Noticias de ciberseguridad · semana del 9 al 15 nov 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
Ukraine dismantles crypto scam network that stole €4.3 million
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. [...]
Fuente: BleepingComputer ↗ También en: The RecordThe Biggest Threat to Your GRC Job Isn’t AI. It’s Ignoring AI.
AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy,…
Fuente: BleepingComputer ↗FBI agent stole $2.5 million in crypto from hackers under investigation
A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. [...]
Fuente: BleepingComputer ↗Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called…
Fuente: The Hacker News ↗Alleged AI-aided cyberattack exploits assistant interface to breach German web host
Hackers allegedly assisted by AI breached a German web hosting company through a tool designed to allow customers to connect AI assistants to their accounts, the company disclosed.
Fuente: The Record ↗Revolve Puts Data Breach Victim Count at 1.5 Million
Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals.
Fuente: SecurityWeek ↗US bans MEXC crypto exchange over sanctions evasion, cybercrime links
The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. [...]
Fuente: BleepingComputer ↗Pro-Russian hackers target European officials, offer rewards for personal information
Pro-Russian hackers published the personal information of Italian Foreign Minister Antonio Tajani and other senior European officials on the dark web, offering cryptocurrency rewards for additional details about them and their families.
Fuente: The Record ↗Plex2Shell Exploited Against QNAP NAS Users
Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.
Fuente: SecurityWeek ↗Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it.
Fuente: SecurityWeek ↗Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web
Italian Foreign Minister Antonio Tajani said Saturday that his personal data had been disseminated on the dark web.
Fuente: SecurityWeek ↗Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.
Fuente: SecurityWeek ↗El Gobierno lleva a TikTok ante la Fiscalía después de que 'Maldita' haya encontrado más de mil vídeos de abuso sexual infantil
El Ministerio de Juventud e Infancia ha pedido a la Fiscalía que investigue a TikTok después de que Maldita.es haya documentado miles de vídeos y directos de abuso sexual infantil explícito en la plataforma. La ministra Sira Rego ha…
Fuente: Xataka ↗Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the…
Fuente: The Hacker News ↗Amplifon Americas Data Breach Impacts 1.3 Million
Hackers stole personal, health, and insurance information, including Social Security numbers, from the company’s internal systems.
Fuente: SecurityWeek ↗Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that…
Fuente: The Hacker News ↗Over 3 Million People Hit by Frontline Education Data Breach
Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students.
Fuente: SecurityWeek ↗LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be…
Fuente: The Hacker News ↗Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack
Working with cryptographers, DeepMind’s AI agents cut the cost of forging RSA-1024 signatures and found a cheaper way to factor keys.
Fuente: SecurityWeek ↗- ● Explotada activamente
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been…
Fuente: The Hacker News ↗ También en: INCIBE-CERT Cross-site Scripting (XSS) almacenado en Tankuam Places
Cross-site Scripting (XSS) almacenado en Tankuam Places Lun, 09/11/2026 - 09:10 Aviso Recursos Afectados Tankuam Places, versiones anteriores a la apl.00007.00005 (diciembre de 2025). Descripción INCIBE ha coordinado la publicación de una…
Fuente: INCIBE-CERT ↗