Noticias de seguridad, directo desde el campo.

CyberXero Uses AI Agents to Hit WordPress Worldwide and Ukrainian Energy

An access broker used dozens of Claude Code agents and a 'this is my own pentest' story to automate WordPress takeovers and target Ukrainian energy providers. Over 628,000 records are linked to the campaign. Here's what happened and what to fix.

Bricksforge CVSS 10.0 Flaw Exploited for Unauthenticated RCE on WordPress

Attackers are exploiting CVE-2026-85097 in the Bricksforge WordPress plugin to upload and run PHP without logging in. Ninja Forms and WPC Product Bundles XSS flaws are also being used to plant hidden admins. Here's what to patch and what to check.

Oct 12, 2026·4 min lectura

Critical SonicWall SMA 1000 Flaw Hit by Exploitation Attempts Days After Patch

Attackers began probing SonicWall SMA 1000 appliances for CVE-2026-102255, a CVSS 10.0 pre-auth SSRF, just two days after the fix shipped. Here's what it means and what to do.

Midnight Mimosa: Android Malware Preinstalled in Budget Phone Firmware

Bitdefender has uncovered Midnight Mimosa, malware built into the firmware of low-cost MediaTek Android phones. It runs ad fraud and proxyware on thousands of devices in 150+ countries, and normal uninstalling cannot remove it.

Power BI Phishing Lure Plants Rogue ScreenConnect Clients for Persistent Access

Attackers are hiding phishing links behind Microsoft Power BI reports and using them to install a pair of attacker-controlled ScreenConnect clients on Windows machines. Here is how the chain works and how to shut it down.

Oct 12, 2026·6 min lectura

Casbaneiro Banking Trojan Hides Its C2 Until Victims Visit Their Bank

A new Casbaneiro campaign steals Outlook data and registers victims quietly, then opens its main command channel only when the user visits a targeted bank, so infected machines can look clean.

P7 DarkSword iOS Exploit Kit Adds Remote Control and Crypto Wallet Theft

A new DarkSword variant turns compromised iPhones into remotely tasked implants that harvest Keychain and wallet data — and it is now spreading through a hijacked analytics domain.

GhostAction returns: hijacked maintainer accounts push credential-stealing GitHub Actions workflows at scale

Attackers are using compromised maintainer accounts to add a fake "security audit" workflow that steals CI/CD secrets and credentials from git history. More than 500 accounts and tens of thousands of repositories are affected so far.

Oct 11, 2026·6 min lectura

TP-Link Faces Five U.S. State Lawsuits Over Router Security and China Links

Florida, Iowa, Montana and Nebraska have joined Texas in suing TP-Link over its security and China claims. Five newly detailed Aginet flaws are the part defenders can act on now.

Public exploit drops for pre-auth AnyDesk Linux flaw that grants root

A working exploit dubbed AnyPwn now targets a pre-authentication heap overflow in AnyDesk for Linux. It was silently fixed in 8.0.3 with no CVE, so update now and restrict TCP 7070.

Flax Typhoon: Five Old Flaws Added to CISA's Exploited List, Federal Patch Deadline Is Today

CISA has added ProFTPD, ONLYOFFICE, Strapi, Apache Struts and ISC BIND flaws to KEV after confirming that the China-linked group Flax Typhoon is exploiting them. Here's what to check and fix.

GoBalance Signing Bug Lets Attackers Recover Tor .onion Master Keys

A truncated Ed25519 key in GoBalance leaks an onion site's long-term private key from one public descriptor, enabling permanent .onion address hijacks. Dread and Omega are among the services hit.

Oct 11, 2026·4 min lectura

AhsayCBS Flaws Chained to Deploy Web Shells and XMRig Miners Disguised as Edge

Attackers are chaining two AhsayCBS vulnerabilities to run code on exposed backup servers. The 10.3.4 fix reportedly falls short, so restricting access to the management interface is the main defence for now.