The Hacker News

La señal de hoy The Hacker News ha publicado WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV (25 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in ...

La señal de hoy The Hacker News ha publicado Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates (22 de septiembre de 2026). A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defen ...

La señal de hoy The Hacker News ha publicado Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access (22 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that cou ...

La señal de hoy The Hacker News ha publicado Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks (16 de septiembre de 2026). Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 (CVSS score: 7.8), is described as a case of local privilege escalation due to insecure file permissions. It affects the following versions - Acronis Backup p ...

La señal de hoy The Hacker News ha publicado Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation (18 de septiembre de 2026). Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. “Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate ...

La señal de hoy The Hacker News ha publicado CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild (19 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnera ...

La señal de hoy The Hacker News ha publicado Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records (17 de septiembre de 2026). A security breach at Gyazo, Helpfeel’s image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday. It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo imag ...

La señal de hoy The Hacker News ha publicado Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation (16 de septiembre de 2026). Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 (CVSS score: 8.0), is a privilege escalation flaw. “In Cellular Modem, there is a possible permission bypass due to a logic error in the code,” according to a description of the bug in the N ...

La señal de hoy The Hacker News ha publicado Threat Intelligence Alone Won’t Close the Exploitation Gap (16 de septiembre de 2026). A leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelerate the path from exposure to breach faster than most securit ...

La señal de hoy The Hacker News ha publicado Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds (15 de septiembre de 2026). With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a v ...

La señal de hoy The Hacker News ha publicado CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV (12 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1 ...

La señal de hoy The Hacker News ha publicado N-able N-central Pre-Auth RCE Flaw Exploited in the Wild (9 de septiembre de 2026). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026. The vulnerability in question is CVE-2026-86218 (CVSS score: 1 ...