CyberSecurity Researcher/Speaker/Pro-Pentester - ISO/IEC 27001 Certified Bug Bounty Hunter from Mx 🇲🇽🇪🇸 🏴☠️ #m10sec
Joined April 2010
- Tweets16.5K
- Following810
- Followers57.3K
- Likes119K
El M10 🏴☠️ retweeted
🔴 #URGENTE | Una convocatoria por TikTok reclutó a los 600 jóvenes que han arrasado el centro de Barcelona dozz.es/lfr08
El M10 🏴☠️ retweeted
🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours.
That's not all.
→ Signs of agentic AI use in post-exploitation activity
→ Suspected Lazarus-linked operators scanning 216 targets worldwide
Full details ↓ thehackernews.com/2026/10/ph…
El M10 🏴☠️ retweeted
🚨🇪🇸 | GRAVE: Renfe anuló un contrato de ciberseguridad e ignoró un informe de Defensa antes del hackeo. Meses antes adjudicó otro contrato sin publicidad por 8,8 millones menos a una empresa del sector.
El M10 🏴☠️ retweeted
🛡️ Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations
Details: cybersecuritynews.com/micros…
Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information.
Microsoft detailed the change in Message Center notice MC1519866, published on October 21, 2026. Targeted Release is scheduled to begin in early November and finish by mid-November. Worldwide general availability is expected to start in early December and finish by mid-December, rather than reaching every customer in November.
#cybersecuritynews
El M10 🏴☠️ retweeted
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailsc…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
El M10 🏴☠️ retweeted
El agente IA Claude Mythos 5 de Anthropic intentó inyectar código malicioso y engañar a desarrolladores
Anthropic ha revelado que su agente de IA, Claude Mythos 5 , intentó insertar código malicioso en un proyecto real de GitHub durante una prueba
blog.elhacker.net/2026/10/el…
El M10 🏴☠️ retweeted
⚠️🇲🇽 Alerta: Se reporta en canales de Telegram la presunta filtración y comercialización de una base de datos perteneciente a INTER[.]MX, uno de los principales brokers digitales de seguros en México, que comprometería más de 970,000 registros de clientes y prospectos,
El M10 🏴☠️ retweeted
Que cojones está pasando en Barcelona?
Este acaba de entrar en una tienda Pandora a robar todo lo que ha podido con 7k personas en directo
Que asco de país se está quedando
El M10 🏴☠️ retweeted
Millones de dispositivos vulnerables a ataques RCE por el abandono de la app Popcorn Time
Investigadores de Eye Security desactivaron remotamente un actualizador vulnerable en la aplicación abandonada Time4Popcorn
blog.elhacker.net/2026/10/mi…
El M10 🏴☠️ retweeted
Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated.
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi
El M10 🏴☠️ retweeted
CIA can access your phone and laptop cameras and microphones, says former CIA officer John Kiriakou.
El M10 🏴☠️ retweeted
‼️ Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Details: cybersecuritynews.com/palo-a…
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces.
The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell.
#cybersecuritynews
El M10 🏴☠️ retweeted
‼️ OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in Red-Teaming Tests
Details: cybersecuritynews.com/openai…
OpenAI says its AI agents found zero-day flaws, escaped sandboxes, reached the live internet, and exchanged information across isolation boundaries during large red-teaming tests of its research systems.
The findings, published on October 23, show how advanced models can chain software bugs and setup errors to bypass controls designed to contain them. The company said it repaired the weaknesses and worked with open-source maintainers on patches.
These tests involved internal training and evaluation systems, not the environments customers use with released OpenAI models.
#cybersecuritynews
El M10 🏴☠️ retweeted
⚠️ PALO ALTO: PHP2SHELL FLAWS HIT PAN-OS AND PANORAMA MANAGEMENT INTERFACE, HOTFIXES DUE OCT 26–30
Palo Alto Networks says the critical PHP RCE pair CVE-2026-109618 / CVE-2026-109619 ("PHP2Shell") affects PAN-OS and Panorama 10.2, 11.1, 11.2, 12.1 and 12.2. Severity HIGH (CVSS-B 8.7).
* Only the management web interface (HTTPS web UI and XML API) is affected, including data-plane interfaces with a management profile attached.
* GlobalProtect portal/gateway, Clientless VPN and Captive Portal are NOT impacted. Cloud NGFW and Prisma Access are unaffected.
* No PAN-OS fixes yet: hotfixes have ETAs of Oct 26–30 depending on branch.
* Until then, restrict management access to trusted internal IPs or a jump box. Threat Prevention users can enable Threat IDs 543004, 97622–97625 (content 9162+).
* Palo Alto is not aware of malicious exploitation against its products.
security.paloaltonetworks.co…
#PaloAlto #PANOS #PHP2Shell #CyberSecurity
El M10 🏴☠️ retweeted
Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code
Details: cybersecuritynews.com/multip…
F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176.
F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0. The bugs do not make every NGINX server vulnerable by default because each one needs a specific software version and configuration.
F5’s advisories do not report active exploitation of these three newly disclosed flaws.
#cybersecuritynews
El M10 🏴☠️ retweeted
🚨 Node2Shell Node.js RCE Exploit Lets Attackers Execute Malicious Code
Details: cybersecuritynews.com/new-no…
Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js.
The Node.js security advisory, published on October 21, 2026, confirms that the flaw can allow remote code execution and affects the 22.x, 24.x, and 26.x release lines. Fixes are available across all three branches. The code delivered with the compressed data created a marker file that the test application was not instructed to produce.
#CybersecurityNews
El M10 🏴☠️ retweeted
Surge un tercer fallo de PHP2Shell que no recibirá un parche de emergencia
La Fundación PHP informó el viernes que ha reservado un identificador CVE (CVE-2026-115560) para un tercer fallo de RCE que se suma a los dos primeros que componen PHP2Shell, y publicará un aviso completo y el software corregido con la próxima versión regular de PHP
blog.elhacker.net/2026/10/su…
