Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Priority Command Strip
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Studio para abrir el feed completo, histórico ampliado y el catálogo KEV.
Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...] CVEs: CVE-2026-104286. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Fortinet, Citrix, F5, Atlassian, GitHub, Check Point. DORA relevance: medium.
Por qué importa
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Sin CVEs críticas frescas en la ventana actual.
Sin nuevos advisories PSIRT de vendor en la ventana.
Explotación activa confirmada. Riesgo material para entornos expuestos.
La vulnerabilidad CVE-2026-104286 está siendo explotada activamente en ataques zero-day, permitiendo la ejecución remota de código en dispositivos FortiMail críticos.
Acción recomendada
Identifique y parche inmediatamente todos los dispositivos FortiMail expuestos; no posponga la remediación al ciclo mensual.
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the ShinyHunters group defaced the website. The group claimed to have stolen employee and applicant information and shared samples of purported FBI personnel […] The post 28th September – Threat Intelligence Report appeared first on Check Point Research. CVEs: CVE-2026-85102, CVE-2026-93616, CVE-2026-94127, CVE-2026-87902. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Google, F5, WordPress, PHP, HPE, Check Point. DORA relevance: high.
Por qué importa
Se ha detectado explotación activa asociada a CVEs con señal CISA KEV y actividad no autorizada, incluida la desfiguración de FBIjobs.gov y una posible sustracción de datos.
Acción recomendada
Verifica inmediatamente la exposición a las CVEs afectadas, prioriza el parcheo fuera del ciclo mensual y valida cualquier indicio de compromiso o exfiltración.
La actividad no autorizada y la posible sustracción de datos de empleados y solicitantes requieren verificar de inmediato la responsabilidad del controlador y la adecuación de las medidas de protección de datos.
Cyber threat groups have increasingly targeted enterprise AI assets, such as credentials, cloud environments, and research, as a means for operationalizing their own use of AI. Now, another sophisticated means for obfuscating illegitimate use of AI resources is coming more clearly to light. According to a report last week from security firm Team Cymru, malicious actors are employing proxy servers, known as transfer stations, to hide the origin of traffic to frontier AI models, providing cover for model distillation attacks and potential abuse of stolen AI subscription credentials. Team Cymru researchers initially identified 10,867 such servers running two open-source relay platforms called Claude Relay Service (CRS) and its successor, sub2api. Their investigation later expanded, and the total number of such proxies is now estimated at more than 80,000. “A transfer station breaks the assumption every frontier-model control depends on: that the account making a request belongs to the party consuming the answer,” said Scott Fisher, senior principal engineer at Team Cymru, in the company’s report. “What we have uncovered is an entire ecosystem designed explicitly to break the frontier model providers’ T&Cs, enabling fraud and illicit activity.” These transfer services authenticate customers with their own accounts but connect to upstream AI services using pools of API keys or logged-in consumer subscriptions that in many cases have been obtained through malicious activities such as credential theft. Team Cymru managed to tie several clusters of activity through these proxies to IP addresses in China and Hong Kong. Considering that over half of the transfer gateways are hosted on VPS services in the US, it suggests the intent is to hide the geographic location of the traffic, potentially to enable model distillation attacks, in which targeted prompts are designed to extract model knowledge that is then used to train and improve other AI models. All the frontier labs have CISA KEV/exploitation signal detected. Vendors: Cisco, Palo Alto Networks, Google, AWS, Citrix, F5, GitHub, Okta, Node.js, MikroTik. DORA relevance: high.
Por qué importa
Existe una economía activa de proxies que utiliza credenciales y API keys robadas para ocultar el origen del tráfico, abusar de servicios de IA y facilitar posibles ataques de destilación de modelos.
Acción recomendada
Revoca y rota inmediatamente las credenciales y API keys expuestas, inspecciona el uso anómalo de servicios de IA y bloquea proxies o relay no autorizados.
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...] CVEs: CVE-2026-88771, CVE-2026-88772. CISA KEV/exploitation signal detected. Vendors: Microsoft, Adobe, Citrix, F5, SonicWall, Atlassian, Cloudflare. DORA relevance: medium.
Por qué importa
Dos vulnerabilidades críticas de ejecución remota de código en Citrix NetScaler están siendo explotadas activamente y cuentan con actualizaciones de seguridad disponibles.
Acción recomendada
Comprueba inmediatamente la exposición, aplica las actualizaciones de Citrix sin esperar al ciclo mensual y busca indicios de explotación en los dispositivos afectados.
La explotación activa de dos vulnerabilidades críticas de ejecución remota exige una respuesta inmediata de gestión de vulnerabilidades y supervisión de la gobernanza de ciberseguridad bajo NIS2.
Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week. [...] CVEs: CVE-2026-19490, CVE-2026-19489. CISA KEV/exploitation signal detected. Vendors: Microsoft, Adobe, Citrix, F5, SonicWall, Atlassian, Cloudflare. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Comprueba la exposición a CVE-2026-19490, CVE-2026-19489 en el inventario de activos y las herramientas de vulnerabilidades.
[CISA KEV actively exploited] Vendor: F5 | Product: BIG-IP APM | F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-25 | Ransomware use: Unknown | Added: 2026-09-22 CVEs: CVE-2026-94127. CISA KEV/exploitation signal detected. Vendors: F5. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
[CISA KEV actively exploited] Vendor: F5 | Product: BIG-IP | F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-03-30 | Ransomware use: Unknown | Added: 2026-03-27 CVEs: CVE-2025-53521. CISA KEV/exploitation signal detected. Vendors: F5. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
HTML source discovery from thehackernews.com CVEs: CVE-2026-104286, CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Google, Fortinet, Citrix, F5, Zyxel, GitLab, Linux, WordPress, Veeam, MikroTik, Cloudflare, Check Point. DORA relevance: medium.
Por qué importa
La vulnerabilidad CVE-2026-104286 en FortiMail está siendo explotada activamente in-the-wild y ha sido incluida en el catálogo KEV de CISA, permitiendo ejecución de escritura de archivos no autenticada.
Acción recomendada
Identificar y parchear inmediatamente los dispositivos FortiMail afectados; no esperar al ciclo de mantenimiento regular y realizar triage de seguridad hoy mismo.