Actualizado hace 1 min
Noticias de ciberseguridad del 21 de octubre de 2026
Resumen de 159 notas de ciberseguridad publicadas el 21 de octubre de 2026. Los temas con más cobertura: vulnerabilidades (69), ciberataques y apt (29), ia y seguridad (23).
159 notas en castellano e inglés. Quitar filtros
VulnerabilidadesExploits y PoC
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities…
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.
Apache Tomcat corrige 8 fallos de seguridad que permitirían saltar la autenticación
Apache Tomcat ha corregido ocho fallos de seguridad que podrían permitir a los atacantes omitir las verificaciones de contraseñas, exponer datos entre usuarios e interrumpir conexiones. Las correcciones fueron publicadas el 20 de octubre de 2026 en las versiones 11.0.27, 10.1.61…
VulnerabilidadesExploits y PoC
CVE-2026-109618 / CVE-2026-109619 | PHP Core Remote Code Execution Vulnerabilities (PHP2Shell)
PHP2Shell refers to two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution. Explore the out-of-memory corruption and stale global state attack paths, affected PHP versions, exploitation conditions, and…
VulnerabilidadesExploits y PoC
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Ciberseguridad
eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million…
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Ciberataques y APTIA y seguridad
“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
IA y seguridadPhishing e ingeniería social
ClickFix has never been bigger, and AI tools are its most convincing lure yet
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly…
VulnerabilidadesExploits y PoC
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws,…
[Actualización 21/10/2026] Múltiples vulnerabilidades en PHP
[Actualización 21/10/2026] Múltiples vulnerabilidades en PHP Mié, 21/10/2026 - 15:53 Aviso Recursos Afectados Las versiones afectadas de las ramas mantenidas son PHP 8.2.x anterior a 8.2.35, PHP 8.3.x anterior a 8.3.36, PHP 8.4.x anterior a 8.4.27 y PHP 8.5.x anterior a…
NVIDIA unveils security architecture that can stop AI agents crossing set boundaries
NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combining it with hardware for running AI models,…
PHP2Shell: Critical PHP vulnerabilities patched, update now!
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.
VulnerabilidadesHerramientas e investigación
Microsoft paga hasta 40.000$ por reportes completos de vulnerabilidades de Azure
Microsoft ha implementado un nuevo sistema de evaluación en sus programas de recompensas por errores, donde la calidad de la evidencia presentada por los investigadores es determinante para el pago. En el programa de Azure, los informes sobre ejecución remota de código y…