Noticias de ciberseguridad · semana del 19 al 25 oct 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]
Fuente: BleepingComputer ↗TiDB Breach Exposes Flawed Cloud Security Assumptions
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.
Fuente: Dark Reading ↗IA segura y seguridad gestionada, dos tendencias que marcarán el futuro de la ciberseguridad
Infinigate Iberia, plataforma tecnológica y asesor de confianza en ciberseguridad, cloud e infraestructura de red, participa en una nueva edición del Encuentro Internacional de Seguridad de la Información (ENISE 2026), el evento de…
Fuente: CyberSecurity News ↗Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
Fuente: BleepingComputer ↗Meta on the spot for $25 billion under New Mexico privacy ruling
The Cambridge Analytica data privacy case from a decade ago is still weighing on Meta's finances.
Fuente: The Record ↗Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.
Fuente: Dark Reading ↗Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.
Fuente: Dark Reading ↗Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.
Fuente: The Record ↗PHP publica parches de urgencia por dos fallos críticos PHP2Shell con intentos de explotación
PHP ha lanzado parches de urgencia para dos vulnerabilidades críticas agrupadas como PHP2Shell que permiten ejecución remota de código sin autenticación. Ya se han detectado intentos de explotación activa, así que la recomendación es…
Fuente: Una al día ↗'PHP2Shell' Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
Fuente: Dark Reading ↗Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for…
Fuente: The Hacker News ↗Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
Fuente: SecurityWeek ↗ También en: BleepingComputerCómo saber si una web está afectada por la vulnerabilidad de PHP con la herramienta que OpenAI ha publicado
Las dos vulnerabilidades críticas detectadas en PHP han llevado a administradores y organizaciones de distintos países a revisar servidores y aplicar actualizaciones con urgencia. Algunas webs incluso han optado por desconectarse…
Fuente: Xataka ↗Democrat lawmakers say Russia is aiming to undermine party ahead of midterms
The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes.
Fuente: The Record ↗LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise…
Fuente: The Hacker News ↗PHP says AI review of critical bugs first sparked alarm in August, but signs first surfaced in 2024
In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why it scrambled to post information earlier than…
Fuente: The Record ↗Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.
Fuente: SecurityWeek ↗PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.
Fuente: SecurityWeek ↗OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
Fuente: Dark Reading ↗OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the…
Fuente: The Hacker News ↗OpenAI agents disabled safety monitoring, one lied about it
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. [...]
Fuente: BleepingComputer ↗Un vecino de Puente Genil denuncia ante la Policía Local una de las primeras estafas en España con el prefijo 400
Un vecino de Puente Genil, Córdoba, ha denunciado un intento de estafa telefónica realizado desde un número que empieza por +400. Este nuevo prefijo, una medida del Ministerio para la Transformación Digital, tiene como objetivo reunir a…
Fuente: Xataka ↗Optiv Launches CyberBOT Cybersecurity Awareness Training Program
Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.
Fuente: Dark Reading ↗Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.
Fuente: Dark Reading ↗Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over…
Fuente: KrebsOnSecurity ↗Múltiples vulnerabilidades en PHP
Múltiples vulnerabilidades en PHP Mar, 20/10/2026 - 15:53 Aviso Recursos Afectados El equipo de seguridad del ecosistema PHP indica que todas las versiones podrían estar afectadas. Las pruebas se han realizado únicamente en las versiones…
Fuente: INCIBE-CERT ↗ También en: SecurityWeek, SANS ISC, BleepingComputer, XatakaUn falso concurso de baile permite a los ciberdelincuentes utilizar tu cuenta de WhatsApp
Un falso concurso de baile permite a los ciberdelincuentes utilizar tu cuenta de WhatsApp Mié, 21/10/2026 - 17:02 Aviso Recursos Afectados Personas que hayan recibido un mensaje de WhatsApp solicitando su voto en un supuesto concurso de…
Fuente: INCIBE ↗‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.
Fuente: SecurityWeek ↗High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
Fuente: SecurityWeek ↗Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Fuente: The Record ↗ClickFix has never been bigger, and AI tools are its most convincing lure yet
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and…
Fuente: BleepingComputer ↗PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only…
Fuente: The Hacker News ↗Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform.
Fuente: SecurityWeek ↗Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
Fuente: Dark Reading ↗Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities.
Fuente: SecurityWeek ↗OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it.
Fuente: SecurityWeek ↗Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. [...]
Fuente: BleepingComputer ↗Critical security issue affecting PHP
Fuente: NCSC-UK ↗Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them.
Fuente: SecurityWeek ↗China Defends DeepSeek After US Ban of Its AI From Government Systems
The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.
