical alert requiring immediate attention from all administrators. The new stable (2.6.17) and development (2.7_rc3) versions fix three significant vulnerabilities that jeopardize the availability and security of VPN connections.

Key Vulnerabilities Include:

CVE ID	Primary Impact	Affected Branches
CVE-2025-13751	Local Denial-of-Service (DoS). Causes complete service crash in Windows environments.	2.6 and 2.7 (rc2)
CVE-2025-13086	Security Bypass in HMAC verification. Allows attackers to open TLS sessions without source IP validation.	2.6 (up to 2.6.15)
CVE-2025-12106	Memory Safety issue (Buffer Over-read) in IPv6 handling.	2.7 branch only (rc1)

The most serious flaw for perimeter security is CVE-2025-13086, which effectively nullifies the HMAC cookie validation during the three-way handshake. This allows malicious actors to bypass the initial check and consume server resources without a legitimate connection. Administrators must immediately migrate to the patched versions to restore service integrity and stability, especially in critical infrastructures that rely on OpenVPN for secure remote access.

Heading to 2026: AI, Green IT, and Cybersecurity in Spanish business

info@teralevel.com (TeraLevel) — Mon, 01 Dec 2025 18:00:00 +0000

The 2026 Horizon: Innovation with Purpose

The recent report “Trends 2026: Technologies that Drive, People who Transform” by Experis, highlighted by Infobae and Europa Press, outlines a scenario where technology ceases to be an end and becomes a strategic means. For Spanish companies, success will no longer depend solely on adopting tools, but on how they are integrated ethically and sustainably.

The study highlights six fundamental pillars that will mark the business roadmap:

International Information Security Day: A collective digital shield

info@teralevel.com (TeraLevel) — Mon, 01 Dec 2025 18:00:00 +0000

The Evolution of Cyber Awareness

Since 1988, following the “Morris Worm” incident, International Information Security Day reminds us that data protection is not optional, but a structural necessity. Cybersecurity has evolved from a technical niche into a pillar of national and corporate security.

Key Highlights of the 2025 Celebration

The Department of National Security (DSN) and entities like CCN-CERT have focused this year on collaboration and preventive culture:

Flagship Event: The XIX STIC CCN-CERT Days (held November 26-28 in Madrid) gathered experts from 42 countries under the motto “A digital shield for an interconnected Spain.”
Available Resources: INCIBE reinforces its support with the 017 helpline and best practice guides for companies and citizens.
Legal Framework: The National Security Strategy identifies technology and infrastructure as strategic assets requiring a multidisciplinary approach.

Entity	Main Role	2025 Objective
DSN	Strategy & Legal Framework	Foster a National Security Culture.
CCN-CERT	Incident Management	Create an interconnected “Digital Shield.”
INCIBE	Awareness & Support	Protection of citizens and the private sector.

From Compliance to Resilience

The news highlights a fundamental concept: the “Digital Shield.” In today’s corporate environment, this shield is not built with firewalls alone, but with intelligent and proactive architecture. The DSN’s call for “collective responsibility” resonates directly with our work philosophy.

7 Principles of Site Reliability Engineering (SRE)

info@teralevel.com (TeraLevel) — Fri, 28 Nov 2025 18:00:00 +0000

Site Reliability Engineering (SRE) is an increasingly critical discipline in the modern DevOps environment. Originated at Google in 2003, this methodology proposes treating operations as if they were software problems. According to a recent article published by IBM, there are seven fundamental principles that guide teams toward operational success.

It is important to highlight that, according to the authors of Google’s SRE guide, between 40% and 90% of the total costs of a system are incurred after its creation. Therefore, SRE focuses on maximizing the utility and stability of the product throughout its lifespan.

Cloud and DevOps trends 2025 AI Agents and Platform Engineering

info@teralevel.com (TeraLevel) — Fri, 28 Nov 2025 18:00:00 +0000

The technology landscape is at a turning point where artificial intelligence is moving from conversational to executive, and where enterprises are looking to consolidate their tools in the face of growing complexity. The InfoQ Cloud and DevOps Trends Report 2025 offers a detailed view on which technologies are crossing the chasm into mass adoption and which are emerging as disruptive innovations.

Below, we analyze the key highlights of this report.

Would your business survive a Black Friday cyberattack?

info@teralevel.com (TeraLevel) — Tue, 25 Nov 2025 18:00:00 +0000

Black Friday and Cyber Monday make or break the year for retailers. Sales soar and carts fill, but the same things that drive growth also draw in malefactors. According to a recent analysis by Thales, every click or login is an opportunity for cybercriminals to slip unnoticed into systems full of sensitive data.

