Actualizado hace 1 min
Noticias de ciberseguridad
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
499 notas en castellano e inglés. Quitar filtros
Ciberseguridad
Grafana Labs connects observability and incident response with Knowledge Graph
Grafana Labs has announced a Knowledge Graph in every Grafana Cloud stack, alongside new Digital Experience Monitoring capabilities and updates to Grafana Cloud Incident Response Management (IRM). The releases connect infrastructure and application dependencies with user…
IA y seguridadNormativa y privacidad
Fallo de privacidad de Meta Muse AI expone datos empresariales confidenciales
Meta ha suspendido la función de compartir conversaciones de Muse AI debido a un fallo de privacidad que expuso datos personales y registros comerciales confidenciales. El problema ocurría a través de enlaces de chat rastreables, permitiendo que cualquier persona con el enlace…
IA y seguridadHerramientas e investigación
ThreatLocker adds external controls for AI agent access and execution
ThreatLocker has announced the launch of Zero Trust AI Control (ZTAIC), giving organizations a tool to deploy agentic AI without surrendering control of their environments. ZTAIC enables security teams to give AI agents exactly what they need to perform their jobs while keeping…
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21,…
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular…
Exploits y PoCVulnerabilidades
Moving past autonomous exploitation to machine-speed security
Frontier AI advancements have created a world where exploitation outpaces defense. The average enterprise takes 32 to 43 days to patch, but the mean time to exploit a vulnerability is 10 hours. This asymmetry creates questions around how enterprises can trust autonomous AI to…
Herramientas e investigaciónMalware
Info-stealing malware slipped into OVHcloud CLI releases on GitHub
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who…
Safari blocks trackers that turn your email into a tracking ID
Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers. How email addresses become tracking IDs This “post-cookie”…
Vulnerabilidades críticas detectadas en Gitlab
Vulnerabilidad crítica en GitLab CE/EE – 15/11/226 Introducción CVE-2026-97229 es una vulnerabilidad que afecta a GitLab Community Edition (CE) y Enterprise Edition (EE), la plataforma DevOps de GitLab para gestión de código fuente y CI/CD. GitLab le ha asignado una puntuación…
RansomwareInfraestructura crítica
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024.
Ciberseguridad
14 ways attackers abuse cloud services to hack your enterprise
Attackers are increasingly abusing trusted SaaS platforms, cloud infrastructure, and identity systems to blend malicious activity into legitimate enterprise traffic. Adversaries are pushing command and control (C2) through high-reputation services, including OpenAI and AWS, to…
Ciberseguridad
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order. They may also no longer buy…
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated…
VulnerabilidadesExploits y PoC
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are…
Apocalipsis en PHP: dos vulnerabilidades críticas sin corregir ponen en peligro cualquier web
Dos vulnerabilidades críticas y, por el momento, sin parchear, afectan a PHP y ponen en peligro los sitios web. Este problema se conoce como PHP2Shell. El equipo de seguridad de PHP ha asignado, con fecha de 20 de octubre, a ambos fallos una puntuación de 9.2 sobre 10 en la…
