https://blog.itsdavidg.co/es/tags/seguridad-aws/ Recent content in Seguridad AWS on David Gómez — AWS, seguridad y dirección técnica Hugo es-ES Fri, 11 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-11-seguridad-aws-amazon-s3-object-lock-now-supports-variable-retention-with/ Fri, 11 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-11-seguridad-aws-amazon-s3-object-lock-now-supports-variable-retention-with/ Seguridad en AWS — Amazon S3 Object Lock now supports variable retention, allowing you to apply write-once-read-many (WORM) protection to objects whose required retention period starts with a future event, such as a contract closing or an audit completing. You place an event hold with a retention du https://blog.itsdavidg.co/es/posts/2026-09-10-seguridad-aws-anthropic-discloses-fourth-ai-hacking-incident-involving-c/ Thu, 10 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-10-seguridad-aws-anthropic-discloses-fourth-ai-hacking-incident-involving-c/ Seguridad en AWS — Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company sa https://blog.itsdavidg.co/es/posts/2026-09-09-seguridad-aws-chrome-v8-zero-day-exploited-in-the-wild-enables-code-exec/ Wed, 09 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-09-seguridad-aws-chrome-v8-zero-day-exploited-in-the-wild-enables-code-exec/ Seguridad en AWS — Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug https://blog.itsdavidg.co/es/posts/2026-09-08-seguridad-aws-trezor-says-shipmonk-breach-exposed-67-000-u-s-customers-d/ Tue, 08 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-08-seguridad-aws-trezor-says-shipmonk-breach-exposed-67-000-u-s-customers-d/ Seguridad en AWS — Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numb https://blog.itsdavidg.co/es/posts/2026-09-07-seguridad-aws-critical-vmware-workstation-and-fusion-flaw-lets-vm-admins/ Mon, 07 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-07-seguridad-aws-critical-vmware-workstation-and-fusion-flaw-lets-vm-admins/ Seguridad en AWS — Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-o https://blog.itsdavidg.co/es/posts/2026-09-06-seguridad-aws-unpatched-magento-and-adobe-commerce-zero-day-exploited-to/ Sun, 06 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-06-seguridad-aws-unpatched-magento-and-adobe-commerce-zero-day-exploited-to/ Seguridad en AWS — Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which d https://blog.itsdavidg.co/es/posts/2026-09-05-seguridad-aws-amazon-s3-now-supports-privatelink-for-fips-endpoints/ Sat, 05 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-05-seguridad-aws-amazon-s3-now-supports-privatelink-for-fips-endpoints/ Seguridad en AWS — Amazon S3 now supports AWS PrivateLink for endpoints that have been validated under the Federal Information Processing Standard (FIPS) 140-3 program. Customers with security and compliance requirements can use FIPS-validated cryptographic modules when connecting to S3 while keepin https://blog.itsdavidg.co/es/posts/2026-09-04-seguridad-aws-over-440-000-exploit-attempts-target-super-forms-and-eleme/ Fri, 04 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-04-seguridad-aws-over-440-000-exploit-attempts-target-super-forms-and-eleme/ Seguridad en AWS — Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – https://blog.itsdavidg.co/es/posts/2026-09-03-seguridad-aws-attackers-exploit-critical-jfrog-artifactory-flaw-to-mint/ Thu, 03 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-03-seguridad-aws-attackers-exploit-critical-jfrog-artifactory-flaw-to-mint/ Seguridad en AWS — Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to admini https://blog.itsdavidg.co/es/posts/2026-09-02-seguridad-aws-attackers-exploit-critical-switchvox-flaw-to-deploy-revers/ Wed, 02 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-02-seguridad-aws-attackers-exploit-critical-switchvox-flaw-to-deploy-revers/ Seguridad en AWS — Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulner https://blog.itsdavidg.co/es/posts/2026-09-01-seguridad-aws-aws-agent-registry-for-centralized-agent-discovery-and-gov/ Tue, 01 Sep 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-09-01-seguridad-aws-aws-agent-registry-for-centralized-agent-discovery-and-gov/ Seguridad en AWS — AWS Agent Registry is now generally available. It provides a private, governed catalog and discovery layer for agents, tools, skills, MCP servers, and custom resources within your organization. Teams get complete visibility into their AI landscape, so they can discover existing ca https://blog.itsdavidg.co/es/posts/2026-08-31-seguridad-aws-securing-claude-code-the-new-compliance-api-local-visibili/ Mon, 31 