Noticias de ciberseguridad · semana del 12 al 18 oct 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
Ghostscript flaw lets hackers hijack servers via PDF uploads
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]
Fuente: BleepingComputer ↗Anthropic warns self-replicating AI could spread to your smart devices
Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data…
Fuente: BleepingComputer ↗El 42% de las organizaciones deja alertas de seguridad sin investigar
Los equipos de operaciones de seguridad y de redes detectan los incidentes con mayor eficacia, pero no siempre cuentan con los recursos necesariospara investigarlos y resolverlos. El informe «2026 State of AI Agents in Security and…
Fuente: CyberSecurity News ↗La UPV impulsa VANTAGE, un proyecto de IA multiagente para prevenir ciberataques en Europa
La Universitat Politècnica de València (UPV) ha reunido a un grupo de cerca de 40 profesionales de la ciberseguridad en la primera reunión técnica del consorcio del proyecto europeo VANTAGE, financiado por European Cybersecurity…
Fuente: CyberSecurity News ↗Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
More than 40 residences in Texas were the target of a federal operation in September to clamp down on remote worker scams that feed money back to the North Korean regime.
Fuente: The Record ↗Anthropic Finds Ingredients for Future AI Worms
Anthropic's latest study combined IoT and network tests to explore AI self-replication, which researchers said would be "challenging" to shut down.
Fuente: Dark Reading ↗“Importancia nacional”: OpenAI encuentra un sofisticado dispositivo de grabación en sus oficinas y el FBI acaba interviniendo
Las empresas que desarrollan inteligencia artificial tienen motivos de sobra para proteger su tecnología. Hablamos de sistemas que requieren enormes inversiones, información confidencial y conocimientos cuyo valor va mucho más allá de los…
Fuente: Xataka ↗FTC: Company netted at least $60 million charging sextortion victims for help it didn’t provide
An Ohio-based company charged individuals thousands of dollars to fight sextortion scams, but the operation itself was fraudulent, according to a Federal Trade Commission complaint.
Fuente: The Record ↗October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and…
Fuente: SANS ISC ↗ También en: BleepingComputerMicrosoft releases Windows 10 KB5126657 extended security update
Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]
Fuente: BleepingComputer ↗Microsoft: Windows 11 23H2 reaches end of support in 30 days
Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. [...]
Fuente: BleepingComputer ↗ También en: BleepingComputerLos ciberataques se han disparado tanto en Japón que ya se habla de “un estado de emergencia en el ciberespacio”
Cuando reservamos un billete de tren o alquilamos un coche, solemos prestar atención al precio, al horario o a las condiciones del servicio. Mucho menos a lo que ocurre con los datos personales que dejamos durante la operación y a cuántas…
Fuente: Xataka ↗- ● Explotada activamente
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.
Fuente: SecurityWeek ↗ Small AI Models May Soon Be Able to Self-Replicate on IoT Devices, Anthropic Warns
Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.
Fuente: SecurityWeek ↗ También en: The Hacker NewsUK Housing Ombudsman Service investigates 'security incident'
The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. [...]
Fuente: BleepingComputer ↗Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited…
Fuente: The Hacker News ↗Windows 11 KB5127648 & KB5126653 cumulative updates released
Microsoft has released Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features. [...]
Fuente: BleepingComputer ↗Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]
Fuente: BleepingComputer ↗ También en: The Hacker NewsSAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business…
Fuente: The Hacker News ↗Adobe Patches 140 Vulnerabilities Across 10 Products
The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.
Fuente: SecurityWeek ↗Google Partially Reverses Chrome Bug Bounty Cuts
Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.
Fuente: SecurityWeek ↗TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. [...]
Fuente: BleepingComputer ↗GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having…
Fuente: The Hacker News ↗Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says
The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit…
Fuente: The Record ↗West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’
More than two dozen people were arrested by police in Ghana and Nigeria as part of a U.K.-hosted operation that also included tech companies.
Fuente: The Record ↗Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services.
Fuente: SecurityWeek ↗Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]
Fuente: BleepingComputer ↗North Korean hackers target Ukrainian experts for possible intelligence on Russia's war
North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.
