Herramientas e investigaciónFiltraciones de datos
Claude Code filtra miles de contraseñas de GitHub
Claude Code ha filtrado miles de contraseñas de GitHub debido a un fallo en la ejecución de comandos.
Actualizado hace 1 min
Noticias de ciberseguridad del 11 de noviembre de 2026
Resumen de 32 notas de ciberseguridad publicadas el 11 de noviembre de 2026. Los temas con más cobertura: vulnerabilidades (15), exploits y poc (9), ia y seguridad (5).
32 notas en castellano e inglés. Quitar filtros
Obsidian expands AI agent security with runtime policy enforcement
Obsidian Security has announced its Runtime Policy Decision Engine, giving security teams centralized control over AI agent actions before they run. Building on Obsidian’s extensive AI agent discovery and governance coverage, the engine uses context about who is behind an agent,…
Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD
Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.
VulnerabilidadesIA y seguridad
What will it take to make VulnOps a reality?
Just over a year ago, before advanced AI models began discovering software vulnerabilities at a nearly unmanageable scale in the so-called vulnpocalypse, three industry experts pioneered the concept of “VulnOps.” VulnOps, as envisioned by Heather Adkins, Gadi Evron, and Bruce…
VulnerabilidadesExploits y PoC
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53…
VulnerabilidadesExploits y PoC
El Patch Tuesday de noviembre soluciona más de 1.000 fallos pero solo detecta un zero-day hasta ahora
Microsoft lanzó una masiva actualización de seguridad corrigiendo 1,094 errores, destacando una vulnerabilidad de Outlook ya explotada por atacantes. El reporte alerta sobre amenazas críticas de ejecución remota de código sin interacción del usuario en servicios de Exchange y…
VulnerabilidadesExploits y PoC
Recently Patched Barracuda Vulnerabilities Exploited in Attacks
The security defects could allow attackers to bypass authorization and gain root access to devices.
IA y seguridadFiltraciones de datos
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not…
MalwareHerramientas e investigación
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with…
Ciberseguridad
The Cyber Resilience Act clock doesn’t stop for weekends
In this Help Net Security interview, Aurimas Bakas, CEO of Copla, talks about what the EU Cyber Resilience Act‘s reporting duties mean for manufacturers. He explains why companies need a register of every product version still in use, why boards focus on CE marking while…
VulnerabilidadesExploits y PoC
Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms
Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms.
A CISO’s guide to trimming waste from a flat security budget
In this Help Net Security video, Ken Leeser, CISO at Y Meadows, explains how security leaders can get more protection out of a flat budget. He argues a frozen budget gives teams a reason to cut waste and simplify their security stack. The first step is an inventory of every tool…
VulnerabilidadesExploits y PoC
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of…
EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union. Attackers can turn a newly disclosed flaw into a working attack…
Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed
Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery found, and the reason they give is time. Here’s the catch. Among teams that skip full verification, 57% say at…
Ciberseguridad
LaLiga bloquea por error web de Movistar al combatir IPTV
LaLiga intentó frenar las IPTV piratas, pero un fallo en los bloqueos dinámicos provocó la caída del foro oficial de Movistar al compartir direcciones IP.
VulnerabilidadesExploits y PoC
Falla de sandbox en iOS 26 y 27 expone claves privadas — Apple actualizó sin parchearla
Un exploit público permite que apps maliciosas lean archivos de otras aplicaciones, incluyendo credenciales de wallets cripto, en las dos versiones más recientes del sistema operativo de iPhone.
Infraestructura críticaVulnerabilidades
Atacantes fuerzan sistemas de refrigeración industrial a sobrecalentamiento continuo — agencias de EE.UU. alertan sobre sabotaje remoto
Agencias del gobierno estadounidense advierten sobre una campaña global que explota controladores sin parches para alterar configuraciones críticas de cadena de frío.
Exploits y PoCFiltraciones de datos
An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones
Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report. Attacks delivered through ads and compromised websites have reached employees who use phones for work. DarkSword chains together several software…
New malware doesn’t call home, it turns your Exchange server into its home
There’s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders. A new report from global security company ESET describes a “sophisticated, modular, and tightly interconnected” toolset designed to run on compromised Exchange servers for…
Ciberseguridad
Google Fi super network leans on encryption to keep hotspot traffic private
Google Fi now moves customers’ phones onto Wi-Fi hotspots and between two 5G networks without the user going into settings or logging in. Google calls the setup a super network, and it powers all Fi plans on eligible Pixel phones. Wi-Fi Auto Connect+, a Fi feature that now…