Fuente: SecurityWeek ↗La estafa de la niña bailarina en WhatsApp: Prevención y soluciones
En la última semana, circula por España de manera viral, a través de la red WhatsApp, una estafa que pide votar en un concurso a una niña bailarina de ballet clásico llamada Sophie o Eliska. De hecho, se trata de una campaña de phishing…
Fuente: Red Seguridad ↗Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [...]
Fuente: BleepingComputer ↗Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.
Fuente: SecurityWeek ↗CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
Fuente: BleepingComputer ↗Ciberseguridad en la videovigilancia: marco normativo en España
Durante décadas, la seguridad física y la ciberseguridad transitaron caminos paralelos, con escasas intersecciones. La primera se ocupaba de barreras, cámaras analógicas y vigilantes; la segunda, de firewalls, cifrado y antivirus en el…
Fuente: Red Seguridad ↗- ● Explotada activamente
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively…
Fuente: The Hacker News ↗ Múltiples vulnerabilidades en productos de Oracle
Múltiples vulnerabilidades en productos de Oracle Mié, 21/10/2026 - 08:10 Aviso Recursos Afectados El Critical Patch Update de octubre afecta a múltiples familias de productos Oracle, entre ellas Oracle Database, Oracle E-Business Suite,…
Fuente: INCIBE-CERT ↗Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.
Fuente: SecurityWeek ↗Talent4Cyber reúne a 440 estudiantes universitarios para poner a prueba sus habilidades en ciberseguridad
La tercera edición del Attack & Defense Hackaton universitario Talent4Cyber fue todo un éxito. La iniciativa, organizada por el Mando Conjunto del Ciberespacio (MCCE), el 14 y 15 de octubre, reunió un total de 440 participantes repartidos…
Fuente: Red Seguridad ↗Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities
The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.
Fuente: SecurityWeek ↗Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]
Fuente: BleepingComputer ↗Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
Fuente: Dark Reading ↗ También en: BleepingComputerLa IA nos obliga a redefinir la concienciación en ciberseguridad
por Chris Bevil, director de Ciberresiliencia e Inteligencia Artificial de Commvault Durante años, hemos enseñado a la gente a buscar las señales: una palabra mal escrita, una dirección de correo extraña, un enlace sospechoso. La IA está…
Fuente: CyberSecurity News ↗El 47% de las empresas ve los ataques a proveedores como un riesgo clave
Las empresas mantienen una relación cada vez más estrecha con proveedores tecnológicos, plataformas cloud, empresas de servicios, fabricantes, distribuidores y otros terceros. Muchos de estos actores tienen acceso a sus sistemas,…
Fuente: CyberSecurity News ↗PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
Fuente: BleepingComputer ↗2026-018: Critical Vulnerabilities in PHP
On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. At this time, no technical details have been…
Fuente: CERT-EU ↗FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
Fuente: The Record ↗Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable…
Fuente: BleepingComputer ↗Menos de 100 caracteres, 1.200 webs atacadas y más de 100 comprometidas: así está cambiando la IA la ciberseguridad
Durante años hemos asumido que la ciberseguridad era una carrera de fondo: alguien encontraba una vulnerabilidad, otro intentaba cerrarla y, entre medias, hacían falta tiempo, conocimientos y bastante trabajo humano para convertir ese…
Fuente: Xataka ↗California warns all public school students of data stolen in contractor breach
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
Fuente: The Record ↗Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties
A judge ordered that Abdulrahman Alfozan be detained after he was arrested earlier this month for allegedly bugging an OpenAI conference room.
Fuente: Dark Reading ↗23andMe successor settles with California for $6 million over cybersecurity failings
California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did not properly protect customers' data before a 2023 breach.
Fuente: The Record ↗OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
Fuente: BleepingComputer ↗Nigerian national given 8-year sentence for tax business hacks
A Nigerian national who worked with a group to hack tax prep businesses and conduct millions of dollars in fraud using customer data was sentenced this week.
Fuente: The Record ↗Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so…
Fuente: The Hacker News ↗La Guardia Civil compra por 2,5 millones un sistema para acceder de forma remota a móviles Android y iPhone
La Guardia Civil ha comprado una herramienta diseñada para registrar de forma remota los móviles de las personas que se encuentren bajo investigación, sin necesidad de incautar los dispositivos. El contrato, publicado en el BOE, ofrece…
Fuente: Xataka ↗US Agencies Detail Incident Response Practices for Rogue AI Agents
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.
