Noticias de ciberseguridad · semana del 19 al 25 oct 2026
Lo más relevante de la actualidad en ciberseguridad, con enlace a la fuente original.
La IA nos obliga a redefinir la concienciación en ciberseguridad
por Chris Bevil, director de Ciberresiliencia e Inteligencia Artificial de Commvault Durante años, hemos enseñado a la gente a buscar las señales: una palabra mal escrita, una dirección de correo extraña, un enlace sospechoso. La IA está…
Fuente: CyberSecurity News ↗El 47% de las empresas ve los ataques a proveedores como un riesgo clave
Las empresas mantienen una relación cada vez más estrecha con proveedores tecnológicos, plataformas cloud, empresas de servicios, fabricantes, distribuidores y otros terceros. Muchos de estos actores tienen acceso a sus sistemas,…
Fuente: CyberSecurity News ↗PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
Fuente: BleepingComputer ↗2026-018: Critical Vulnerabilities in PHP
On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. At this time, no technical details have been…
Fuente: CERT-EU ↗FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
Fuente: The Record ↗Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable…
Fuente: BleepingComputer ↗Menos de 100 caracteres, 1.200 webs atacadas y más de 100 comprometidas: así está cambiando la IA la ciberseguridad
Durante años hemos asumido que la ciberseguridad era una carrera de fondo: alguien encontraba una vulnerabilidad, otro intentaba cerrarla y, entre medias, hacían falta tiempo, conocimientos y bastante trabajo humano para convertir ese…
Fuente: Xataka ↗California warns all public school students of data stolen in contractor breach
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
Fuente: The Record ↗Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties
A judge ordered that Abdulrahman Alfozan be detained after he was arrested earlier this month for allegedly bugging an OpenAI conference room.
Fuente: Dark Reading ↗23andMe successor settles with California for $6 million over cybersecurity failings
California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did not properly protect customers' data before a 2023 breach.
Fuente: The Record ↗OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
Fuente: BleepingComputer ↗Nigerian national given 8-year sentence for tax business hacks
A Nigerian national who worked with a group to hack tax prep businesses and conduct millions of dollars in fraud using customer data was sentenced this week.
Fuente: The Record ↗Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so…
Fuente: The Hacker News ↗La Guardia Civil compra por 2,5 millones un sistema para acceder de forma remota a móviles Android y iPhone
La Guardia Civil ha comprado una herramienta diseñada para registrar de forma remota los móviles de las personas que se encuentren bajo investigación, sin necesidad de incautar los dispositivos. El contrato, publicado en el BOE, ofrece…
Fuente: Xataka ↗US Agencies Detail Incident Response Practices for Rogue AI Agents
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.
Fuente: SecurityWeek ↗Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as…
Fuente: The Hacker News ↗Close Identity Gaps in Software Development Before Unleashing AI
Artificial Intelligence is complicating security in the software development lifecycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead.
Fuente: Dark Reading ↗- ● Explotada activamente
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an…
Fuente: The Hacker News ↗ EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
Fuente: The Record ↗Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
Fuente: Dark Reading ↗DHS bans DeepSeek products across US federal civilian agencies
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]
Fuente: BleepingComputer ↗AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at…
Fuente: The Record ↗Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The…
Fuente: The Hacker News ↗Anti-Putin messages disrupt nationwide school assessments in Russia
A pro-Ukraine group that says it operates within Russia took responsibility for anti-Putin messages appearing on an education assessment platform. Authorities said they had restored systems.
Fuente: The Record ↗Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
Fuente: SecurityWeek ↗ También en: The Hacker News, BleepingComputer, SecurityWeekCJIS v6.1 Compliance: 5 Practical Priorities for Agencies
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging,…
Fuente: BleepingComputer ↗The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.
Fuente: SecurityWeek ↗Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]
Fuente: BleepingComputer ↗Ahold Delhaize: Cyberattack affects services across US and Europe
Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]
Fuente: BleepingComputer ↗ También en: SecurityWeekAI Platform Cairn Abused to Hack Over 100 Organizations
At least three threat actors have been abusing Cairn for persistent access and financial theft.
