Hacker News

New stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. Slow Servers (slowservers.net)
    1 pointsby 1 minute ago
    —discuss
  2. Detecting Compromised AI Coding Agents with Jev and Gryph (safedep.io)
    1 pointsby 7 minutes ago
    —discuss
  3. Cloud Emulators (github.com/upgundecha)
    1 pointsby 8 minutes ago
    2comments
  4. File Notification Attacks (inoti.fyi)
    1 pointsby 9 minutes ago
    —discuss
  5. Turbo Vision for Rust (enzolombardi.net)
    1 pointsby 10 minutes ago
    —discuss
  6. Researcher discloses vulnerabilities to OnePlus, they respond with legal threats (notebookcheck.net)
    1 pointsby 11 minutes ago
    —discuss
  7. Japan Electric Vehicle Association 1980年 [video] (youtube.com)
    2 pointsby 12 minutes ago
    —discuss
  8. Maybe don't let Muse run your Facebook Marketplace account (threads.com)
    8 pointsby 16 minutes ago
    2comments
  9. The Overhang (oneusefulthing.org)
    1 pointsby 18 minutes ago
    —discuss
  10. OpenAI pauses some training amid allegations its rogue agents behaved more (theregister.com)
    2 pointsby 24 minutes ago
    —discuss
  11. Show HN: A website for sharing Muse AI invitation codes (museaicode.cc)
    1 pointsby 26 minutes ago
    —discuss
  12. Deshittification Part 2: Bypassing the App Store Gatekeeper (inform.social)
    2 pointsby 27 minutes ago
    —discuss
  13. Advice to a Beginning Software Engineer (seangoedecke.com)
    2 pointsby 27 minutes ago
    —discuss
  14. Give your AI agent a versioned filesystem (lakefs.io)
    1 pointsby 29 minutes ago
    1comments
  15. CliffCompaction: Cost-Efficient Compaction for Long-Horizon Coding Agents (arxiv.org)
    1 pointsby 30 minutes ago
    —discuss
  16. Chrome just added WebMCP to the inspector (twitter.com/gherget)
    2 pointsby 30 minutes ago
    —discuss
  17. We Compared 51k Paint Colors: 3 in 4 Have a Near-Identical Twin in Another Brand (usemuro.com)
    1 pointsby 31 minutes ago
    —discuss
  18. How my boss made InternalServerErrors disappear (bankstatementconverter.com)
    1 pointsby 32 minutes ago
    1comments
  19. Show HN: Shobr: Job seach CLI via browser automation, event-sourcing, LLMs (github.com/sebastiancarlos)
    1 pointsby 35 minutes ago
    —discuss
  20. Hunting a ShinyHunters-linked phishing cluster from one IOC (huntback.io)
    1 pointsby 42 minutes ago
    —discuss
  21. Time.fyi (time.fyi)
    3 pointsby 45 minutes ago
    1comments
  22. MailAuthGuard – Open email authentication and deliverability auditor (github.com/benjaminsamson0210)
    1 pointsby 48 minutes ago
    —discuss
  23. Boberger Niederung: Eight Habitats in One Nature Reserve (alsterrunde.com)
    1 pointsby 49 minutes ago
    —discuss
  24. Underreported in the US: new site uses open source LLMs to find underovered news (pressaudit.org)
    1 pointsby 53 minutes ago
    1comments
  25. I found an SSRF in Google's official MCP Toolbox (CVE-2026-14540) (anas-security-portfolio.vercel.app)
    1 pointsby 56 minutes ago
    1comments
  26. AnyPS5: Convert PS5 executables to run natively on Linux and Windows (github.com/boykopovar)
    1 pointsby 58 minutes ago
    —discuss
  27. Prompting Claude Opus 5.5 (claude.com)
    23 pointsby 58 minutes ago
    1comments
  28. AlloyDB's new agentic database architecture (cloud.google.com)
    2 pointsby 1 hour ago
    1comments
  29. US Arts Employment (twitter.com/josephpolitano)
    1 pointsby 1 hour ago
    —discuss
  30. What is the closest thing we have to Iron man's desk?
    2 pointsby 1 hour ago
    —discuss

I found an SSRF in Google's official MCP Toolbox (CVE-2026-14540)

1 pointsby 57m agoanas-security-portfolio.vercel.app
Open original View on HN
1 comments
33m agoHN ↗

Google's products are littered with CVEs. Disappointing for a supposed "frontier" lab. Can't they hire competent people?

Open thread on HN ↗