Fuente: SecurityWeek ↗Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as…
Fuente: The Hacker News ↗Close Identity Gaps in Software Development Before Unleashing AI
Artificial Intelligence is complicating security in the software development lifecycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead.
Fuente: Dark Reading ↗- ● Explotada activamente
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an…
Fuente: The Hacker News ↗ EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
Fuente: The Record ↗Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
Fuente: Dark Reading ↗DHS bans DeepSeek products across US federal civilian agencies
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]
Fuente: BleepingComputer ↗AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at…
Fuente: The Record ↗Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The…
Fuente: The Hacker News ↗Anti-Putin messages disrupt nationwide school assessments in Russia
A pro-Ukraine group that says it operates within Russia took responsibility for anti-Putin messages appearing on an education assessment platform. Authorities said they had restored systems.
Fuente: The Record ↗Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
Fuente: SecurityWeek ↗ También en: The Hacker News, BleepingComputer, SecurityWeekCJIS v6.1 Compliance: 5 Practical Priorities for Agencies
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging,…
Fuente: BleepingComputer ↗The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.
Fuente: SecurityWeek ↗Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]
Fuente: BleepingComputer ↗Ahold Delhaize: Cyberattack affects services across US and Europe
Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]
Fuente: BleepingComputer ↗ También en: SecurityWeekAI Platform Cairn Abused to Hack Over 100 Organizations
At least three threat actors have been abusing Cairn for persistent access and financial theft.
Fuente: SecurityWeek ↗Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say
Abdulrahman Alfozan’s wife and young son also left the country the day after the 35-year-old Saudi national’s arrest.
Fuente: SecurityWeek ↗Introducing a new AI chapter in the NCSC research problem book
A revolution is underway at the intersection of AI and cyber security.
Fuente: NCSC-UK ↗OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]
Fuente: BleepingComputer ↗Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Microsoft says companies should treat AI agents as insiders, and is adding controls that grant access per task and tighten it as an agent’s risk rises.
Fuente: SecurityWeek ↗Windows Server 2025 gets support for quick machine recovery
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]
Fuente: BleepingComputer ↗La Guardia Civil lanza su primer ciberpuesto
La Guardia Civil ha puesto en marcha su primer ciberpuesto nacional, emplazado en la localidad de Baracaldo, Vizcaya. Esta nueva unidad descentralizada, supeditada a la Cibercomandancia, funcionará para todo el territorio español con el…
Fuente: Red Seguridad ↗Hackers Steal 1.8 Million Records From Nikkei
The compromised information includes names, addresses, email addresses, phone numbers, and dates of birth.
Fuente: SecurityWeek ↗Defense contractors in two NATO allies hacked in recent Russia-linked campaign
The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said.
Fuente: The Record ↗Revolut outage disrupts online banking operations worldwide
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. [...]
Fuente: BleepingComputer ↗970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Paradigm Healthcare Services detected an intrusion in October 2025, but it took nearly a year to start notifying affected individuals.
Fuente: SecurityWeek ↗Múltiples vulnerabilidades en FacturaScripts
Múltiples vulnerabilidades en FacturaScripts Mar, 20/10/2026 - 09:14 Aviso Recursos Afectados FacturaScripts:2025.61 Descripción INCIBE ha coordinado la publicación de 2 vulnerabilidades de severidad media, que afectan a FacturaScripts,…
Fuente: INCIBE-CERT ↗Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
Fuente: SecurityWeek ↗ También en: The Hacker NewsNikkei discloses third data breach in a month, 1.8M records exposed
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. [...]
Fuente: BleepingComputer ↗Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
Fuente: Dark Reading ↗Las pesadillas de la IA que se han hecho realidad en 2026… justo a tiempo para Halloween
Malware capaz de modificar su propio código para evitar ser detectado, sistemas que encuentran vulnerabilidades en cuestión de minutos o ciberataques que se ejecutan prácticamente solos. Lo que hace apenas unos años parecía propio de una…
Fuente: CyberSecurity News ↗La IA obliga a replantear la seguridad de los centros de datos
Los expertos de /fdata y /fsafe, las unidades de centros de datos y de ciberseguridad de fibratel, advierten de que el modelo tradicional basado en proteger por separado redes, sistemas, accesos físicos y operación resulta insuficiente,…
Fuente: CyberSecurity News ↗'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
Fuente: Dark Reading ↗Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
Fuente: The Record ↗ConnectWise Suspends Cloud Services in Response to Cyberattack
The services remain unavailable as the company continues remediation and security validation.
