Noticias de ciberseguridad · semana del 2 al 8 nov 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
British businesses caught in Europe-wide supermarket fridge attacks
Supermarket and grocery store refrigerator controls across Europe were hacked in the early hours of Monday in the second such wave of attacks in recent weeks — following a first wave in France — with unidentified perpetrators defrosting…
Fuente: The Record ↗Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew…
Fuente: The Hacker News ↗Groenlandia se convierte en la pieza clave del internet europeo: Bruselas planea un cable submarino que esquive a EEUU
Bruselas quiere tender un cable submarino de internet que conecte Groenlandia directamente con la Unión Europea. Y la cosa no acaba solo ahí, sino que también hay planes para ampliarlo a través de Canadá hasta Japón y Corea del Sur. El…
Fuente: Xataka ↗Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility
North Korean attackers "combined a range of techniques, including social engineering by fake recruitment interviews," Binance said about the multibillion-dollar crypto heist it discovered in October.
Fuente: The Record ↗Barracuda warns of critical flaws allowing root access to devices
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]
Fuente: BleepingComputer ↗ También en: The Hacker News9 Cyber Awareness Tips That Actually Match Today’s Maze of Threats
Practical guidance on safer search, stronger login security, better executive protection, and other habits that help reduce enterprise risk.
Fuente: Dark Reading ↗LLMJacking Emerges as Thriving Cybercriminal Enterprise
Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.
Fuente: Dark Reading ↗Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028
Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and…
Fuente: BleepingComputer ↗Frontline Education Data Breach Impacts Over 1.3 Million
Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.
Fuente: SecurityWeek ↗CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode
The acquisitions will add AI agent observability and automated AI security testing capabilities to the CrowdStrike Falcon platform.
Fuente: SecurityWeek ↗La llegada de las IA con "automejora recursiva": qué significa que Astra haya ayudado a modificar otro modelo de IA y qué riesgos y beneficios conlleva
El pasado 12 de septiembre Dario Amodei, el director general de Anthropic, publicó uno de sus ensayos más controvertidos. Lo tituló 'Debemos marcar el ritmo de la frontera' (We Must Pace the Frontier), y en su texto defiende la necesidad…
Fuente: Xataka ↗3AM Affiliate Embraces AI-Like Loops in European School Attack
Evidence suggests a model may have generated and revised commands during the ransom gang's breach, though researchers stopped short of claiming full automation.
Fuente: Dark Reading ↗UK school estate hit by 3AM ransomware in suspected AI-assisted attack
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]
Fuente: BleepingComputer ↗Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects
Russia's Interior Ministry said Monday that police had dismantled the group's infrastructure and identified its suspected members following an investigation conducted with assistance from cybersecurity firm Kaspersky.
Fuente: The Record ↗El Internet de las Cosas parecía una gran idea en 2013: los supermercados de Europa están descubriendo que con la IA no lo era tanto
La noche del 11 al 12 de octubre, unos ciberdelincuentes tomaron el control de los sistemas de refrigeración de cientos de supermercados en Francia. Las temperaturas en las neveras y congeladores ascendieron hasta los 50 °C, lo que…
Fuente: Xataka ↗Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes
The hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border.
Fuente: The Record ↗Police seizes over 100 servers in investment scam crackdown
European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. [...]
Fuente: BleepingComputer ↗Múltiples vulnerabilidades en Veeam Management Pack para Microsoft System Center
Múltiples vulnerabilidades en Veeam Management Pack para Microsoft System Center Mar, 03/11/2026 - 14:24 Aviso Recursos Afectados Veeam Management Pack para Microsoft System Center 9.1 y todas las compilaciones anteriores de la rama 9,…
Fuente: INCIBE ↗Android’s November 2026 Updates Patch Over 200 Vulnerabilities
The most severe is a critical flaw in Framework leading to remote code execution without user interaction.
Fuente: SecurityWeek ↗Critical Node-RED Flaw Exploited in Attacks
Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.
Fuente: SecurityWeek ↗Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
The top payout is for high-impact architectural research demonstrating full administrative control.
Fuente: SecurityWeek ↗ También en: BleepingComputerArtificial intelligence and cyber intrusion
An NCSC assessment that examines current AI-enabled threat trends and projections of the threat landscape to 2028.
Fuente: NCSC-UK ↗Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
The NCSC warns that ‘tech on the cheap’ has left UK organisations exposed to AI uncovering and exploiting longstanding cyber security weaknesses and calls for urgent investment in resilience.
