Humor y tecnología de la mano
Joined August 2012
- Tweets2.9K
- Following274
- Followers107
- Likes3.6K
Compukiks retweeted
Jangan cuma scan SKILL.md. Malware-nya bisa aja ngumpet di file lain dalam repo.
Seorang peneliti nemuin 73 repo GitHub yang nyamar jadi AI agent tools, MCP server, dan proyek lain. Banyak yang README-nya kelihatan normal, tapi ngarahin pengguna Windows buat download ZIP installer dari repo. Di dalamnya ada launcher .bat, runtime LuaJIT, dan script obfuscated yang dipakai buat ngirim malware.
Sebelum install skill atau agent tool, cek seluruh repo, termasuk README, installer, scripts, hooks, dan file yang ikut didistribusikan. Periksa juga pemilik repo dan riwayat commit, terutama perubahan README yang tiba-tiba muncul di repo lama.
Kalau ada ZIP installer dari repo, jangan langsung dijalankan. Baca isinya dan verifikasi dulu.
Compukiks retweeted
CVE-2026-42533: critical nginx heap overflow via the map directive, with public ASLR-defeating exploit code. Get the Nuclei detection template and scan with Sn1per. sn1persecurity.com/wordpress…
#CVE-2026-42533 #bugbounty #netsec #infosec #offsec #redteam #EASM #infosecurity
Compukiks retweeted
🔴 CRITICAL 10.0 · Confection WordPress Cable: unauthenticated remote code execution in settings saving (CVE-2026-115252)
Anyone on the network can run arbitrary PHP code on the server without logging in.
👉 No patch yet · affected: >=0.4.0 <=0.4.7
cve.now/CVE-2026-115252?utm_…
Compukiks retweeted
🆕 New CVE
Contact Form 7: remote code execution via unauthenticated form file upload (CVE-2026-114432)
Unauthenticated visitors can upload arbitrary files that may run as code on common Apache setups.
Patch → 6.2.4
cve.now/CVE-2026-114432?utm_…
Compukiks retweeted
⚠️ A new Linux kernel vulnerability (CVE-2026-98276) is a race condition in the socket code that can lead to a use-after-free of a UDP socket.
AlmaLinux 8, 9, and 10 are affected.
Patched kernels are available in the testing repository!
almalinux.org/blog/2026-11-0…
Compukiks retweeted
🔴 | HACKERS ATACAN A SINALOA
Ojo con las últimas publicaciones del grupo criminal Hackero$. Siguen exfiltrando bases de datos del estado de Sinaloa y, como muestra de la información a la que pueden acceder, expusieron todos los datos del exgobernador Rubén Rocha Moya y de la gobernadora interina Graciela Domínguez Nava.
En los casos de estos últimos funcionarios se evidencia cómo, para sus respectivos «doxxeos», utilizan también bases de datos a nivel federal y realizan cruces de información para obtener datos de sus familiares.
Esto se está replicando en varios estados. Se está normalizando que los delincuentes puedan acceder con tanta facilidad a todos nuestros datos.
Compukiks retweeted
🛡️ Hackers Launch 240,000 Attempts to Exploit a WordPress Core Flaw That Allows RCE
Details: cybersecuritynews.com/240000…
Hackers have launched more than 240,000 exploit attempts against a WordPress Core vulnerability that can allow attackers to run malicious code without logging in.
The attacks began on October 28, 2026, the same day WordPress released a security update addressing the flaw. Tracked as CVE-2026-119977, the vulnerability carries a high severity CVSS score of 8.1. It affects unpatched WordPress branches from 4.7 through 7.1.3.
#cybersecurityNews
Compukiks retweeted
Investigadores hallan IP de la Casa Blanca en alquiler vía 28 proxies
Investigadores de Layer3 Intel descubrieron que 28 servicios de proxy residenciales estaban alquilando direcciones de la red de la Casa Blanca
blog.elhacker.net/2026/11/in…
Compukiks retweeted
🇲🇽 🚨 SANTILLANA CONNECT: THREAT ACTORS CLAIM ~13M EDUCATION-PLATFORM ACCOUNT RECORDS
Threat actors on an underground forum claim to have leaked a CSV database allegedly from Santillana Connect / Santillana Compartir, the Santillana Group education platform used by Latin American schools.
According to the post:
• 12,980,190 CSV rows claimed
• Fields claimed: user IDs, usernames, full names, ages, dates of birth, Mexican CURP national IDs, emails, phone numbers, nationality
• Actors also claim roughly 9 million student accounts and 3 million teacher accounts
The claim has not been independently verified.
