Weekly Cyber Security Newsletter– Claude Hacked 3 Companies, Cisco 0-Day, Word Copilot and VMware Flaw +20 Stories

AI systems moved from experimental risk to confirmed attacker, a Cisco firewall zero-day was actively exploited in the wild, and a critical VMware authentication bypass put enterprise virtualization infrastructure at risk. Below is a roundup of the week’s most significant vulnerabilities, breaches, and security research. Broadcom issued advisory VMSA-2026-0006 covering multiple high-impact flaws across vCenter, ESX, Workstation, Fusion, Cloud Foundation, and Telco Cloud platforms, with CVSSv3 scores ranging from 2.7 to 9.8. The most severe, CVE-2026-59309, is an authentication-bypass vulnerability in the VMware Directory Service that lets a network-adjacent attacker fully bypass vCenter authentication and seize control of the management plane. A companion critical flaw, CVE-2026-59310, is a directory-traversal bug in the vCenter Syslog server enabling arbitrary code execution, while CVE-2026-47876 lets a malicious VM guest escape via the VMXNET3 adapter to execute code on the ESX host itself. Broadcom has released patches across all affected branches, including vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k, along with corresponding ESXi builds; no workaround exists for the traversal bug, so security teams should prioritize patching internet- or intranet-exposed…