Actualizado hace 1 min
Lo último sobre vulnerabilidades en los medios de ciberseguridad en castellano. Clasificamos cada nota automáticamente y la enlazamos a su fuente original.
179 notas en castellano e inglés. Quitar filtros
F5 is once again disclosing cybersecurity flaws in its core offerings. The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These…
IA y seguridadVulnerabilidades
Malware capaz de modificar su propio código para evitar ser detectado, sistemas que encuentran vulnerabilidades en cuestión de minutos o ciberataques que se ejecutan prácticamente solos. Lo que hace apenas unos años parecía propio de una película de terror tecnológico se ha…
Phishing e ingeniería socialVulnerabilidades
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
Exploits y PoCVulnerabilidades
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the…
VulnerabilidadesExploits y PoC
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication…
VulnerabilidadesExploits y PoC
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.The intrusion achieved…
VulnerabilidadesExploits y PoC
OverviewOn October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3, the vulnerability allows…
VulnerabilidadesExploits y PoC
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security…
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
Validación incorrecta del origen en Remote Support de BeyondTrust Lun, 19/10/2026 - 09:27 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una vulnerabilidad crítica que podría permitir a un…
DLL sideloading en Siemens Software Center Lun, 19/10/2026 - 09:12 Aviso SCI Recursos Afectados Siemens Software Center, versiones anteriores a la 4.0.9.8. Descripción Siemens ha publicado una vulnerabilidad de severidad alta que, si se explota, podría permitir a un atacante…
Ausencia de verificación de integridad en MobaXterm de Mobatek Lun, 19/10/2026 - 09:03 Aviso Recursos Afectados MobaXterm Personal Edition (Portable), versión 26.4 GA, de Mobatek. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad alta que afecta…
VulnerabilidadesHerramientas e investigación
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home…
VulnerabilidadesExploits y PoC
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Exploits y PoCHerramientas e investigación
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif,…
IA y seguridadHerramientas e investigación
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these…
IA y seguridadHerramientas e investigación
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it. Researchers at Xbow USA worked for six days on developing the…
VulnerabilidadesCiberataques y APT
OverviewOn October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code…
VulnerabilidadesExploits y PoC
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by…
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade…
The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape attack, in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access the underlying host. Dubbed PwnEscape and tracked as CVE-2026-99999, a flaw…
VulnerabilidadesExploits y PoC
Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral…
Gestión incorrecta de mayúsculas y minúsculas en Wazuh Manager Vie, 16/10/2026 - 09:37 Aviso Recursos Afectados Wazuh Manager, versiones desde la 4.14.3, inclusive, pero anteriores a la 4.14.8. Descripción namd0ng y vikman90 han informado sobre una vulnerabilidad de severidad…