Fuente: SecurityWeek ↗Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say
Abdulrahman Alfozan’s wife and young son also left the country the day after the 35-year-old Saudi national’s arrest.
Fuente: SecurityWeek ↗Introducing a new AI chapter in the NCSC research problem book
A revolution is underway at the intersection of AI and cyber security.
Fuente: NCSC-UK ↗OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]
Fuente: BleepingComputer ↗Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Microsoft says companies should treat AI agents as insiders, and is adding controls that grant access per task and tighten it as an agent’s risk rises.
Fuente: SecurityWeek ↗Windows Server 2025 gets support for quick machine recovery
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]
Fuente: BleepingComputer ↗La Guardia Civil lanza su primer ciberpuesto
La Guardia Civil ha puesto en marcha su primer ciberpuesto nacional, emplazado en la localidad de Baracaldo, Vizcaya. Esta nueva unidad descentralizada, supeditada a la Cibercomandancia, funcionará para todo el territorio español con el…
Fuente: Red Seguridad ↗Hackers Steal 1.8 Million Records From Nikkei
The compromised information includes names, addresses, email addresses, phone numbers, and dates of birth.
Fuente: SecurityWeek ↗Defense contractors in two NATO allies hacked in recent Russia-linked campaign
The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said.
Fuente: The Record ↗Revolut outage disrupts online banking operations worldwide
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. [...]
Fuente: BleepingComputer ↗970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Paradigm Healthcare Services detected an intrusion in October 2025, but it took nearly a year to start notifying affected individuals.
Fuente: SecurityWeek ↗Múltiples vulnerabilidades en FacturaScripts
Múltiples vulnerabilidades en FacturaScripts Mar, 20/10/2026 - 09:14 Aviso Recursos Afectados FacturaScripts:2025.61 Descripción INCIBE ha coordinado la publicación de 2 vulnerabilidades de severidad media, que afectan a FacturaScripts,…
Fuente: INCIBE-CERT ↗Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
Fuente: SecurityWeek ↗ También en: The Hacker NewsNikkei discloses third data breach in a month, 1.8M records exposed
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. [...]
Fuente: BleepingComputer ↗Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
Fuente: Dark Reading ↗Las pesadillas de la IA que se han hecho realidad en 2026… justo a tiempo para Halloween
Malware capaz de modificar su propio código para evitar ser detectado, sistemas que encuentran vulnerabilidades en cuestión de minutos o ciberataques que se ejecutan prácticamente solos. Lo que hace apenas unos años parecía propio de una…
Fuente: CyberSecurity News ↗La IA obliga a replantear la seguridad de los centros de datos
Los expertos de /fdata y /fsafe, las unidades de centros de datos y de ciberseguridad de fibratel, advierten de que el modelo tradicional basado en proteger por separado redes, sistemas, accesos físicos y operación resulta insuficiente,…
Fuente: CyberSecurity News ↗'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
Fuente: Dark Reading ↗Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
Fuente: The Record ↗ConnectWise Suspends Cloud Services in Response to Cyberattack
The services remain unavailable as the company continues remediation and security validation.
Fuente: SecurityWeek ↗ También en: The RecordHackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the…
Fuente: BleepingComputer ↗ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
Fuente: Dark Reading ↗El mercado de la ciberseguridad sufrió un desplome del 26% en EEUU. Una especialidad fue a contracorriente: creció un 268%
Imaginemos una empresa que comienza a incorporar inteligencia artificial a sus servicios. Además de proteger sus sistemas habituales, ahora debe prestar atención a los datos que utilizan sus modelos, las personas que pueden acceder a…
Fuente: Xataka ↗Bullhorn takes staffing platform offline to contain cyberattack
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]
Fuente: BleepingComputer ↗Two more Serbian opposition figures targeted with spyware, researchers say
A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.
Fuente: The Record ↗Qué hacer cuando una empresa informa una brecha de datos, pero aporta poca información
Las notificaciones de brechas de datos ofrecen cada vez menos información a las víctimas. Lo que una organización omite puede influir en las medidas que tomes después.
