Ciberseguridad
ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Actualizado hace 1 min
Noticias de ciberseguridad del 23 de octubre de 2026
Resumen de 152 notas de ciberseguridad publicadas el 23 de octubre de 2026. Los temas con más cobertura: vulnerabilidades (58), ciberataques y apt (38), exploits y poc (22).
152 notas en castellano e inglés. Quitar filtros
VulnerabilidadesExploits y PoC
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to…
Filtraciones de datosRansomware
Filtración de PwC: Everest dice haber robado 590 GB de datos
El grupo de ransomware Everest afirma haber robado 590,69 GB de datos de la firma global de servicios profesionales PwC. La presunta filtración incluiría documentos internos, materiales de capacitación y registros de recursos humanos. Hasta el momento, estas afirmaciones no han…
Ciberseguridad
CoinDCX niega hackeo de 16M mientras sonda señala 40 wallets
Capcom data breach exposes 11.7 million account records
Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in…
VulnerabilidadesExploits y PoC
The ‘Mythos moment’ has already passed. Now comes the hard part for cybersecurity
When Anthropic introduced Claude Mythos Preview, the cybersecurity debate quickly turned to what AI could do: uncover decades-old vulnerabilities, develop working exploits and accelerate tasks that once required specialist expertise. Anthropic noted that Mythos discovered…
Vulnerabilidad crítica de Cisco Expressway permite ejecución remota de código
Cisco ha lanzado actualizaciones de seguridad para corregir una vulnerabilidad crítica en Cisco Expressway (CVE-2026-76466). Este fallo, que tiene una puntuación CVSS de 9.8, podría permitir que atacantes remotos ejecuten comandos del sistema operativo con privilegios de root en…
IA y seguridadVulnerabilidades
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August…
Filtraciones de datosCiberataques y APT
11 Million Impacted by Capcom Data Breach
The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts.
Filtraciones de datosNormativa y privacidad
Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’
In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders.
The AI notetaker risk is now an everywhere problem
The businesspeople adopting AI notetakers are not being reckless. They are responding to a real business need. Our teams are in meetings all day with companies we support, and the idea that we could read a clean summary of every one of them at the end of the day makes us better…
Ciberataques y APTIA y seguridad
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction set this summer through a honeypot posing as an…
Ciberataques y APTHerramientas e investigación
LiteLLM Compromised in Fresh Supply Chain Attack
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.
Ciberseguridad
Múltiples actualizaciones en productos de Fortinet
Múltiples actualizaciones en productos de Fortinet Vie, 23/10/2026 - 10:02 Aviso Recursos Afectados FortiOS: 8.0.0–8.0.1; 7.6.0–7.6.7; 7.4.0–7.4.12; 7.2.0–7.2.13.FortiManager y FortiAnalyzer: 8.0.0–8.0.1; 7.6.0–7.6.7; 7.4.0–7.4.11; 7.2.0–7.2.12.FortiMail: 8.0.0–8.0.1;…
Impacto de vulnerabilidades críticas de PHP en productos de QNAP
Impacto de vulnerabilidades críticas de PHP en productos de QNAP Vie, 23/10/2026 - 10:02 Aviso Recursos Afectados QTS 6.1.0; QTS 5.2.11 y anteriores.QuTS hero h6.1.0; h6.0.x; h5.2.11 y anteriores.QuTScloud c5.2.9 y anteriores.QuMagie 2.10.1 y anteriores.Note Station 3 3.9.14 y…
Impacto de vulnerabilidades críticas de PHP en productos de Tenable
Impacto de vulnerabilidades críticas de PHP en productos de Tenable Vie, 23/10/2026 - 10:02 Aviso Recursos Afectados Tenable Security Center, versiones 6.9.1 y anteriores.Tenable Enclave Security, versiones 1.9.1 y anteriores. Descripción [AVISO PRELIMINAR]Tenable ha publicado…
Impacto de vulnerabilidades críticas de PHP en productos de Mitel
Impacto de vulnerabilidades críticas de PHP en productos de Mitel Vie, 23/10/2026 - 10:02 Aviso Recursos Afectados MiVoice 5000, versiones R8.4 y anteriores.OpenScape Branch, versiones V11R3.4.3 y anteriores.OpenScape SBC, versiones V11R3.4.3 y anteriores.OpenScape Voice Trace…