Actualizado hace 1 min
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
428 notas en castellano e inglés. Quitar filtros
Ciberseguridad
Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.
360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.
RansomwareInfraestructura crítica
CISA y otras agencias internacionales advierten que el grupo de ransomware SafePay ha vulnerado a más de 600 organizaciones de infraestructura crítica desde agosto de 2024. Los atacantes acceden mediante credenciales robadas, fuerza bruta y vulnerabilidades en VPNs, utilizando…
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working…
OverviewOn October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests.…
VulnerabilidadesExploits y PoC
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we’ll walk you through examples using KEDR, KATA, and KES.
VulnerabilidadesExploits y PoC
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. 
VulnerabilidadesExploits y PoC
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities…
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.
Apache Tomcat ha corregido ocho fallos de seguridad que podrían permitir a los atacantes omitir las verificaciones de contraseñas, exponer datos entre usuarios e interrumpir conexiones. Las correcciones fueron publicadas el 20 de octubre de 2026 en las versiones 11.0.27, 10.1.61…
VulnerabilidadesExploits y PoC
PHP2Shell refers to two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution. Explore the out-of-memory corruption and stale global state attack paths, affected PHP versions, exploitation conditions, and…
VulnerabilidadesExploits y PoC
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Ciberseguridad
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million…
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Ciberataques y APTIA y seguridad
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
IA y seguridadPhishing e ingeniería social
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly…
VulnerabilidadesExploits y PoC
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws,…