Fuente: NCSC-UK ↗Mutipath TCP: Use and Detection, (Mon, Nov 2nd)
Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684,  CVE-2026-98432)
Fuente: SANS ISC ↗ También en: INCIBE-CERT, The Hacker NewsEl CCN lanza ESP-IA, una nueva metodología de evaluación de seguridad de productos con IA
El Centro Criptológico Nacional (CCN) ha presentado la guía CCN-STIC-2011, bajo el título Metodología de Evaluación de Seguridad de Productos – Inteligencia Artificial (ESP-IA). Y lo ha hecho acompañada de dos anexos: la plantilla de…
Fuente: Red Seguridad ↗Detenidos en España dos radicales de Blocus que usaban Internet para organizar los asaltos
La Policía Nacional detuvo en Málaga a un presunto miembro del movimiento radical Blocus, un joven de 20 años que utilizaba canales de mensajería instantánea para coordinar saqueos, incendios y actos de pillaje con el uso de armas en…
Fuente: Red Seguridad ↗Harvard University data breach exposed info of 851,000 accounts
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. [...]
Fuente: BleepingComputer ↗Múltiples vulnerabilidades en Tenable Identity Exposure
Múltiples vulnerabilidades en Tenable Identity Exposure Mar, 03/11/2026 - 11:48 Aviso Recursos Afectados Tenable Identity Exposure 3.93.5 y versiones anteriores de esa rama.Tenable Identity Exposure 3.77.17 y versiones anteriores de esa…
Fuente: INCIBE-CERT ↗Boletín de seguridad de Android: noviembre 2026
Boletín de seguridad de Android: noviembre 2026 Mar, 03/11/2026 - 11:48 Aviso Recursos Afectados El boletín identifica Android 14, 15, 16, 16-qpr2 y 17 para los componentes AOSP, según el CVE, además del núcleo Linux y componentes de…
Fuente: INCIBE-CERT ↗Múltiples vulnerabilidades en productos de MediaTek
Múltiples vulnerabilidades en productos de MediaTek Mar, 03/11/2026 - 11:48 Aviso Recursos Afectados Dispositivos que incorporen los chipsets y componentes MediaTek enumerados por CVE en el boletín del fabricante, y que no hayan recibido…
Fuente: INCIBE-CERT ↗Múltiples vulnerabilidades en ALO Suite de AM System
Múltiples vulnerabilidades en ALO Suite de AM System Mar, 03/11/2026 - 10:51 Aviso Recursos Afectados ALO Suite, versión 25_09_15.03_35. Descripción INCIBE ha coordinado la publicación de 15 vulnerabilidades, una de severidad alta y 14 de…
Fuente: INCIBE-CERT ↗UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
The U.K. will likely face AI cyberattacks on its critical infrastructure by 2028 as criminals and states, including China and Russia, increasingly use AI in their cyber activity.
Fuente: SecurityWeek ↗Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google says it is highly confident that device maker Videostrong intentionally put a…
Fuente: The Hacker News ↗ También en: BleepingComputer, SecurityWeekNATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training
The NATO CCDCOE exercise in Estonia introduces AI agents and OpenAI Daybreak into joint cyber and kinetic operations training.
Fuente: SecurityWeek ↗Over 100 European Stores Hit as Supermarket Fridge Attacks Return
Attackers again tampered with internet-exposed refrigeration controllers, this time at stores in Belgium, Sweden, Ireland and beyond.
Fuente: SecurityWeek ↗¿Le darías el volante a la IA?
Imagina un coche de rally entrando a gran velocidad en un tramo de montaña. El piloto conduce, pero a su lado alguien observa lo que todavía no puede ver y le anticipa lo que viene: curva cerrada, cambio de rasante, grava, peligro……
Fuente: Red Seguridad ↗Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing…
Fuente: The Hacker News ↗Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which…
Fuente: The Hacker News ↗Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection out to strangers and…
Fuente: KrebsOnSecurity ↗UK faces ‘unprecedented rise’ in cyberattacks in coming months, warns cyber chief
"[V]ulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable," the NCSC's chief will warn in releasing the agency's annual report.
Fuente: The Record ↗$6.3B Binance Hack Shows the Need to Test Attack Paths
Understanding how attackers can move through an environment after gaining initial access is key to protecting critical assets, security experts say.
Fuente: Dark Reading ↗8 de cada de 10 empresas no cuentan con protocolos de ciberseguridad en sus proyectos de IA
En los últimos meses, las ciberamenazas han crecido y se han profesionalizado cada vez más mediante el uso de inteligencia artificial. Esta tendencia ha llevado a los ciberdelincuentes a explorar nuevos objetivos de ataque, y los propios…
Fuente: CyberSecurity News ↗Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform
Blockchain security companies said more than $46 million left the Mercado Bitcoin platform.
Fuente: The Record ↗Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. [...]
Fuente: BleepingComputer ↗Michigan State cyber incident claimed by ransomware gang behind recent hospital attack
A recent post by the BYOD gang appears to line up with a security incident that prompted campus-wide action at Michigan State University. BYOD drew attention in October for an attack on the University of New Mexico.
Fuente: The Record ↗Sitios web falsos y agentes de IA: riesgos y cómo protegerse
Los asistentes de IA pueden recomendar enlaces y los agentes incluso navegar e interactuar con sitios web en nombre del usuario. Sin embargo, ambos pueden terminar conduciendo a páginas fraudulentas.
