Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Sin señales activamente explotadas ni parches de emergencia.
Priority Command Strip
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Pro para abrir el feed completo, histórico ampliado y el catálogo KEV.
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Explotación reportada sobre Microsoft / Google. Verificar exposición real en el inventario.
Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system into Safe Mode with Networking enabled. According to Huntress, the technique successfully took both its agent and Microsoft Defender’s real-time protection offline. This, the researchers said, gave the attacker a window to operate without endpoint defenses. The incident investigated by Huntress began on August 4 with a credential-spraying attack against an exposed SonicWall SSL VPN. About seven minutes after the failed login attempts began, an attacker successfully authenticated to an account that did not have multi-factor authentication (MFA) enabled, Huntress analyst James Northey said in a blog post. Two hours after authentication was managed, the operator reportedly accessed the domain controller over RDP, performed extensive Active Directory enumeration, and subsequently moved to an application server to archive mapped file shares with WinRAR. The stolen data was uploaded to an attacker-controlled S3 bucket using s5cmd, establishing the data-theft component of a double-extortion attack. Ultimately, AnyDesk was installed on the host machine for persistent remote access and to deliver the Akira ransomware payload. This is when the operator used “msconfig.exe” to force the machine into Safe Mode with Networking, instead of disabling EDR directly. Huntress says this is the first time it has observed Akira using the technique. Safe Mode is becoming a popular ransomware technique Safe Mode is normally a Windows troubleshooting environment that loads only essential drivers and services. That makes it useful to attackers because many third-party security products are excluded from the minimal startup configuration. Anticipating that AnyDesk itself might also be unavailable in Safe Mode, the attackers modified the Safe Boot registry configuration to ensure the remote-access service would start. The approach is not e Vendors: Microsoft, Google, AWS, Oracle, SonicWall, Atlassian, GitHub. DORA relevance: high.
Por qué importa
Explotación reportada sobre Microsoft / Google. Verificar exposición real en el inventario.
Acción recomendada
Avisa a los owners de los stacks Microsoft, Google, AWS, Oracle.
Cyber defenders need to shake off traditional best practices and switch from reactive patching to building inherently resilient systems in the face of AI-accelerated vulnerability discovery, according to a senior security manager at Microsoft. David Weston, group manager in the Windows team at Microsoft, told delegates at Black Hat USA that traditional approaches to vulnerability remediation fail to work in an era when AI tools are making vulnerability discovery and exploit development cheaper, faster, and more scalable. Weston’s keynote — entitled “The End of Rare: Defending When Offense Is Cheap” — challenged industry vulnerability best practices that Weston said where from a time when developing exploits and mounting attacks was time consuming and expensive. That’s no longer the case, he said. As evidence, Weston explained how the Microsoft Security Response Center (MSRC) is doubling the number of vulnerabilities it processes and patches every six weeks. “That is an incredible number,” he said. “We’re nine times the vulnerability volume that we were in March.” The accelerating pace of vulnerability discovery is “highly correlated” to rising use of increasingly capable AI tools, and presents a cross-industry problem, he said. “These are serious vulnerabilities, the kind that I used to take a year to bespoke craft,” Weston pointed out. “They’re being spit out at industrial speed, and it’s not [just] Windows. You look at Linux, you look at any other operating system out there, I think you’ll see a pretty strong correlation.” Microsoft’s MDASH, short for Multi-model Agentic Scanning Harness, found roughly 200 Linux kernel vulnerabilities in the company’s internal Azure Linux distribution that Microsoft is working with the community to fix. Microsoft also added a new module to MDASH to help its engineers triage vulnerabilities. The technology is capable of turning a static analysis result into proof-of-concept exploit code. “That’s worked much better than we ever thou Vendors: Microsoft, Google, Linux. DORA relevance: high.
Por qué importa
Explotación reportada sobre Microsoft / Google. Verificar exposición real en el inventario.
Acción recomendada
Avisa a los owners de los stacks Microsoft, Google, Linux.
Group-IB researchers discovered WindRelay, a new Android malware built to capture live payment card data over NFC (Near Field Communication) and relay it to attackers in real time. WindRelay is paired with the SpyNote remote access trojan, which gives attackers remote access to a victim’s device. Attack chain overview (Source: Group-IB) How the scam unfolds The scam starts with a phone call, in which the fraudster claims to be from the victim’s bank and says … More → The post New Android malware relays bank cards to fraudsters while victims still hold them appeared first on Help Net Security. CVEs: CVE-2026-20349, CVE-2026-68820. Vendors: Microsoft, Cisco, Google, Salesforce, ServiceNow. DORA relevance: high.
Por qué importa
CVE de alto impacto sobre Microsoft / Cisco. Planificar ventana de parche.
Acción recomendada
Comprueba la exposición a CVE-2026-20349, CVE-2026-68820 en el inventario de activos y las herramientas de vulnerabilidades.
Researchers have found that compromised or malicious SIM cards can issue commands to some smartphones and cellular-connected devices, allowing attackers to steal information, disrupt communications, downgrade connections to 2G, and in some cases execute code. Tomasz Piotr Lisowski and Dr Marius Muench of the University of Birmingham, working with Kristian Covic from Fuzzware, traced this to a legitimate function already built into the cellular spec. That function is Proactive SIM. It lets a card send … More → The post Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G appeared first on Help Net Security. CVEs: CVE-2025-48618, CVE-2026-18577. Vendors: Google. DORA relevance: high.
Por qué importa
CVE de alto impacto sobre Google. Planificar ventana de parche.
Acción recomendada
Comprueba la exposición a CVE-2025-48618, CVE-2026-18577 en el inventario de activos y las herramientas de vulnerabilidades.
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur. CVEs: CVE-2026-19137, CVE-2026-19138, CVE-2026-19139, CVE-2026-19140, CVE-2026-19141. Vendors: Microsoft, Google. DORA relevance: medium.
Por qué importa
CVE de alto impacto sobre Microsoft / Google. Planificar ventana de parche.
Acción recomendada
Comprueba la exposición a CVE-2026-19137, CVE-2026-19138, CVE-2026-19139 en el inventario de activos y las herramientas de vulnerabilidades.
De multiples vulnérabilités ont été découvertes dans Google Android. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur. Vendors: Google. DORA relevance: medium.
Por qué importa
CVE de alto impacto sobre Google. Planificar ventana de parche.
Acción recomendada
Avisa a los owners de los stacks Google.
Severity: 1.1, Published: 2026-08-12 CVEs: CVE-2026-0291. Vendors: Microsoft, Palo Alto Networks, Google, Apple. DORA relevance: medium.
Por qué importa
Advisory oficial de Microsoft / Palo Alto Networks. Validar versiones desplegadas.
Acción recomendada
Comprueba la exposición a CVE-2026-0291 en el inventario de activos y las herramientas de vulnerabilidades.
Firecrawl extraction from security.paloaltonetworks.com CVEs: CVE-2026-0293. Vendors: Microsoft, Palo Alto Networks, Google, Apple. DORA relevance: medium.
Por qué importa
Advisory oficial de Microsoft / Palo Alto Networks. Validar versiones desplegadas.
Acción recomendada
Comprueba la exposición a CVE-2026-0293 en el inventario de activos y las herramientas de vulnerabilidades.