Fuente: SecurityWeek ↗ También en: The RecordHackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the…
Fuente: BleepingComputer ↗ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
Fuente: Dark Reading ↗El mercado de la ciberseguridad sufrió un desplome del 26% en EEUU. Una especialidad fue a contracorriente: creció un 268%
Imaginemos una empresa que comienza a incorporar inteligencia artificial a sus servicios. Además de proteger sus sistemas habituales, ahora debe prestar atención a los datos que utilizan sus modelos, las personas que pueden acceder a…
Fuente: Xataka ↗Bullhorn takes staffing platform offline to contain cyberattack
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]
Fuente: BleepingComputer ↗Two more Serbian opposition figures targeted with spyware, researchers say
A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.
Fuente: The Record ↗Qué hacer cuando una empresa informa una brecha de datos, pero aporta poca información
Las notificaciones de brechas de datos ofrecen cada vez menos información a las víctimas. Lo que una organización omite puede influir en las medidas que tomes después.
Fuente: WeLiveSecurity ↗Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the…
Fuente: The Hacker News ↗OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]
Fuente: BleepingComputer ↗Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands
Ahold Delhaize, the Dutch multinational grocery retailer, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic.
Fuente: The Record ↗Russian social media giant VK faces disruptions after data center drone strike
The disruptions began Sunday, when users complained of difficulties loading news feeds, playing music and accessing other features of VK's platforms.
Fuente: The Record ↗Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Fuente: SecurityWeek ↗Microsoft fixes game, app crashes caused by recent Windows update
Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]
Fuente: BleepingComputer ↗OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what…
Fuente: Dark Reading ↗Inside the Underground Market for Know Your Client Services
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to…
Fuente: BleepingComputer ↗The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
Fuente: Dark Reading ↗F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
Fuente: BleepingComputer ↗Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations…
Fuente: KrebsOnSecurity ↗GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake…
Fuente: The Hacker News ↗50 muertos o 1.000 millones de dólares en daños: el listón que Anthropic quiere fijar para que el Gobierno pueda frenar un modelo de IA
Anthropic ha estado presentando entre bambalinas un borrador de proyecto de ley sobre la seguridad de los modelos de IA más punteros en el Capitolio, según el medio Politico. Desde luego no es frecuente que un laboratorio de IA intente…
Fuente: Xataka ↗Microsoft fixes classic Outlook bug that hid Copilot buttons
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. [...]
Fuente: BleepingComputer ↗ITE obtiene la certificación ISO/IEC 42001, primera norma internacional sobre sistemas de gestión de la IA
La compañía Integración Tecnológica Empresarial (ITE) ha recibido la certificación ISO/IEC 42001, el primer estándar internacional que establece los requisitos para implantar, mantener y mejorar de forma continua un sistema de gestión de…
Fuente: Red Seguridad ↗Japón declara un estado de emergencia en ciberseguridad
Japón ha cruzado un umbral histórico. En octubre de 2026, la Sede de la Estrategia Nacional de Ciberseguridad nipona declaró oficialmente un estado de emergencia cibernética, medida sin precedentes en el país. La decisión llega tras…
Fuente: Red Seguridad ↗One Compromised Login Exposed Millions of California Students’ Records
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.
Fuente: SecurityWeek ↗From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound…
Fuente: The Hacker News ↗Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers.
Fuente: The Record ↗Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization.
Fuente: SecurityWeek ↗Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude…
Fuente: The Hacker News ↗MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.
Fuente: SecurityWeek ↗Microsoft: October Windows Server updates break Exchange sign-in, mail flow
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. [...]
Fuente: BleepingComputer ↗Anthropic Acquires Confidential AI Startup Opaque Systems
Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware.
Fuente: SecurityWeek ↗- ● Explotada activamente
Validación incorrecta del origen en Remote Support de BeyondTrust
Validación incorrecta del origen en Remote Support de BeyondTrust Lun, 19/10/2026 - 09:27 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una…
Fuente: INCIBE-CERT ↗ La IA obliga al sector salud a reforzar su ciberseguridad
La adopción acelerada de herramientas de inteligencia artificial (IA) está transformando los modelos de negocio, la atención sanitaria y la gestión de la seguridad. Sin embargo, la expansión de estas tecnologías también está ampliando la…
Fuente: Red Seguridad ↗Ausencia de verificación de integridad en MobaXterm de Mobatek
Ausencia de verificación de integridad en MobaXterm de Mobatek Lun, 19/10/2026 - 09:03 Aviso Recursos Afectados MobaXterm Personal Edition (Portable), versión 26.4 GA, de Mobatek. Descripción INCIBE ha coordinado la publicación de una…
Fuente: INCIBE-CERT ↗