Fuente: WeLiveSecurity ↗Fintech platform Sageworks taken offline after suspected cyberattack
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment. [...]
Fuente: BleepingComputer ↗Polymarket pledges to give $3.9 million back to victims after site compromise
In a post-mortem on an October 29 incident, prediction market Polymarket said it will pay people back what they lost, as well as compensate them for the site's downtime.
Fuente: The Record ↗Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers
An alliance of Belarusian and pro-Ukrainian hackers claimed to have taken out Russia's federal statistics agency, Rosstat, and stolen vast amounts of sensitive government data in a cyberattack.
Fuente: The Record ↗BTCPay Server warns of hot wallet thefts targeting outdated instances
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions. [...]
Fuente: BleepingComputer ↗Your Mobile Carrier Stores Your Call Logs for Years
Mobile carriers can retain years of call and text metadata, exposing sensitive details about customers' relationships, locations, and daily routines if breached. Cape examines the privacy risks of long-term telecom data retention and how…
Fuente: BleepingComputer ↗Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
Significant cybersecurity deals were announced by Absolute Security, Aikido, Anthropic, Cohere, Hex-Rays, and Proofpoint.
Fuente: SecurityWeek ↗Microsoft's AI Risk Report Misses This Key Detail
The latest "Digital Defense Report" identifies government agencies as prime targets for AI attacks but doesn't mention that they are broadly being targeted through Microsoft bugs.
Fuente: Dark Reading ↗DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by…
Fuente: The Hacker News ↗Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website.
Fuente: SecurityWeek ↗Apple warns users in 99 countries of mercenary spyware
Apple does not attribute attacks or the notices to specific malicious actors or geographical regions, the notification said, due to the “extreme cost, sophistication, and worldwide nature of mercenary spyware attacks [which] make them…
Fuente: The Record ↗Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings
A popular Ukrainian air raid alert system was hacked over the weekend, prompting a cyber group to breach a similar Russian system in retaliation.
Fuente: The Record ↗Hackers disrupt refrigeration systems at European supermarkets
A cyberattack on refrigeration systems has disrupted stores run by multiple supermarket chains across several European countries after hackers remotely changed temperature settings on freezers and cooling systems. [...]
Fuente: BleepingComputer ↗PapRAT Cyber Espionage Campaign Leaves a 'BITTER' Taste in South Asia
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
Fuente: Dark Reading ↗Microsoft fixes Smart App Control broken by October Windows update
Microsoft has resolved a known issue that prevented some users from activating the Smart App Control security feature after installing the October 2026 KB5127648 Windows 11 security update. [...]
Fuente: BleepingComputer ↗Revolve Data Breach Impacts at Least 180,000 People
Hackers accessed its online shopping platform and stole customers’ personal and payment card information.
Fuente: SecurityWeek ↗Second wave of suspected cyberattacks hits supermarket freezers across Europe
Supermarket and grocery store refrigerators across Europe appear to have been hacked early Monday — the second such incident in recent weeks where attackers have manipulated temperature controls and caused stock to spoil.
Fuente: The Record ↗Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. [...]
Fuente: BleepingComputer ↗Tener las neveras conectadas puede hacer que alguien las suba a 50 grados. Está pasando en Bélgica y Suecia
Tener los dispositivos conectados permite su gestión centralizada y a distancia. Esto supone una enorme ventaja para las empresas con miles de estos dispositivos desperdigados, por eso las grandes cadenas de supermercados centralizan…
Fuente: Xataka ↗Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability…
Fuente: The Hacker News ↗Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy
Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders…
Fuente: The Hacker News ↗Malicious Claude Code Extension Served in Cursor Supply Chain Attack
The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.
Fuente: SecurityWeek ↗Synology warns of C3RB3R ransomware attacks targeting NAS devices
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. [...]
Fuente: BleepingComputer ↗Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged…
Fuente: The Hacker News ↗Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
The attackers used offensive agentic techniques to access the company’s systems and internal tools.
Fuente: SecurityWeek ↗- ● Explotada activamente
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
Fuente: SecurityWeek ↗ También en: BleepingComputer Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted.
Fuente: SecurityWeek ↗FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto.
Fuente: SecurityWeek ↗Barcelona Cybersecurity Congress abordará el impacto de la IA en la ciberseguridad
Bajo el lema ‘Connecting the European cybersecurity ecosystem’, BCC consolida en 2026 su posición como una de las principales plataformas europeas de negocio e intercambio de conocimiento, donde los participantes podrán compartir…
Fuente: CyberSecurity News ↗FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions
The FBI and U.S. Secret Service alleged this weekend that North Korean hackers were responsible for stealing more than $6.3 billion from cryptocurrency platform Binance last week.
Fuente: The Record ↗