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-31-seguridad-aws-securing-claude-code-the-new-compliance-api-local-visibili/ Seguridad en AWS — Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activit https://blog.itsdavidg.co/es/posts/2026-08-30-seguridad-aws-aws-transform-now-in-scope-for-fedramp-class-c/ Sun, 30 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-30-seguridad-aws-aws-transform-now-in-scope-for-fedramp-class-c/ Seguridad en AWS — AWS Transform is now in scope for FedRAMP Class C (formerly Moderate baseline) in the US East (Ohio) Region. You can now use AWS Transform to build applications and run workloads that are subject to FedRAMP Class C compliance requirements. The Federal Risk and Authorization Manage https://blog.itsdavidg.co/es/posts/2026-08-29-seguridad-aws-papercut-zero-day-exploited-in-attacks-affecting-all-ng-an/ Sat, 29 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-29-seguridad-aws-papercut-zero-day-exploited-in-attacks-affecting-all-ng-an/ Seguridad en AWS — PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said https://blog.itsdavidg.co/es/posts/2026-08-28-seguridad-aws-critical-cpanel-flaw-could-let-one-hosting-customer-take-r/ Fri, 28 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-28-seguridad-aws-critical-cpanel-flaw-could-let-one-hosting-customer-take-r/ Seguridad en AWS — cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported vers https://blog.itsdavidg.co/es/posts/2026-08-27-seguridad-aws-openai-releases-its-official-report-on-the-hugging-face-br/ Thu, 27 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-27-seguridad-aws-openai-releases-its-official-report-on-the-hugging-face-br/ Seguridad en AWS — The report, which spans several discrete cybersecurity compromises, is the most complete accounting of the incident to date. https://blog.itsdavidg.co/es/posts/2026-08-26-seguridad-aws-marimo-notebook-flaw-could-run-mcp-commands-before-cells-e/ Wed, 26 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-26-seguridad-aws-marimo-notebook-flaw-could-run-mcp-commands-before-cells-e/ Seguridad en AWS — Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record. The CNA record https://blog.itsdavidg.co/es/posts/2026-08-25-seguridad-aws-actively-exploited-oracle-weblogic-flaw-lets-unauthenticat/ Tue, 25 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-25-seguridad-aws-actively-exploited-oracle-weblogic-flaw-lets-unauthenticat/ Seguridad en AWS — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability https://blog.itsdavidg.co/es/posts/2026-08-24-seguridad-aws-aws-partner-central-agents-mcp-server-now-supports-oauth-w/ Mon, 24 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-24-seguridad-aws-aws-partner-central-agents-mcp-server-now-supports-oauth-w/ Seguridad en AWS — AWS partners can now access AWS Partner Central agents from tools they already use, such as Amazon Quick and Kiro, using OAuth through AWS Sign-In. Partners can authorize agent access with their existing AWS identities, sign-in methods, IAM permissions, and governance controls wit https://blog.itsdavidg.co/es/posts/2026-08-23-seguridad-aws-critical-macos-sharepoint-vcenter-and-microsoft-ike-flaws/ Sun, 23 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-23-seguridad-aws-critical-macos-sharepoint-vcenter-and-microsoft-ike-flaws/ Seguridad en AWS — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, stating they are being exploited in the wild. The shortcomings added to the KEV catalog are listed below - CVE-2026 https://blog.itsdavidg.co/es/posts/2026-08-22-seguridad-aws-attackers-exploit-zimbra-snmp-flaw-for-unauthenticated-rem/ Sat, 22 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-22-seguridad-aws-attackers-exploit-zimbra-snmp-flaw-for-unauthenticated-rem/ Seguridad en AWS — A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of com https://blog.itsdavidg.co/es/posts/2026-08-21-seguridad-aws-microsoft-entra-id-flaw-cvss-10-0-exploited-in-wild-allows/ Fri, 21 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-21-seguridad-aws-microsoft-entra-id-flaw-cvss-10-0-exploited-in-wild-allows/ Seguridad en AWS — Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting th https://blog.itsdavidg.co/es/posts/2026-08-20-seguridad-aws-amazon-cloudwatch-pipelines-adds-geoip-rds-and-xml-process/ Thu, 20 Aug 2026 09:30:00 +0000 https://blog.itsdavidg.co/es/posts/2026-08-20-seguridad-aws-amazon-cloudwatch-pipelines-adds-geoip-rds-and-xml-process/ Seguridad en AWS — Amazon CloudWatch pipelines now includes three new processors that parse and enrich log data as it's ingested: an Amazon RDS log parser, an XML parser and a GeoIP enrichment processor. CloudWatch pipelines is a fully managed service that ingests, transforms, and routes telemetry t