Actualizado hace 1 min
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
540 notas en castellano e inglés. Quitar filtros
Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures. Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats. The traditional game of cat and mouse between…
Validación incorrecta del origen en Remote Support de BeyondTrust Lun, 19/10/2026 - 09:27 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una vulnerabilidad crítica que podría permitir a un…
DLL sideloading en Siemens Software Center Lun, 19/10/2026 - 09:12 Aviso SCI Recursos Afectados Siemens Software Center, versiones anteriores a la 4.0.9.8. Descripción Siemens ha publicado una vulnerabilidad de severidad alta que, si se explota, podría permitir a un atacante…
Ausencia de verificación de integridad en MobaXterm de Mobatek Lun, 19/10/2026 - 09:03 Aviso Recursos Afectados MobaXterm Personal Edition (Portable), versión 26.4 GA, de Mobatek. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad alta que afecta…
VulnerabilidadesHerramientas e investigación
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home…
Filtraciones de datosIA y seguridad
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI,…
Hoy os dejo una conversación - entrevista entre dos hackers a los que quiero, admiro, con los que he trabajado mucho, y con los que disfruto de hacer siempre cosas. Con ellos he escrito libros, he hecho proyectos, he trabajado en las mismas empresas, he dado charlas, y sobre…
Semperis, la empresa de ciberresiliencia y respuesta ante crisis impulsada por la identidad, ha publicado los resultados de su informe mundial anual sobre ransomware, en el que se destaca que la IA desempeña un papel importante en este tipo de ataques. Además, los…
Ciberseguridad
Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled…
MalwareHerramientas e investigación
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8."…
Ciberataques y APTHerramientas e investigación
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365…
While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests.
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
VulnerabilidadesExploits y PoC
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
IA y seguridadPhishing e ingeniería social
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
Ciberseguridad
The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.
Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.
IA y seguridadInfraestructura crítica
Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.
Exploits y PoCHerramientas e investigación
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif,…
Exploits y PoCFiltraciones de datos
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
