Actualizado hace 1 min
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
574 notas en castellano e inglés. Quitar filtros
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public…
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights…
VulnerabilidadesExploits y PoC
Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral…
IA y seguridadHerramientas e investigación
Current security procedures for training AI models are inadequate, hundreds of AI researchers have warned governments and the AI community. They are calling for tougher rules and the establishment of a new international body overseeing best practice for AI development. In an…
Gestión incorrecta de mayúsculas y minúsculas en Wazuh Manager Vie, 16/10/2026 - 09:37 Aviso Recursos Afectados Wazuh Manager, versiones desde la 4.14.3, inclusive, pero anteriores a la 4.14.8. Descripción namd0ng y vikman90 han informado sobre una vulnerabilidad de severidad…
Múltiples vulnerabilidades en Next.js de Vercel Vie, 16/10/2026 - 09:37 Aviso Recursos Afectados Las siguientes versiones y configuraciones de Next.js:versiones desde la 16.0.0 hasta la 16.4.0, cuando se utiliza App Router con Cache Components y una función use cache devuelve…
Phishing e ingeniería socialVulnerabilidades
Omisión de autenticación mediante suplantación en Remote Support de BeyondTrust Vie, 16/10/2026 - 09:37 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una vulnerabilidad de severidad…
Múltiples vulnerabilidades en Eclipse Milo de Eclipse Foundation Vie, 16/10/2026 - 09:37 Aviso SCI Recursos Afectados Eclipse Milo, versiones:desde la 0.6.0 hasta la 1.1.4;algunas vulnerabilidades afectan únicamente a las versiones desde la 1.0.0 hasta la 1.1.4. Descripción…
Path traversal en Torrent Suite Software de Thermo Fisher Vie, 16/10/2026 - 09:37 Aviso SCI Recursos Afectados Thermo Fisher Torrent Suite Software, versiones 5.18 y anteriores. Descripción Akanksha Raghvesh y Abhinav Agarwal han informado sobre una vulnerabilidad de severidad…
Múltiples vulnerabilidades en AIG-302 de Moxa Vie, 16/10/2026 - 09:37 Aviso SCI Recursos Afectados Moxa AIG-302 Series, versiones de firmware 1.4.0 y anteriores. Descripción Ievgen Bondarenko ha informado sobre 2 vulnerabilidades: una de severidad alta y una de severidad media…
Inyección SQL en Profleet de TSG Vie, 16/10/2026 - 09:27 Aviso Recursos Afectados TSG Profleet versión 12.004.01. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad crítica, que afecta a Profleet de TSG, proveedor de soluciones para el…
Ciberseguridad
Server-Side Request Forgery en la exportación a PDF de Wegow Vie, 16/10/2026 - 09:25 Aviso Recursos Afectados Funcionalidad de exportación a PDF de gráficos de ventas de entradas del portal backoffice.wegow.com. Descripción INCIBE ha coordinado la publicación de una…
VulnerabilidadesExploits y PoC
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS…
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned tasks, and none of the organizations…
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal…
Ciberseguridad
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
I believe the cybersecurity industry may be approaching AI security the wrong way.
Ciberseguridad
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program]
Ciberseguridad
The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.
Ciberataques y APTIA y seguridad
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.
El ciberataque que durante la noche del 11 al 12 de octubre afectó a los sistemas de refrigeración de supermercados en Francia ha acabado por trascender el ámbito empresarial y ha llegado hasta el Parlamento. Ante los diputados, el ministro de Finanzas, Roland Lescure, cifró en…
Ciberataques y APTIA y seguridad
Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.
VulnerabilidadesFiltraciones de datos
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and…