⚠️ Analyst Note:
Education-platform account data that includes Mexican CURP (national ID), dates of birth and contact details is highly sensitive for schools, families and staff across LatAm. Treat authenticity and scope as unconfirmed until Santillana or a regulator speaks. Unverified threat-actor claim — NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: xitter.gq/DailyDarkWeb/creator-s…
#DDW #DarkWeb #Mexico #LatAm #Santillana #EdTech #Education #DataLeak #CURP #ThreatIntelligence #CyberSecurity
Compukiks retweeted
🚨 Hoy en ciberseguridad :
🔴 Amazon México: un tal f*******i pone a la venta 6.68 millones de registros con nombres, compras y precios. Solo lo reporta VECERT, sin muestra seria y Amazon no ha dicho nada. Ojalá sea scraping viejo, porque si es real ya saben qué te compraste.
🔴 WordPress: CISA metió al KEV el CVE-2026-119977, una race condition del core que ya se explota. Wordfence dice que bloqueó 13,095 ataques en un día. Si tu sitio sigue sin el 7.1.4, actualiza hoy y no el viernes.
bleepingcomputer.com/news/se…
🔴 Policía Federal Argentina: MortemTeam (SkyLing) dice tener 26 GB con biometría de agentes, documentos y hasta escuchas. Varias cuentas lo reportan; la PFA no ha confirmado nada.
xitter.gq/DailyDarkWeb/status/21…
Foros llenos de "bases" y sitios sin parchar. Mientras no actualicen, esto no para. xitter.gq/VECERTRadar/status/211…
⚠️ 🇲🇽 📦 🗄️ PREVENTIVE ALERT - ALLEGED DATA EXPOSURE AT AMAZON MEXICO (AMAZON MEXICO DATA: 6.68M RECORDS)
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: F*******I / DATE: NOVEMBER 3, 2026]
Centralized cyber-intelligence systems have intercepted a commercial offer on underground marketplaces advertising the alleged sale of a massive database containing 6.68 million records linked to the Amazon Mexico platform.
It is strictly noted that the veracity of this leak, the initial vector of compromise, and the overall authenticity of the 6.68 million records have not been officially confirmed by Amazon’s corporate offices or incident response centers. As this concerns posts on underground forums, the definitive status of the data remains alleged and unconfirmed.
Posted by: User f*******i.
Victim / Target: Amazon Mexico (E-commerce platform) — 🇲🇽 Mexico.
Sector: 🛒 E-commerce, Retail, and Digital Consumer Transactions.
Date of Publication: November 3, 2026.
Stated Volume: 6,680,000 records.
Nature of the Incident: Alleged exfiltration and offering for sale of databases containing purchase information, customer names, product metadata, and transactional histories.
🔍 TECHNICAL BREAKDOWN OF THE COMPROMISED INFORMATION
Exposed Data Structure:
Domain-of-origin identifiers (Amazon. com.mx).
Numerical transaction codes or user identification codes. Full names of the buyers
Details of products purchased or viewed (e.g., Apple iPhone models).
Product ratings, review counts, sale prices in local currency, and direct links to multimedia resources on the platform.
🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / E-COMMERCE)
Security Audit of Gateways and APIs: The platform’s security engineering teams should immediately review access logs and access control policies for analytical or reporting systems to rule out unauthorized data exfiltration.
Consumer Protection and Alerts: Since the records expose names and purchase histories, it is recommended to alert users about potential targeted phishing campaigns or impersonation scams involving purported Amazon orders.
Monitoring of Clandestine Channels: Track the circulation of the file on hacker forums to determine whether the complete database has been distributed for free or if it remains part of an exclusive sale scheme.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: analyzer.vecert.io
Quickly verify your security at: monitor.vecert.io
Quotes and services: vecert.io/contact
#AmazonMexico #Ecommerce #Retail #DataLeak #DataBreach #BreachAlert #DatabaseLeak #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk
Compukiks retweeted
🇲🇽 🚨 MEXICO: 7 MILLION SANTANDER BANK MEXICO CUSTOMER RECORDS ALLEGEDLY LEAKED
A threat actor on a dark web forum claims to hold records on 7 million customers of Santander Bank Mexico, one of the country's largest banks.
According to the claim:
* About 7 million customer records
* Said to come from Santander's Mexican operations
* No verifiable sample shown in the post
The claim has not been independently verified, and Santander Mexico has not commented.
⚠️ Analyst Note:
A listing with the same "7 million" figure and a Santander Mexico label appeared on another forum in early October under a different alias, so this may be recirculated or aggregated data rather than a fresh breach. Even so, bank-branded datasets fuel phishing and fake bank-call fraud. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Mexico #Santander #Banking #DataLeak #ThreatIntelligence
Compukiks retweeted
‼️Breaking - Hackers Hijacked French Blood Plasma Freezers, Changing Temperature Settings From −30°C to 110°C
Details: cybersecuritynews.com/french…
Hackers reportedly changed temperature settings on refrigeration equipment used by the French Blood Establishment, EFS, from around −30°C to 110°C after targeting its cooling service provider, Coolworld.