Fuente: The Record ↗El CNI busca 17 perfiles técnicos para anticiparse a las amenazas de la IA y la cuántica: lo que piden dice mucho de cómo se prepara
El Centro Nacional de Inteligencia ha abierto una campaña para incorporar ingenieros y analistas técnicos. Son 17 perfiles, desde el análisis de malware hasta el despliegue de modelos de IA, para los que el CNI está recibiendo currículums…
Fuente: Xataka ↗The MFA Gaps Attackers are Still Exploiting
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how…
Fuente: BleepingComputer ↗SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...]
Fuente: BleepingComputer ↗El riesgo de la IA no va a parecerse a Terminator. Se parecerá a lo que acaba de pasar en 500 supermercados franceses
La noche del domingo al lunes, los frigoríficos de cientos de supermercados franceses se descongelaron a la vez. Alguien activó a distancia los ciclos de desescarche de sus controladores. El ataque alcanzó al menos 300 establecimientos de…
Fuente: Xataka ↗Russian internet provider SkyNet reports outages after cyberattack claimed by Ukrainian hackers
One of St. Petersburg's major internet providers said its network had been under a distributed denial-of-service (DDoS) attack since October 6, affecting services including online gaming, voice calls and video conferencing.
Fuente: The Record ↗Ledger says hardware implant in cryptocurrency wallets stole recovery phrases
Ledger cryptocurrency wallets sold through a Southeast Asian reseller had an implant allowing outsiders to drain funds, the company said.
Fuente: The Record ↗South African clothing retailer Foschini Group investigating cyberattack on British fashion brands
The South African retail giant The Foschini Group (TFG) disclosed a cyberattack that disrupted IT systems at three of its British fashion brands, leaving some services unavailable.
Fuente: The Record ↗Cyber incident hits grocery stores in US, Netherlands and Belgium
Ahold Delhaize, the Dutch multinational retailer, announced it was taking precautionary measures following a cybersecurity incident, with stores in the U.S., Netherlands and Belgium reportedly impacted.
Fuente: The Record ↗Ciberataque sin precedentes en Francia contra las neveras de los supermercados
Lo ocurrido la noche del 11 al 12 de octubre de 2026 en Francia no tiene precedentes en la historia de la delincuencia digital. Cientos de supermercados de las principales cadenas del país, como Carrefour, Monoprix, Intermarché, La…
Fuente: Red Seguridad ↗XWorm RAT Evolves Into Surveillance Platform
Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.
Fuente: SecurityWeek ↗AI Turns Familiar Cyberattacks Into a Race Against Time
IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses.
Fuente: SecurityWeek ↗Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via Cryptobilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss…
Fuente: The Hacker News ↗ También en: BleepingComputer, SecurityWeekLa IA exige una nueva forma de entender la ciberseguridad
La inteligencia artificial (IA) está cambiando nuestra relación con la tecnología. Ya no se limita a responder preguntas o generar contenidos; sino que empieza a comprender mejor nuestro contexto, anticipar necesidades y ayudarnos a…
Fuente: Red Seguridad ↗Retail giant Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network. [...]
Fuente: BleepingComputer ↗ También en: SecurityWeekRefrigeration Controller Hack Spoils Food Across European Supermarkets
A cyberattack targeted refrigeration controllers, setting refrigerators and freezers across hundreds of supermarkets to defrost.
Fuente: SecurityWeek ↗Los ciberataques aumentan un 45% en España durante el primer semestre de 2026
España destaca entre los países con mayor volumen de ciberataques durante el primer semestre de 2026, según un nuevo informe realizado por NTT Data. Durante ese período, el equipo de Cyber Threat Intelligence de la compañía ha…
Fuente: Red Seguridad ↗Cross-Site Scripting en la aplicación web de YouMind
Cross-Site Scripting en la aplicación web de YouMind Mar, 13/10/2026 - 09:39 Aviso Recursos Afectados Aplicación web de YouMind. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad media que afecta a la…
Fuente: INCIBE-CERT ↗Múltiples vulnerabilidades en NonStop Servers de HPE
Múltiples vulnerabilidades en NonStop Servers de HPE Mar, 13/10/2026 - 09:38 Aviso Recursos Afectados HPE NonStop Servers y los componentes de software indicados en el boletín del fabricante.Para la vulnerabilidad crítica está afectado…
Fuente: INCIBE-CERT ↗Desbordamiento de búfer basado en montículo en NX-OS Software de Cisco
Desbordamiento de búfer basado en montículo en NX-OS Software de Cisco Mar, 13/10/2026 - 09:38 Aviso Recursos Afectados Versiones vulnerables de Cisco NX-OS Software en los siguientes productos:Cisco Nexus 3000 Series Switches con la…
Fuente: INCIBE-CERT ↗Múltiples vulnerabilidades en productos de GitLab
Múltiples vulnerabilidades en productos de GitLab Mar, 13/10/2026 - 09:38 Aviso Recursos Afectados Para la vulnerabilidad crítica:GitLab Community Edition y Enterprise Edition 19.2, versiones anteriores a 19.2.8;GitLab Community Edition y…
Fuente: INCIBE-CERT ↗Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.