If your retail business went offline during Thanksgiving weekend, how long would it take to recover? The loss of trust and money could be devastating.

CNCF retires the Ingress Nginx Controller for Kubernetes

info@teralevel.com (TeraLevel) — Mon, 24 Nov 2025 18:00:00 +0000

The End of an Era for Ingress Nginx

The Cloud Native Computing Foundation (CNCF) has officially announced the retirement of the Ingress Nginx Controller for Kubernetes. The deadline is set for March 2026. After this date, the software will no longer receive support, security updates, or bug fixes, meaning any continued use will be at the user’s own risk.

Why the Change?

The decision is driven by several critical factors:

Critical Alert: RCE Vulnerability in Fortinet FortiWeb

info@teralevel.com (TeraLevel) — Tue, 18 Nov 2025 18:00:00 +0000

The Gatekeeper Compromised

Fortinet has released a high-priority security advisory regarding its Web Application Firewall (WAF) solution, FortiWeb. A critical vulnerability (identified as CVE-2025-64446) has been discovered that could allow an attacker to take full control of the device without needing a username or password.

The flaw is described as a Relative Path Traversal. By sending specifically crafted HTTP or HTTPS requests, a cybercriminal can bypass web directory restrictions and execute arbitrary commands on the underlying operating system with administrator privileges.

Active exploitation of two critical Windows vulnerabilities: One is a Multi-Year Zero-Day

info@teralevel.com (TeraLevel) — Sat, 01 Nov 2025 18:00:00 +0000

Security researchers have issued a critical alert regarding the active and widespread exploitation of two serious Windows vulnerabilities. Most worryingly, one of them is a zero-day (a flaw unknown to the vendor) that, according to investigations, has been used by attackers since 2017, and remains unpatched by Microsoft.

The attacks are targeting a wide range of users and organizations, suggesting a coordinated, large-scale operation.

1. The Shortcut Zero-Day (`.lnk`) - CVE-2025-9491

This flaw, now tracked as CVE-2025-9491, resides in the binary format of Windows Shortcuts (.lnk), the component that enables fast access to applications or files.

More than 86,000 downloads of malicious packages on NPM

info@teralevel.com (TeraLevel) — Thu, 30 Oct 2025 18:00:00 +0000

Critical Vulnerability: The Dark Side of Code Dependencies

The modern development ecosystem, built on the use of repositories like NPM (Node Package Manager), relies on trust and efficiency. However, a recent report from the security firm Koi has sounded the alarm, revealing a massive cyberattack campaign, tracked as PhantomRaven, that has successfully compromised over 126 malicious packages. These packages have been downloaded more than 86,000 times since August, largely flying under the radar.

New Nation-State Attacks: Hackers distribute invisible malware from Blockchains

info@teralevel.com (TeraLevel) — Fri, 17 Oct 2025 18:00:00 +0000

Malware Moves to the Blockchain: Introducing the EtherHiding Technique

Google Threat Intelligence researchers have identified a concerning evolution in the threat landscape: hacker groups linked to nation-states (including the North Korean group UNC5342) are using public cryptocurrency blockchains like Ethereum and BNB Smart Chain to host and distribute malware.

This technique, dubbed EtherHiding, represents the “next-generation of bulletproof hosting,” offering attackers cheap and impossible-to-remove infrastructure.

What Makes the Blockchain “Bulletproof”?

Traditionally, bulletproof hosting was located in countries without extradition treaties. EtherHiding leverages the fundamental properties of blockchain technology to achieve the same goal:

Report: Full-Stack observability cuts downtime costs

info@teralevel.com (TeraLevel) — Wed, 08 Oct 2025 18:00:00 +0000

The Sobering Cost of Downtime

The numbers are stark. A new global survey from New Relic pegs the median cost of a high-impact IT outage at $2 million per hour (roughly $33,333 a minute), with a median annual hit of $76 million. This operational risk lands just as enterprises are layering in agentic and LLM-powered services, adding speed and complexity to already distributed stacks.

The Full-Stack Advantage

One lever stands out: full-stack observability. Defined as visibility spanning infrastructure, applications, security, digital experience (DEM), and logs, it offers tangible benefits:

GitHub secures npm after 'Shai-Hulud' attack

info@teralevel.com (TeraLevel) — Sat, 27 Sep 2025 18:00:00 +0000

The Attack That Changed Everything

The npm registry recently weathered one of its most sophisticated attacks. On September 14, 2025, the Shai-Hulud worm infiltrated the JavaScript ecosystem by compromising maintainer accounts. Unlike typical malware, this worm was self-replicating, using post-install scripts to turn trusted packages into attack vectors. GitHub moved quickly to remove over 500 packages, but the damage highlighted a harsh reality: current authentication methods are insufficient.

