VulnerabilidadesExploits y PoC
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Actualizado hace 1 min
Noticias de ciberseguridad del 16 de octubre de 2026
Resumen de 35 notas de ciberseguridad publicadas el 16 de octubre de 2026. Los temas con más cobertura: vulnerabilidades (15), ia y seguridad (13), herramientas e investigación (7).
35 notas en castellano e inglés. Quitar filtros
Federal agencies recommend cyber controls, independent testing for frontier AI systems
While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests.
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
IA y seguridadPhishing e ingeniería social
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
Ciberseguridad
Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform
The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.
Enterprise AI Enters Risk Management Phase as Security Concerns Rise
Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.
IA y seguridadInfraestructura crítica
AI Takes Control of Robotic Arm in 16 Minutes Flat
Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.
Exploits y PoCHerramientas e investigación
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif,…
Exploits y PoCFiltraciones de datos
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
IA y seguridadHerramientas e investigación
Hallucinated domain in official OpenAI skill underscores AI supply chain risks
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these…
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows…
Phishing e ingeniería socialHerramientas e investigación
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to…
IA y seguridadHerramientas e investigación
Xbow spent $40K on AI and cracked Google Chrome wide open
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it. Researchers at Xbow USA worked for six days on developing the…
Herramientas e investigaciónIA y seguridad
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without…
When Your Ransomware Negotiator Works for the Other Side
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.
VulnerabilidadesCiberataques y APT
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
OverviewOn October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code…
Filtraciones de datosIA y seguridad
When AI Agents Commit Breaches, Humans May Not Be Held Liable
As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.
Bank of America spent millions on anti-money-laundering tech, but not enough to avoid a $1.2B fine
Bank of America has had to spend big on IT in response to an AI security audit and findings that its anti-money-laundering (AML) controls were lacking. The bank was fined a whopping $1.2 billion for money laundering offences this week, after banking authorities identified a lax…
Ciberseguridad
Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation
The National Institute of Standards and Technology (NIST), National Security Agency’s Super Intelligence Security Center (NSA SISC) and Cybersecurity and Infrastructure Security Agency (CISA) published Key Practices for Incident Readiness and Response in Super Intelligence…
Ciberataques y APTPhishing e ingeniería social
Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login…
VulnerabilidadesExploits y PoC
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by…
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade…
Linux kernel gets a fix for a flaw that enabled attackers to escape VMs
The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape attack, in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access the underlying host. Dubbed PwnEscape and tracked as CVE-2026-99999, a flaw…
AI Decision Models and Their Impact on AI SOC Platforms
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public…