The Hacker News

La señal de hoy The Hacker News ha publicado Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 (10 de septiembre de 2026). Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident dates back to January 2026 and involved an early version of Cla ...

La señal de hoy The Hacker News ha publicado Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox (9 de septiembre de 2026). Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome’s JavaScript and WebAssembly engine. “Out-of-bounds write in V8 ...

La señal de hoy The Hacker News ha publicado Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted (5 de septiembre de 2026). Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the secur ...

La señal de hoy The Hacker News ha publicado Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code (5 de septiembre de 2026). Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploi ...

La señal de hoy The Hacker News ha publicado Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores (5 de septiembre de 2026). Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store’s server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on Septembe ...

La señal de hoy The Hacker News ha publicado Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws (4 de septiembre de 2026). Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files ...

La señal de hoy The Hacker News ha publicado Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure (1 de septiembre de 2026). Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory. “JFrog Artifactory contains an authentication w ...

La señal de hoy The Hacker News ha publicado Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials (2 de septiembre de 2026). Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers ...

La señal de hoy The Hacker News ha publicado Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance (31 de agosto de 2026). Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone cannot tell you whether an agent’s access is legitimate. AI has mo ...

La señal de hoy The Hacker News ha publicado PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions (28 de agosto de 2026). PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it’s “aware of confirmed customer incidents and is treating this matter with t ...

La señal de hoy The Hacker News ha publicado Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server (28 de agosto de 2026). cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. cPanel described the issue as a critical security vulnera ...

La señal de hoy The Hacker News ha publicado Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode (25 de agosto de 2026). Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck’s CVE Numbering Authority (CNA) record. The CNA record says the command can run as a local subprocess when the notebook is opened in e ...