Ciberseguridad
Actualizado hace 1 min
Noticias de ciberseguridad del 20 de octubre de 2026
Resumen de 108 notas de ciberseguridad publicadas el 20 de octubre de 2026. Los temas con más cobertura: vulnerabilidades (26), ciberataques y apt (22), exploits y poc (21).
108 notas en castellano e inglés. Quitar filtros
Ataque WP2Shell permite crear cuentas de administrador e instalar shells en WordPress sin login
WP2Shell es una vulnerabilidad que combina dos fallos del núcleo de WordPress para permitir la ejecución de código en el servidor mediante solicitudes no autenticadas. Esto permite a un atacante crear cuentas de administrador e instalar web shells basadas en plugins. Según el…
Ciberseguridad
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
VulnerabilidadesHerramientas e investigación
KVM escape exposes broader attack surface in Linux networking
Security researchers have found a critical flaw in the Linux kernel’s networking stack that can let attackers escape a KVM virtual machine and execute code on the host system. The weakness could also potentially let attackers compromise systems running other Linux-based…
Ciberseguridad
Hackeo de Drift: 61 millones en ether al mezclador
VulnerabilidadesHerramientas e investigación
CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
CVE-2026-101767 is a critical (CVSS 9.8) unauthenticated SQL injection vulnerability in Oracle E-Business Suite 12.2.3–12.2.15. Horizon3 researchers identified an attack chain enabling remote code execution through the TCF servlet. Learn about affected versions, October 2026…
VulnerabilidadesFiltraciones de datos
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
VulnerabilidadesExploits y PoC
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
California warns all public school students of data stolen in contractor breach
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
Ciberseguridad
Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ
The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.
Ciberseguridad
Vuelta a la normalidad tras el hackeo a Liquid, según Back
23andMe successor settles with California for $6 million over cybersecurity failings
California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did not properly protect customers' data before a 2023 breach.
Ciberseguridad
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages.
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said.
Ciberseguridad
Nigerian national given 8-year sentence for tax business hacks
A Nigerian national who worked with a group to hack tax prep businesses and conduct millions of dollars in fraud using customer data was sentenced this week.