Noticias de ciberseguridad · semana del 26 oct al 1 nov 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
Carga sin restricciones de archivos en la aplicación PuMuKIT
Carga sin restricciones de archivos en la aplicación PuMuKIT Mar, 27/10/2026 - 14:14 Aviso Recursos Afectados PuMuKIT, versiones anteriores a la 5.0.8. Descripción INCIBE ha coordinado la publicación de una vulnerabilidad de severidad…
Fuente: INCIBE-CERT ↗From industry concern to practical action: the value of working with regulators
How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity
Fuente: NCSC-UK ↗iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
Fuente: SecurityWeek ↗Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses.
Fuente: SecurityWeek ↗Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
Fuente: BleepingComputer ↗This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
Fuente: SecurityWeek ↗Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.
Fuente: SecurityWeek ↗Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to…
Fuente: The Hacker News ↗Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]
Fuente: BleepingComputer ↗Múltiples vulnerabilidades en Cloud BI Platform de Sisense
Múltiples vulnerabilidades en Cloud BI Platform de Sisense Mar, 27/10/2026 - 09:28 Aviso Recursos Afectados Sisense Cloud BI Platform (SaaS). Descripción INCIBE ha coordinado la publicación de 2 vulnerabilidades de severidad alta, que…
Fuente: INCIBE-CERT ↗PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP…
Fuente: The Hacker News ↗ También en: INCIBE-CERTOpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem…
Fuente: The Hacker News ↗- ● Explotada activamente
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]
Fuente: BleepingComputer ↗ También en: INCIBE-CERT, INCIBE-CERT, INCIBE-CERT, INCIBE-CERT, WeLiveSecurity, The Hacker News, BleepingComputer Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products.
Fuente: SecurityWeek ↗Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras
CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.
Fuente: The Record ↗ También en: The Hacker NewsCybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at more than 30 clinics.
Fuente: SecurityWeek ↗So Many AI Security Benchmarks, But None Tell the Whole Story
Measuring AI model security gets complex fast — a growing patchwork of benchmarks targets different variables in the equation, but none replace testing against your own code and workflows.
Fuente: Dark Reading ↗Apple Patches for October 2026, (Mon, Oct 26th)
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.
Fuente: SANS ISC ↗University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
Fuente: BleepingComputer ↗El 32% de las organizaciones españolas ha sufrido incidentes relacionados con la IA
Los agentes de IA no se limitan a responder prompts, sino que pueden interpretar, tomar decisiones y actuar en nombre de las personas a través del correo electrónico, herramientas de colaboración, copilotos y flujos de trabajo. Esto ha…
Fuente: CyberSecurity News ↗Alertan por sitios falsos para comprar el nuevo GTA 6
Queda menos de un mes para que el videojuego más esperado del último tiempo vea la luz. Aunque Grand Theft Auto VI aún no haya salido a la venta, los ciberdelincuentes ya se están aprovechando de la expectación. En una reciente…
Fuente: CyberSecurity News ↗Risks & Rewards: How AI Is Redefining the CISO's Role
Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.
Fuente: Dark Reading ↗Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. [...]
Fuente: BleepingComputer ↗Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines
In an unusual move, the suit — brought under the state’s deceptive trade practices laws — seeks to hold founder and CEO Sam Altman personally liable for the alleged deception.
Fuente: The Record ↗In-the-Wild Attack Abuses AI Agents' Trust in Markdown
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
Fuente: Dark Reading ↗OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]
Fuente: BleepingComputer ↗Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
A string of hacking incidents by rogue AI agents also has raised fears the technology will slip free of human control to carry out harmful, life-threatening tasks.
Fuente: SecurityWeek ↗DreamHost forces password resets in ongoing "incident"
DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]
Fuente: BleepingComputer ↗Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a…
Fuente: The Hacker News ↗'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
Fuente: Dark Reading ↗OpenAI ha descubierto que sus agentes de IA han encontrado la forma de hablar entre ellos a escondidas
En el terreno de la inteligencia artificial (IA), las capacidades emergentes son habilidades que los modelos de lenguaje no tenían a menor escala y que aparecen de golpe al aumentar su tamaño, sin que nadie las haya programado ni las haya…
Fuente: Xataka ↗Serbian autocrat loses election following widespread reports of digital repression
Serbian strongman leader Aleksandar Vučić on Sunday admitted defeat in his race for prime minister, a loss that follows a series of incidents of digital repression that galvanized the opposition.
Fuente: The Record ↗Ukraine disputes Musk's claims of Starlink misuse as military connectivity restored
Ukrainian Defense Minister Yevhen Khmara said Saturday that Starlink and Starshield connectivity had been restored.