Fuente: Dark Reading ↗Detectan más de 390.000 ataques de phishing a través de plataformas cloud
Los ciberdelincuentes están aprovechando servicios cloud de confianza como Cloudflare Workers, Vercel, Netlify, GitHub Pages o IPFS para lanzar campañas de phishing cada vez más sofisticadas. En los últimos doce meses se han llevado a…
Fuente: CyberSecurity News ↗El 91% de los profesionales de TI y ciberseguridad sufre estrés laboral
Los equipos de TI y ciberseguridad trabajan bajo una presión cada vez mayor. Los ataques son cada vez más sofisticados, las expectativas de recuperación son cada vez mayores y la responsabilidad de la continuidad del negocio recae a…
Fuente: CyberSecurity News ↗Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. [...]
Fuente: BleepingComputer ↗Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.
Fuente: Dark Reading ↗Yandex confirms service outage as users lose access to cloud files
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. [...]
Fuente: BleepingComputer ↗Anthropic takes risky AI tests offline after models breach govt sites
Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. [...]
Fuente: BleepingComputer ↗No Identity, No Recovery: Cyber Resilience Starts With IAM
The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.
Fuente: Dark Reading ↗Un ciberataque pone patas arriba los frigoríficos de supermercados franceses y otro incidente afecta a cadenas europeas
Cuando pensamos en ciberseguridad, es fácil imaginar un correo sospechoso, una contraseña robada o una página web que deja de funcionar. Pero los sistemas informáticos también intervienen en actividades que no asociamos de inmediato con…
Fuente: Xataka ↗Cyberattack disrupts refrigeration at hundreds of French supermarkets
A cyberattack overnight Sunday disrupted refrigerators at hundreds of French supermarkets, spoiling fresh food at stores run by some of the country’s largest grocery chains.
Fuente: The Record ↗ También en: BleepingComputerIonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
The all-stock deal brings Elisity’s least-privilege access technology into IonQ’s security portfolio.
Fuente: SecurityWeek ↗Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based…
Fuente: BleepingComputer ↗Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which…
Fuente: The Hacker News ↗ También en: SecurityWeekGitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. [...]
Fuente: BleepingComputer ↗2026-016: Critical Vulnerability in GitLab CE and EE
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated…
Fuente: CERT-EU ↗Passing the Baton: Dark Reading Names New Editor-in-Chief
Fahmida Y Rashid will keep the momentum going as she leads Dark Reading.
Fuente: Dark Reading ↗Help the NCSC understand how organisations approach external attack surface risk
We're looking to hear from people involved in evaluating, selecting or adopting EASM.
Fuente: NCSC-UK ↗Ukraine strikes third Yandex data center, disrupting digital services across Russia
A third Yandex data center in Russia was hit by Ukrainian drones over the weekend, forcing it to shut down and causing further disruptions to cloud services, payments, deliveries and other online services across the country.
Fuente: The Record ↗Canonical Websites Disrupted in Second DDoS Attack This Year
The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal
Fuente: SecurityWeek ↗Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty…
Fuente: The Hacker News ↗Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US.
Fuente: SecurityWeek ↗iRhythm Data Breach Impacts at Least 360,000 People
Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers.
Fuente: SecurityWeek ↗Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
Fuente: SecurityWeek ↗ También en: The Hacker NewsRansomware Response Expert Arrested in ShinyHunters FBI Hack Probe
The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.
Fuente: SecurityWeek ↗Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.
Fuente: SecurityWeek ↗CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The…
Fuente: The Hacker News ↗