Actualizado hace 1 min
Noticias de ciberseguridad del 23 de octubre de 2026
Resumen de 151 notas de ciberseguridad publicadas el 23 de octubre de 2026. Los temas con más cobertura: vulnerabilidades (58), ciberataques y apt (37), exploits y poc (21).
151 notas en castellano e inglés. Quitar filtros
Infostealer riding the AI Train
Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude,…
Quest Diagnostics warns of potential data theft after attack on lab service system
Nationwide lab test company Quest Diagnostics said one of its key systems may have experienced a breach of patient data.
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
VulnerabilidadesExploits y PoC
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious…
Microsoft 365 accounts compromised at 79 organizations, no passwords needed
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July…
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply — not contain — the risk.
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an…
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the…
Ciberseguridad
Compromised TLS Certificates
The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve…
VulnerabilidadesFiltraciones de datos
Filtrados fallos críticos sin parchear del kernel de Linux
En octubre, se revelaron accidentalmente detalles técnicos de varios fallos de seguridad no parcheados de Linux en listas de correo públicas. Según reportes de la Zero Day Initiative de Trend Micro, se identificaron dos vulnerabilidades críticas (CVSS 9.0) que permitirían a un…
Ciberseguridad
eMudhra quits global TLS certificate market after compromise of CA signing keys
Indian digital trust company eMudhra has announced that it is exiting the global SSL/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate…
Herramientas e investigaciónCiberataques y APT
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.
Ciberataques y APTVulnerabilidades
Robot hackeado apuñala a un humano
Un robot humanoide hackeado apuñaló la mano de una persona durante unas pruebas de seguridad con MuTRAP para estudiar vulnerabilidades y desarrollar defensas.
Ciberseguridad
ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.