A New Security Roadmap

GitHub has announced immediate and drastic changes to secure the supply chain:

New Cryptojacking campaign exploits DevOps Tools

info@teralevel.com (TeraLevel) — Thu, 04 Sep 2025 18:00:00 +0000

Targeting the Heart of Development

Security researchers at Wiz have uncovered a widespread attack dubbed JINX-0132, representing a calculated shift in how threat actors target development environments. Unlike traditional attacks on end-users, this operation specifically targets the core technologies of DevOps workflows: HashiCorp Nomad, Consul, Gitea, and Docker API servers.

The campaign is notable for its stealth. Instead of custom malware, the attackers download legitimate tools (like standard releases of XMRig) directly from public GitHub repositories. By blending in with legitimate traffic and using trusted sources, they operate under the radar of many modern security tools.

News on TeraLevel

NIS2 and DORA: the path from regulation to operational maturity

European regulation does not introduce the risk, but it requires organisations to prove they can manage it.

Cyber resilience in Spain: from global risk to operational reality

If the World Economic Forum described systemic cyber risk at a global level, Spain’s data shows that this risk is already operational.

Cyber resilience in 2026: from technical risk to systemic risk

Cybersecurity is no longer a purely technical issue — it has become a systemic risk.

SRE and cloud architecture: designing reliability from the ground up

Reliability is not added at the end of a project: it is decided in the architecture.

Applying SRE in production: effective practices, common pitfalls, and key metrics

Applying SRE principles in practice is where their effectiveness in production is truly determined.

2025 Report The cybersecurity paradox: More tools same risks

The Myth of “More is Better” in Cybersecurity

Simplify to Protect: The TeraLevel Approach

FBI confirms 630 million stolen passwords and its corporate impact

A Massive Breach Redefining Access Risk

Cisco Warns of Critical RCE Vulnerability in React and Next.js

Red Alert: “React2Shell” Threatens Web Applications

Npm Malware Uses Prompt Injection to Bypass Cybersecurity AIs

A Twist in Supply Chain Security

OWASP Releases Top 10 risks for Agentic AI Security

When AI Moves from “Speaking” to “Acting”: New Security Challenges

Shai Hulud V2: The Sophisticated Attack Testing The Security Of GitHub Actions Workflows

The “Shai Hulud v2” Attack and the Supply Chain

The Top 10 AWS re:Invent 2025 Cloud Operations Announcements

Key AWS Cloud Operations Innovations

OpenVPN Releases Critical Patches Addressing DoS and Security Bypass Vulnerabilities

Critical Alert in OpenVPN: DoS and Security Bypass

Heading to 2026: AI, Green IT, and Cybersecurity in Spanish business

The 2026 Horizon: Innovation with Purpose

International Information Security Day: A collective digital shield

The Evolution of Cyber Awareness

Key Highlights of the 2025 Celebration

From Compliance to Resilience

7 Principles of Site Reliability Engineering (SRE)

Cloud and DevOps trends 2025 AI Agents and Platform Engineering

Would your business survive a Black Friday cyberattack?

CNCF retires the Ingress Nginx Controller for Kubernetes

The End of an Era for Ingress Nginx

Why the Change?

Critical Alert: RCE Vulnerability in Fortinet FortiWeb

The Gatekeeper Compromised

Active exploitation of two critical Windows vulnerabilities: One is a Multi-Year Zero-Day

1. The Shortcut Zero-Day (.lnk) - CVE-2025-9491

More than 86,000 downloads of malicious packages on NPM

Critical Vulnerability: The Dark Side of Code Dependencies

New Nation-State Attacks: Hackers distribute invisible malware from Blockchains

Malware Moves to the Blockchain: Introducing the EtherHiding Technique

What Makes the Blockchain “Bulletproof”?

Report: Full-Stack observability cuts downtime costs

The Sobering Cost of Downtime

The Full-Stack Advantage

GitHub secures npm after 'Shai-Hulud' attack

The Attack That Changed Everything

A New Security Roadmap

New Cryptojacking campaign exploits DevOps Tools

Targeting the Heart of Development

1. The Shortcut Zero-Day (`.lnk`) - CVE-2025-9491