Actualizado hace 1 min
Resumen de 54 notas de ciberseguridad publicadas el 27 de octubre de 2026. Los temas con más cobertura: vulnerabilidades (20), ia y seguridad (11), herramientas e investigación (10).
54 notas en castellano e inglés. Quitar filtros
IA y seguridadVulnerabilidades
Se reportan diversas noticias de seguridad, incluyendo un ataque a la cadena de suministro de LiteLLM y parches críticos de Microsoft. Destaca la denuncia de Cohere sobre el modelo Qwen de Alibaba, que intentó enviar datos a China durante una prueba. Cohere advierte que, sea un…
VulnerabilidadesExploits y PoC
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
Ciberataques y APTFiltraciones de datos
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people. On Monday,…
An Alibaba AI model generated an unexpected command to upload data to a Beijing-region cloud storage service during a cybersecurity evaluation, rival developer Cohere said, raising concerns about the security of AI agents with access to enterprise systems. The model,…
IA y seguridadHerramientas e investigación
Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this…
MalwareHerramientas e investigación
Se detectó un gusano de npm de la familia Miasma que comprometió 42 repositorios de GitHub mediante el robo de credenciales y el uso de cargas útiles diseñadas para evadir escáneres. El malware se propaga automáticamente y utiliza ganchos para asistentes de IA y herramientas de…
Herramientas e investigaciónFiltraciones de datos
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can…
Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses.
VulnerabilidadesExploits y PoC
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
Ciberseguridad
DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can’t get into their email or FTP accounts until someone sets a new password for them. DreamHost is a web hosting provider whose…
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
Carga sin restricciones de archivos en la aplicación PuMuKIT Mar, 27/10/2026 - 14:14 Aviso Recursos Afectados PuMuKIT, versiones anteriores a la 5.0.8. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad alta que afecta a la aplicación de PuMuKIT,…
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
RansomwareHerramientas e investigación
A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in.
Ciberseguridad
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut…
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
CVE-2026-111497 afecta tres líneas de versión activas y se extiende a Python, .NET y componentes de infraestructura cloud — el alcance real supera al ecosistema JavaScript.
Filtraciones de datosVulnerabilidades
Más de 26.000 servidores afectados en Japón, 3.897 registros bancarios filtrados en India y millones de intentos de explotación contra PHP sin actualizar: una semana que expone la fragilidad de la cadena de confianza digital.