Fuente: WeLiveSecurity ↗Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the…
Fuente: The Hacker News ↗OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]
Fuente: BleepingComputer ↗Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands
Ahold Delhaize, the Dutch multinational grocery retailer, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic.
Fuente: The Record ↗Russian social media giant VK faces disruptions after data center drone strike
The disruptions began Sunday, when users complained of difficulties loading news feeds, playing music and accessing other features of VK's platforms.
Fuente: The Record ↗Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Fuente: SecurityWeek ↗Microsoft fixes game, app crashes caused by recent Windows update
Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]
Fuente: BleepingComputer ↗OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what…
Fuente: Dark Reading ↗Inside the Underground Market for Know Your Client Services
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to…
Fuente: BleepingComputer ↗The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
Fuente: Dark Reading ↗F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
Fuente: BleepingComputer ↗Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations…
Fuente: KrebsOnSecurity ↗GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake…
Fuente: The Hacker News ↗50 muertos o 1.000 millones de dólares en daños: el listón que Anthropic quiere fijar para que el Gobierno pueda frenar un modelo de IA
Anthropic ha estado presentando entre bambalinas un borrador de proyecto de ley sobre la seguridad de los modelos de IA más punteros en el Capitolio, según el medio Politico. Desde luego no es frecuente que un laboratorio de IA intente…
Fuente: Xataka ↗Microsoft fixes classic Outlook bug that hid Copilot buttons
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. [...]
Fuente: BleepingComputer ↗Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
Fuente: SecurityWeek ↗ITE obtiene la certificación ISO/IEC 42001, primera norma internacional sobre sistemas de gestión de la IA
La compañía Integración Tecnológica Empresarial (ITE) ha recibido la certificación ISO/IEC 42001, el primer estándar internacional que establece los requisitos para implantar, mantener y mejorar de forma continua un sistema de gestión de…
Fuente: Red Seguridad ↗Japón declara un estado de emergencia en ciberseguridad
Japón ha cruzado un umbral histórico. En octubre de 2026, la Sede de la Estrategia Nacional de Ciberseguridad nipona declaró oficialmente un estado de emergencia cibernética, medida sin precedentes en el país. La decisión llega tras…
Fuente: Red Seguridad ↗One Compromised Login Exposed Millions of California Students’ Records
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.
Fuente: SecurityWeek ↗From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound…
Fuente: The Hacker News ↗Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers.
Fuente: The Record ↗Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization.
Fuente: SecurityWeek ↗Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude…
Fuente: The Hacker News ↗MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.
Fuente: SecurityWeek ↗Microsoft: October Windows Server updates break Exchange sign-in, mail flow
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. [...]
Fuente: BleepingComputer ↗Anthropic Acquires Confidential AI Startup Opaque Systems
Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware.
Fuente: SecurityWeek ↗- ● Explotada activamente
Validación incorrecta del origen en Remote Support de BeyondTrust
Validación incorrecta del origen en Remote Support de BeyondTrust Lun, 19/10/2026 - 09:27 Aviso Recursos Afectados BeyondTrust Remote Support, todas las versiones hasta la 26.2.3, inclusive. Descripción BeyondTrust ha publicado una…
Fuente: INCIBE-CERT ↗ La IA obliga al sector salud a reforzar su ciberseguridad
La adopción acelerada de herramientas de inteligencia artificial (IA) está transformando los modelos de negocio, la atención sanitaria y la gestión de la seguridad. Sin embargo, la expansión de estas tecnologías también está ampliando la…
Fuente: Red Seguridad ↗Ausencia de verificación de integridad en MobaXterm de Mobatek
Ausencia de verificación de integridad en MobaXterm de Mobatek Lun, 19/10/2026 - 09:03 Aviso Recursos Afectados MobaXterm Personal Edition (Portable), versión 26.4 GA, de Mobatek. Descripción INCIBE ha coordinado la publicación de una…
Fuente: INCIBE-CERT ↗