Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
IT teams responsible for identity security are concerned about AI agents’ ongoing access to company systems and the actions they take on users’ behalf, according to a Delinea’s 2026 Identity Security Report: The AI Enforcement Gap. “Written policy is only as good as your ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea. “Our research echoes what I hear from leaders constantly: they have the AI policies … More → The post AI agents keep access to company data after their work is done appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix, Kubernetes. DORA relevance: medium.
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Los agentes de IA mantienen acceso persistente a datos corporativos tras finalizar sus tareas, creando un riesgo crítico de escalada de privilegios y exposición de datos sensibles bajo normativas GDPR/HIPAA.
Acción recomendada
Audita los permisos y tokens de acceso de los agentes de IA en entornos cloud y revisa la configuración de ciclo de vida de sesiones para mitigar el acceso no autorizado.
El acceso persistente y potencialmente excesivo de agentes de IA a datos corporativos puede incumplir los principios de protección desde el diseño, procesamiento bajo instrucciones y seguridad adecuada al riesgo.
GDPR · Art. 25 Data protection by design and by default (direct) · Art. 29 Processing under the authority of the controller or processor (direct) · Art. 32 Security of processing (direct)
When a journalist suspects their phone has been hacked, the first question is whether any trace of the attack is left. Google has added six features to Advanced Protection in Android 17, including one that keeps a copy of that evidence off the device. Existing users will receive a notification when the new capabilities become available on their devices. Forensic logging and data retention Intrusion Logging records security and network events, including app activity. Users … More → The post Android 17 makes it harder for spyware to cover its tracks appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix. DORA relevance: medium.
Por qué importa
Se han reportado vulnerabilidades asociadas a múltiples proveedores (Cisco, Google, Citrix) en el contexto de nuevas capacidades de seguridad de Android 17, lo que requiere validación de exposición.
Acción recomendada
Audita el inventario de activos para identificar sistemas afectados por CVE-2026-76504 y CVE-2026-88772 y notifica a los responsables de infraestructura de Cisco, Google y Citrix.
Armadin has raised $255.5 million in Series B funding co-led by Andreessen Horowitz (a16z) and Accel that brings the company’s valuation to over $2.5 billion. The round includes participation from new investors Bain Capital Ventures (BCV) and Redpoint. Existing investors 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins, and Menlo Ventures also returned, reflecting their continued confidence, bringing Armadin’s total funding to $445 million. Seven months after emerging from stealth, Armadin is running agentic attack … More → The post Armadin raises $255.5 million to expand AI offensive security platform appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix. DORA relevance: medium.
Por qué importa
Se han identificado vulnerabilidades críticas asociadas a proveedores clave (Cisco, Google, Citrix) que requieren validación inmediata en el inventario de activos.
Acción recomendada
Auditar el inventario de activos para identificar versiones afectadas de Cisco, Google y Citrix y aplicar los parches de seguridad correspondientes.
Legit Security has announced an expansion of its Agentic Remediation capability to cover vulnerabilities found in open-source dependencies, not just first-party code, enabling development teams to move from vulnerability detection to a verified fix without manual triage. The expansion addresses a growing gap in application security: as AI-generated code accelerates software delivery, most modern codebases are made up largely of open-source dependencies, and every new package introduces potential exposure to known vulnerabilities. Traditional find-it, fix-it … More → The post Legit Security extends automated fixes to vulnerable open-source dependencies appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix. DORA relevance: medium.
Por qué importa
Se han identificado vulnerabilidades en dependencias de código abierto que afectan a productos de Cisco, Google y Citrix, requiriendo validación de exposición en el inventario.
Acción recomendada
Audita el inventario de software para identificar la presencia de CVE-2026-76504 y CVE-2026-88772 y aplica los parches recomendados por los proveedores.
Exabeam has introduced a new wave of capabilities that bring the Agentic SOC to life in the cloud and on-premises environments, combining AI-driven investigation, execution, and governance. Analyst workflows alone can’t keep pace with machine-speed threats or the growing complexity of goal-driven AI agents and autonomous workflows. The future of the SOC is agentic. For more than a decade, Exabeam has built applied machine learning into security operations, beginning with its pioneering work in user … More → The post Exabeam brings AI-assisted security investigations to data that must stay on-premises appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix, GitHub, Elastic. DORA relevance: medium.
Por qué importa
Se han reportado vulnerabilidades asociadas a múltiples proveedores críticos en el ecosistema, requiriendo validación de inventario.
Acción recomendada
Verificar la presencia de los activos afectados (Cisco, Google, Citrix, GitHub, Elastic) y aplicar parches si las versiones son vulnerables.
The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root. The post Zammad Zero-Days Exploited in AI-Powered DIVD Hack appeared first on SecurityWeek. CVEs: CVE-2026-102489, CVE-2026-102490. Vendors: Microsoft, Cisco, Google, Citrix, GitHub, Mozilla, OpenSSL, WatchGuard. DORA relevance: medium.
Por qué importa
Explotación activa de zero-days en Zammad que permite ejecución remota de código y escalada de privilegios a root, con riesgo crítico de compromiso total del sistema.
Acción recomendada
Identificar y aislar inmediatamente cualquier instancia de Zammad expuesta, aplicar parches de seguridad si están disponibles y auditar logs en busca de intentos de secuestro de sesión.
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU <br/>Security Impact Rating: Critical <br/>CVE: CVE-2026-76504 CVEs: CVE-2026-76504. Vendors: Cisco, Mozilla. DORA relevance: medium.
Por qué importa
Una vulnerabilidad crítica permite a atacantes remotos no autenticados acceder a la API de Cisco Catalyst SD-WAN Manager con privilegios de administrador.
Acción recomendada
Identifica de inmediato los sistemas afectados, aplica las actualizaciones de Cisco y restringe la exposición de la API mientras se valida la corrección.
Vendors:CiscoCISO · Cloud Security · SecOps
Mapeo regulatorio · riesgo 65
La vulnerabilidad crítica permite acceso remoto no autenticado con privilegios de administrador y exige gestión prioritaria del riesgo TIC, aunque no hay evidencia de explotación activa o incidente material.
DORA · Art. 10 Detection (direct) · Art. 13 Learning and evolving (direct) · Art. 15 Further harmonisation of ICT risk management tools, methods, processes and policies (direct)
BlackFog has announced the launch of ADX Vision 2.0, expanding its AI security capabilities to help organizations govern and control the use of generative and agentic AI across the enterprise. As employees move from simply interacting with AI tools to deploying agents capable of making decisions and acting on corporate data, the security challenge for organizations is changing. Traditional controls were not designed to address risks such as prompt injection, unauthorized data exposure and limited … More → The post BlackFog adds prompt protection and governance for agentic AI appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix, GitHub. DORA relevance: high.
Por qué importa
La presencia de vulnerabilidades críticas en stacks tecnológicos críticos (Cisco, Google, Citrix, GitHub) combinada con la adopción de agentes de IA aumenta la superficie de ataque y el riesgo de exposición de datos bajo normativas DORA y GDPR.
Acción recomendada
Audita inmediatamente el inventario de activos para identificar versiones afectadas de Cisco, Google, Citrix y GitHub y aplica los parches de seguridad disponibles.