The incident occurred overnight between November 1 and 2, 2026, raising concerns about frozen plasma stored for patient transfusions. Coolworld supplies temperature-controlled equipment and maintenance services, including refrigerated containers used in medical settings.
An on-call technician reportedly noticed temperatures rising during the night, allowing teams to respond before the disruption affected operations.
#CybersecurityNews
Compukiks retweeted
🚨 BREAKING: WordPress just patched 22 security vulnerabilities, including a flaw that could allow REMOTE CODE EXECUTION.
WordPress 7.1.4 was released TODAY, and administrators are being urged to update immediately.
Here’s what was discovered:
→ Remote Code Execution (RCE): A race condition during WordPress updates could allow attackers to execute code during the upgrade window.
→ Multiple Stored XSS Vulnerabilities: Flaws affecting WordPress blocks, the Interactivity API, and administrative features.
→ Unauthenticated Information Disclosure: Attackers could access unpublished Customizer changes without logging in.
→ Denial of Service: A vulnerability in the Interactivity API could disrupt site availability.
→ AI-Discovered Vulnerabilities: Anthropic researchers contributed findings, including security issues involving personal data removal requests and user accounts.
⚠️ ACTION REQUIRED: Update to WordPress 7.1.4 or the appropriate patched version for your branch. Verify that automatic updates actually completed.
Running WordPress? Lucid Security is offering free website security assessments to help identify potential exposure.
🌐 lucidsecurity.si
Source: wordpress.org/news/2026/10/w…
🤖 Made with AI
Compukiks retweeted
A PoC/exploit has been discovered for vulnerability CVE-2026-42530
PT ID: PT-2026-50439
Read on dbugs: dbu.gs/vulnerability/PT-2026…
Vendor: F5
Product: NGINX Open Source
Description: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Link: github.com/udyz/cve-2026-425…
Compukiks retweeted
🚨 BREAKING: CRITICAL 9.5/10 VULNERABILITY THREATENS SERVERS WORLDWIDE. HACKERS COULD EXECUTE CODE BEFORE THE OPERATING SYSTEM EVEN LOADS.
Security researchers have uncovered a 16-year-old firmware vulnerability in technology used across the global server and data center ecosystem.
CVE-2026-97631 affects TianoCore EDK II, a foundational component used by major UEFI firmware vendors.
And the implications are serious.
🔴 Here's what we know:
➜ Pre-boot code execution: Attackers could execute malicious code at Ring 0, the CPU's highest privilege level, before operating system security controls are active.
➜ Widespread exposure: EDK II code is used extensively by firmware vendors including AMI, Insyde, and Phoenix, potentially exposing numerous enterprise servers.
➜ Security bypass potential: Successful exploitation could undermine the boot chain of trust and potentially enable persistent malware or compromise sensitive information.
➜ 16 YEARS UNDISCOVERED: The underlying buffer overflow has existed for approximately 16 years.
➜ Disclosure went wrong: Researchers from Anthropic and Google discovered the vulnerability, but a publicly released code fix exposed the issue months before its planned coordinated disclosure.
⚠️ THE BIG PROBLEM:
A source-code fix has been merged, but affected servers still require firmware updates from their manufacturers. Distributing those updates across enterprise infrastructure could take considerable time.
Important: Exploitation requires vulnerable firmware, PXE network boot, network access during the boot process, and target-specific knowledge. This is not an unrestricted remote exploit against every server.
Organizations should immediately review their firmware exposure, disable unnecessary network boot functionality, and check for vendor updates.
🔐 Lucid Security is offering FREE initial security reviews to help businesses identify potential vulnerabilities and reduce their attack surface.
🌐 lucidsecurity.si
CVE-2026-97631 | CVSS 9.5 CRITICAL
Source: Ars Technica / TianoCore Security Advisory
Compukiks retweeted
Pueden instalar puertas traseras en WordPress abusando de sesiones de administrador
Se ha detectado una nueva cadena de ataque que pone en riesgo a los administradores de WordPress que mantienen su panel de control abierto en el mismo navegador que usan para navegar habitualmente. Investigadores han documentado el uso de un cargador de JavaScript que, al detectar una sesión activa de administrador en una página comprometida, aprovecha dicha confianza del navegador para instalar un backdoor de PHP oculto en el sitio
blog.elhacker.net/2026/10/pu…