Fuente: The Record ↗Dutch police extradite Chinese national accused of laundering Cambodian investment scam funds
44-year-old Zheng Zhao was allegedly a key money-launderer working with a group of scammers who called U.S.-based victims and urged them to invest in fictitious businesses.
Fuente: The Record ↗Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]
Fuente: BleepingComputer ↗Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation…
Fuente: The Hacker News ↗Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]
Fuente: BleepingComputer ↗Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities.
Fuente: SecurityWeek ↗Genesys Hack Exposes Customer Data From Internal Systems
The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected.
Fuente: SecurityWeek ↗Stolen AI Reasoning Could Help China Build Cheaper Rivals
Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI.
Fuente: SecurityWeek ↗When an AI Agent Is the Incident, the Identity Record Is the Evidence
A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does. [...]
Fuente: BleepingComputer ↗10 Software Security Practices Built for the Next 250 Years
This Cybersecurity Awareness Month's theme, "Securing the Next 250," asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations.
Fuente: Dark Reading ↗Chinese man extradited for role in $36 million cryptocurrency scam
A Chinese national was arraigned in California after being extradited from the Netherlands for his alleged involvement in a cryptocurrency investment scam that stole nearly $37 million from 174 victims in the United States. [...]
Fuente: BleepingComputer ↗PHP2Shell Exploitation Moves From Probes to Working Shells
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.
Fuente: SecurityWeek ↗953 Online Stores Infected in Long-Lasting Malware Campaign
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.
Fuente: SecurityWeek ↗Cross-Site Scripting reflejado en el software IsMyGym de Zuinq Studio
Cross-Site Scripting reflejado en el software IsMyGym de Zuinq Studio Lun, 26/10/2026 - 13:01 Aviso Recursos Afectados Software de gestión de gimnasios IsMyGym, versiones anteriores a la v6.0.85. Descripción INCIBE ha coordinado la…
Fuente: INCIBE-CERT ↗Popular AI tool LiteLLM says unrevoked key allowed hackers to target users
LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week.
Fuente: The Record ↗Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first…
Fuente: The Hacker News ↗Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts.
Fuente: SecurityWeek ↗Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one…
Fuente: The Hacker News ↗Kali Linux 2026.3 released with 7 new tools, desktop updates
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]
Fuente: BleepingComputer ↗ También en: BleepingComputer- ● Explotada activamente
Inyección SQL en VeloCloud Orchestrator de Arista
Inyección SQL en VeloCloud Orchestrator de Arista Lun, 26/10/2026 - 11:22 Aviso Recursos Afectados VeloCloud Orchestrator On-Prem:Rama 5.2.x: versiones anteriores a 5.2.3.18.Rama 6.1.x: versiones anteriores a 6.1.3.10.Rama 6.4.x:…
Fuente: INCIBE-CERT ↗ Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.
Fuente: SecurityWeek ↗5th EMPACT Hackathon leads to the detection of 51 potential victims
An international operation involving 40 experts and investigators from 20 countries has identified 51 potential victims of human trafficking, as well as five suspects. Held in Amsterdam from 23 to 25 September 2026, the fifth EMPACT…
Fuente: Europol ↗ENISE: 20 ediciones de actividad empresarial, cooperación y generación de oportunidades
La vigésima edición del Encuentro Internacional de Seguridad de la Información (20ENISE), organizada por el Instituto Nacional de Ciberseguridad (Incibe) del 21 al 23 de octubre en León, volvió a reunir a miles de profesionales para…
Fuente: Red Seguridad ↗Looking for a Language [Guest Diary], (Wed, Oct 21st)
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program]
Fuente: SANS ISC ↗Mythos 5 Ignored Real-World Harm in July Attack
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
Fuente: SecurityWeek ↗Cross-Site Scripting reflejado en la videoteca de las Cortes de Castilla-La Mancha
Cross-Site Scripting reflejado en la videoteca de las Cortes de Castilla-La Mancha Lun, 26/10/2026 - 09:31 Aviso Recursos Afectados Aplicación web de la videoteca de las Cortes de Castilla-La Mancha, accesible en…
Fuente: INCIBE-CERT ↗La IA obliga a replantear la ciberseguridad
La inteligencia artificial (IA) está cambiando las reglas de la ciberseguridad. Su capacidad para automatizar procesos, acelerar decisiones y ampliar el alcance de las acciones obliga a las organizaciones a replantear cómo protegen sus…
Fuente: Red Seguridad ↗