DevOps

La señal de hoy The Hacker News ha publicado Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users’ Mailboxes (5 de octubre de 2026). Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. “Weak authorization in Microsoft Exchange Server allows an authenticated attacker ...

La señal de hoy The Hacker News ha publicado Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE (5 de octubre de 2026). A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then ...

La señal de hoy The Hacker News ha publicado Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware (3 de octubre de 2026). The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and ...

La señal de hoy AWS What’s New ha publicado Amazon Redshift simplifies access to secure logging with federated permissions (30 de septiembre de 2026). Amazon Redshift now makes it easier to troubleshoot and audit queries on data protected by federated permissions with fine-grained access control (FGAC). Using the new DEBUG permission, data owners can let specific identities see unredacted secure logging records across multiple Redshift data warehouses. With Amazon Redshift federated permissions, you define ...

La señal de hoy AWS What’s New ha publicado AWS Continuum for Penetration Testing now available in 6 additional Regions (30 de septiembre de 2026). AWS Continuum for Penetration Testing now available in 6 additional Regions AWS Continuum for Penetration Testing (AWS Security Agent) is a managed security service that enables AWS customers to conduct penetration testing against their web applications and APIs. Previously limited in geographic reach, the service now addresses the growing need for localized ...

La señal de hoy The Hacker News ha publicado Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft (1 de octubre de 2026). Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. “Their investigation identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a Una noticia genera atención. La pregunta útil es otra: ¿esto cambia algo de lo que tu equipo tiene que hacer esta semana, o no? ...

La señal de hoy AWS What’s New ha publicado Amazon Aurora now supports PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 (29 de septiembre de 2026). Amazon Aurora PostgreSQL-Compatible Edition now supports PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24, which include bug fixes from the PostgreSQL community and Aurora-specific enhancements. We recommend upgrading to the latest minor versions to benefit from these improvements and address Common Vulnerabilities and Exposures (CVEs), as detailed i ...

La señal de hoy The Hacker News ha publicado Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M (28 de septiembre de 2026). The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday. The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24, used them to send fraudulent withdrawal commands to Bitget’s wa ...

La señal de hoy The Hacker News ha publicado Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent (28 de septiembre de 2026). Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that’s targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent. “The implant installs the framework unchanged, then overwrites its SOUL.md persona file,” ThreatDown said. “The 39-line prompt directs it t ...

La señal de hoy The Hacker News ha publicado Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation (27 de septiembre de 2026). Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or published a fix. Some administrators say they have taken appliances offline rather than wait for one ...

La señal de hoy The Hacker News ha publicado SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild (26 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows - CVE-2026-65660 (CVSS score: 8.8) - A code injection vulnerabilit ...

La señal de hoy The Hacker News ha publicado WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV (25 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in ...