[remote] Exasol Database 7.1.30 - command execution
Exasol Database 7.1.30 - command execution
Actualizado hace 1 min
Noticias de ciberseguridad
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
510 notas en castellano e inglés. Quitar filtros
[remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
[remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
[remote] South River Technologies Titan MFT Server 26.0.0 - code execution
South River Technologies Titan MFT Server 26.0.0 - code execution
[remote] Synametrics Syncrify 6.2 - command execution
Synametrics Syncrify 6.2 - command execution
FBI sospecha que ejecutivo de ciberseguridad ayudó a ShinyHunters con web de extorsión
Investigadores federales sospechan que un ejecutivo de una firma de consultoría de Estados Unidos ayudó al grupo ShinyHunters a operar un sitio web utilizado para presionar a empresas hackeadas a pagar rescates. Este caso plantea dudas sobre si algunos asesores de…
Ciberseguridad
Hackeo de Drift: lavan 63 millones en Tornado Cash
Ataque WP2Shell permite crear cuentas de administrador e instalar shells en WordPress sin login
WP2Shell es una vulnerabilidad que combina dos fallos del núcleo de WordPress para permitir la ejecución de código en el servidor mediante solicitudes no autenticadas. Esto permite a un atacante crear cuentas de administrador e instalar web shells basadas en plugins. Según el…
Ciberseguridad
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
VulnerabilidadesHerramientas e investigación
KVM escape exposes broader attack surface in Linux networking
Security researchers have found a critical flaw in the Linux kernel’s networking stack that can let attackers escape a KVM virtual machine and execute code on the host system. The weakness could also potentially let attackers compromise systems running other Linux-based…
Ciberseguridad
Hackeo de Drift: 61 millones en ether al mezclador
VulnerabilidadesHerramientas e investigación
CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
CVE-2026-101767 is a critical (CVSS 9.8) unauthenticated SQL injection vulnerability in Oracle E-Business Suite 12.2.3–12.2.15. Horizon3 researchers identified an attack chain enabling remote code execution through the TCF servlet. Learn about affected versions, October 2026…
VulnerabilidadesFiltraciones de datos
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
VulnerabilidadesExploits y PoC
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
California warns all public school students of data stolen in contractor breach
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
Ciberseguridad
Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ
The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.
Ciberseguridad