Actualizado hace 1 min
Noticias de ciberseguridad
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
534 notas en castellano e inglés. Quitar filtros
The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity…
MalwareHerramientas e investigación
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed…
Microsoft, Nvidia push provenance checks as open-weight AI adoption accelerates
Microsoft and Nvidia are urging enterprises to assess the security of open-weight AI models throughout deployment, warning that changes to model weights and configurations can weaken safeguards even when a model retains its ability to perform assigned tasks. In a joint paper…
Ciberseguridad
ConnectWise backup credentials exposed multiple Microsoft 365 tenants
ConnectWise has disabled key cloud services and is investigating unauthorized access to customers’ Microsoft 365 environments after a credential tied to its Cloud Backup platform was compromised and used to authenticate into customer tenants, prompting Huntress to identify…
Ciberseguridad
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it…
Training AIs to Solve CAPTCHAs
Interesting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and…
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and…
Spyware found on devices belonging to prominent Serbian critics as elections loom
The confirmed and suspected targets include a university rector backing Serbia's protests and a prosecutor who investigated a Trump-linked Belgrade development, weeks before parliamentary elections.
Ciberseguridad
Francia actualiza alerta por hackeo a refrigeradores
Ciberseguridad
The password nobody owns: Taking machines to zero standing privilege (ZSP)
Ask your infrastructure lead who owns the service account behind the overnight finance batch and notice how long the answer takes. In many of the environments I’ve reviewed, the engineer who set it up left years ago and the password has been sitting in a vault, or sometimes a…
9 rising malware trends every security pro should know
Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures. Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats. The traditional game of cat and mouse between…
Validación incorrecta del origen en Remote Support de BeyondTrust
Validación incorrecta del origen en Remote Support de BeyondTrust Lun, 19/10/2026 - 09:27 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una vulnerabilidad crítica que podría permitir a un…
DLL sideloading en Siemens Software Center
DLL sideloading en Siemens Software Center Lun, 19/10/2026 - 09:12 Aviso SCI Recursos Afectados Siemens Software Center, versiones anteriores a la 4.0.9.8. Descripción Siemens ha publicado una vulnerabilidad de severidad alta que, si se explota, podría permitir a un atacante…
Ausencia de verificación de integridad en MobaXterm de Mobatek
Ausencia de verificación de integridad en MobaXterm de Mobatek Lun, 19/10/2026 - 09:03 Aviso Recursos Afectados MobaXterm Personal Edition (Portable), versión 26.4 GA, de Mobatek. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad alta que afecta…
VulnerabilidadesHerramientas e investigación
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home…