Ingeniero de Detección: 2026-09-19

1. Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

   The Hacker News, 2026-09-19. Leer, 3 min.

   CVE-2026-58138, CVSS 9.8, lets an unauthenticated attacker submit a crafted workflow definition to the Orkes Conductor API and escape unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true), reaching OS command execution through the INLINE, LAMBDA, DO_WHILE and SWITCH task types. It affects versions 3.21.21 before 3.30.2. Fortinet reports attackers actively targeting Conductor servers, having blocked nearly 7,000 attempts between 2 and 9 September including 1,290 in one 24-hour span, a 132 percent increase; the majority of that activity is said to have originated from Germany, Hong Kong, Indonesia, the UAE and India. The fix is to upgrade to 3.30.2 or later and, where that is not immediate, to restrict external API access and monitor for suspicious workflow submissions.

   Por qué importa para este rol: Write detection for unauthenticated workflow submissions carrying INLINE, LAMBDA, DO_WHILE or SWITCH tasks, and alert on Conductor processes spawning OS commands. Exploitation is already happening at volume, so this is a rule to ship this week rather than a backlog item.

2. Building an AI Detection Engine That Understands Agent Intent

   Wiz Research, 2026-09-17. Leer, 11 min.

   Wiz researchers describe a multi-stage AI detection pipeline that ingests model input and output logs from cloud and model providers, including system prompts, tool specifications and tool results, surfaces candidates with regex and secrets matching, then uses a small language model to filter noise and a larger model to judge intent shift. Verdicts are correlated with cloud and runtime events to separate what an agent intended from what it actually did. Wiz says AWS Bedrock invocation logs are available today to Wiz Defend customers in private preview, and reports evaluating the pipeline against 102 scenarios it built itself in controlled fictional environments, 57 injected attacks and 45 benign workflows.

   Por qué importa para este rol: If model invocation logging is not turned on, turn on Bedrock invocation logs and look at what prompt and tool-call records actually give you as a source. The design point worth copying is that intent read from model input and output stays a lead until you correlate it with cloud and runtime events showing what the agent did.

3. Using Cyber Decoys to Strengthen Detection and Response

   Cybersecurity and Infrastructure Security Agency (CISA), 2026-09-16. Leer, 2 min.

   CISA published guidance on 16 September 2026 on using cyber decoys, which it defines as assets that appear to be legitimate systems, accounts, or data but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence. The page names honeytokens among the decoy concepts it covers, alongside tripwires and breadcrumbs. The landing page is a short overview and the guidance itself is a downloadable PDF. Listed audiences include executives, federal government, industry, small and medium businesses, and state, local, tribal and territorial government.

   Por qué importa para este rol: Read the PDF and pick one decoy you can place this week, such as a honeytoken credential that no legitimate process should ever use, then wire its use to a high-confidence alert. The published definition also gives you the language to justify the build.

Ingeniero de Detección