Noticias de ciberseguridad · semana del 19 al 25 oct 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
Nikkei discloses third data breach in a month, 1.8M records exposed
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. [...]
Fuente: BleepingComputer ↗Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
Fuente: SecurityWeek ↗ También en: The Hacker News, BleepingComputerResearchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
Fuente: Dark Reading ↗Las pesadillas de la IA que se han hecho realidad en 2026… justo a tiempo para Halloween
Malware capaz de modificar su propio código para evitar ser detectado, sistemas que encuentran vulnerabilidades en cuestión de minutos o ciberataques que se ejecutan prácticamente solos. Lo que hace apenas unos años parecía propio de una…
Fuente: CyberSecurity News ↗La IA obliga a replantear la seguridad de los centros de datos
Los expertos de /fdata y /fsafe, las unidades de centros de datos y de ciberseguridad de fibratel, advierten de que el modelo tradicional basado en proteger por separado redes, sistemas, accesos físicos y operación resulta insuficiente,…
Fuente: CyberSecurity News ↗'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
Fuente: Dark Reading ↗Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
Fuente: The Record ↗ConnectWise Suspends Cloud Services in Response to Cyberattack
The services remain unavailable as the company continues remediation and security validation.
Fuente: SecurityWeek ↗ También en: The RecordHackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the…
Fuente: BleepingComputer ↗ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
Fuente: Dark Reading ↗El mercado de la ciberseguridad sufrió un desplome del 26% en EEUU. Una especialidad fue a contracorriente: creció un 268%
Imaginemos una empresa que comienza a incorporar inteligencia artificial a sus servicios. Además de proteger sus sistemas habituales, ahora debe prestar atención a los datos que utilizan sus modelos, las personas que pueden acceder a…
Fuente: Xataka ↗Bullhorn takes staffing platform offline to contain cyberattack
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]
Fuente: BleepingComputer ↗Two more Serbian opposition figures targeted with spyware, researchers say
A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.
Fuente: The Record ↗Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
Fuente: SecurityWeek ↗Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the…
Fuente: The Hacker News ↗OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]
Fuente: BleepingComputer ↗Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands
Ahold Delhaize, the Dutch multinational grocery retailer, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic.
Fuente: The Record ↗Russian social media giant VK faces disruptions after data center drone strike
The disruptions began Sunday, when users complained of difficulties loading news feeds, playing music and accessing other features of VK's platforms.
Fuente: The Record ↗Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Fuente: SecurityWeek ↗Microsoft fixes game, app crashes caused by recent Windows update
Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]
Fuente: BleepingComputer ↗OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what…
Fuente: Dark Reading ↗Inside the Underground Market for Know Your Client Services
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to…
Fuente: BleepingComputer ↗The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
Fuente: Dark Reading ↗F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
Fuente: BleepingComputer ↗Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations…
Fuente: KrebsOnSecurity ↗GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake…
Fuente: The Hacker News ↗50 muertos o 1.000 millones de dólares en daños: el listón que Anthropic quiere fijar para que el Gobierno pueda frenar un modelo de IA
Anthropic ha estado presentando entre bambalinas un borrador de proyecto de ley sobre la seguridad de los modelos de IA más punteros en el Capitolio, según el medio Politico. Desde luego no es frecuente que un laboratorio de IA intente…
Fuente: Xataka ↗Microsoft fixes classic Outlook bug that hid Copilot buttons
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. [...]
Fuente: BleepingComputer ↗Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
Fuente: SecurityWeek ↗Japón declara un estado de emergencia en ciberseguridad
Japón ha cruzado un umbral histórico. En octubre de 2026, la Sede de la Estrategia Nacional de Ciberseguridad nipona declaró oficialmente un estado de emergencia cibernética, medida sin precedentes en el país. La decisión llega tras…
Fuente: Red Seguridad ↗One Compromised Login Exposed Millions of California Students’ Records
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.
Fuente: SecurityWeek ↗From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound…
Fuente: The Hacker News ↗Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers.
Fuente: The Record ↗Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization.
Fuente: SecurityWeek ↗Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude…
Fuente: The Hacker News ↗MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.
Fuente: SecurityWeek ↗Microsoft: October Windows Server updates break Exchange sign-in, mail flow
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. [...]
Fuente: BleepingComputer ↗Anthropic Acquires Confidential AI Startup Opaque Systems
Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware.
Fuente: SecurityWeek ↗- ● Explotada activamente
Validación incorrecta del origen en Remote Support de BeyondTrust
Validación incorrecta del origen en Remote Support de BeyondTrust Lun, 19/10/2026 - 09:27 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una…
Fuente: INCIBE-CERT ↗ La IA obliga al sector salud a reforzar su ciberseguridad
La adopción acelerada de herramientas de inteligencia artificial (IA) está transformando los modelos de negocio, la atención sanitaria y la gestión de la seguridad. Sin embargo, la expansión de estas tecnologías también está ampliando la…
Fuente: Red Seguridad ↗Ausencia de verificación de integridad en MobaXterm de Mobatek
Ausencia de verificación de integridad en MobaXterm de Mobatek Lun, 19/10/2026 - 09:03 Aviso Recursos Afectados MobaXterm Personal Edition (Portable), versión 26.4 GA, de Mobatek. Descripción INCIBE ha coordinado la publicación de una…
Fuente: INCIBE-CERT ↗