On September 6, 2026, an unidentified operator exfiltrated approximately 68.8 GiB of database backups from a Philippine government agency responsible for overseas employment and migrant workers. The stolen data included 27 SQL Server backups related to case management systems such as POEA and OFW variants. The operator inadvertently exposed their staging infrastructure through an open HTTP directory on a VPS in Singapore, revealing tools including a rebranded GodPotato privilege escalation tool (Wrqsnx), PowerShell stagers, and the Impacket toolkit. The attack leveraged DCOM and RPC mechanisms to gain SYSTEM-level access without exploiting known vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access methods and command-and-control channels remain unknown, though the tooling was deployed on agency portal hosts.
Threat actors are abusing legitimate mobile device management (MDM) platforms such as Hexnode and Rippling by using social engineering techniques to trick users into enrolling devices or installing management agents. Once enrolled, attackers deploy unauthorized remote monitoring and management (RMM) tools like ScreenConnect, connecting to attacker-controlled relays to gain remote access. The MDM platforms themselves are not compromised but are misused through deception, making it difficult to distinguish legitimate from malicious activity.
NORA, a self-hosted artifact registry and pull-through cache, prior to version 0.9.5, contains a missing authorization vulnerability in its token management UI. The system authenticates users but fails to enforce administrator-level authorization for critical token management operations. This allows read bearer tokens to enumerate all users' tokens and metadata, and write bearer tokens or write-capable OIDC identities to revoke arbitrary admin and service tokens. The issue is resolved in version 0.9.5.
CVE-2026-93516 is a use-after-free vulnerability in X.org X Server and XWayland caused by improper lifecycle management when adding or removing XInput master devices. It affects versions of X.org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute code within the X server context. The vulnerability has a medium severity rating with a CVSS score of 5.5. Fixes are available in versions 21.1.25 for X.org X Server and 24.1.14 for XWayland.
A vulnerability in the Linux kernel's drm/vc4 HDMI driver caused a kernel crash due to improper power management of Packet RAM during audio infoframe updates. The issue occurred when audio was triggered before video restoration, leading to attempts to write infoframes while Packet RAM was disabled. This has been resolved by moving Packet RAM enablement to runtime power management hooks.
A vulnerability in the Linux kernel futex subsystem involving FUT_OFF_MMSHARED futexes has been fixed. The issue allowed processes to wait on shared futexes referencing a freed memory management structure (MM), causing wakeups to be misdirected to new MMs at the same address. This was addressed by using a unique 64-bit per-MM ID to key FUT_OFF_MMSHARED futexes, preventing cross-MM wakeup consumption.
A resource leak vulnerability was fixed in the Linux kernel's viai2c-wmt driver. The issue involved the clock reference count not being decremented properly when errors occurred or the module was unloaded, due to improper management of the clock resource in wmt_i2c_probe().
A vulnerability in the Linux kernel's iSCSI implementation allows a target to reference invalid task slots in the task pool, leading to null pointer dereferences and kernel crashes. This occurs because the kernel does not properly validate the task named by certain management responses, allowing an attacker to cause a general protection fault with crafted iSCSI packets.
A vulnerability in the Linux kernel's AMDGPU driver involves improper handling of runtime power management references in the amdgpu_gpr function. Specifically, the runtime PM reference is dropped twice when copying wave register data to userspace fails, leading to a runtime PM usage count underflow. This issue affects the amdgpu_debugfs_gpr_read() function and can cause incorrect power management state accounting on affected hardware.
A vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) handling causes out-of-bounds accesses due to unexpected SS bit settings in nested page fault (#NPF) exit codes when running Hyper-V on Windows 11. The issue arises because the AMD manual is unclear about when the SS bit is set, leading to warnings and undefined behavior sanitizer (UBSAN) reports. The fix involves dropping unexpected bits in error codes while preserving the SS bit when reflecting faults to the first-level hypervisor (L1).
A memory management vulnerability in the Linux kernel's AMDGPU driver causes resource leaks when certain command submission (CS) failures occur after the parser_bos stage. Specifically, userptr ranges allocated during buffer object processing are not freed on some error paths, leading to memory leaks.
A use-after-free vulnerability in the Linux kernel's workqueue subsystem was fixed by correcting the lifetime management of unbound worker pools for pending per-CPU workqueues (pwqs). The flaw allowed a freed worker_pool to be accessed, causing a kernel slab-use-after-free error detected by KASAN.
A vulnerability in the Linux kernel scheduler subsystem (sched_ext) involves incorrect handling of bypass dispatch claims for schedulers bypassed by an ancestor. This flaw causes some descendant schedulers to either leak claims or fail to claim bypass dispatch properly, leading to potential task scheduling issues during power management suspend and resume cycles.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially gain unauthorized access to managed systems. The vulnerability is critical with a CVSS score of 9.6, indicating high impact on confidentiality and integrity without requiring user interaction.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a high CVSS score of 9.6, indicating critical severity. No specific patch information is provided in the source data.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to perform unauthorized operations. The vulnerability is identified as CWE-862 and has a CVSS v3.1 score of 7.1, indicating high severity.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and specified LTS releases contain an authentication bypass vulnerability. This flaw allows a low privileged remote attacker to spoof authentication, potentially causing denial of service. The vulnerability does not impact confidentiality but can affect integrity and availability.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with remote access to potentially elevate their privileges further. The vulnerability is identified as CWE-269 and has a CVSS v3.1 score of 7.2, indicating a high severity impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented in the provided data.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially disclose information. The vulnerability does not impact integrity or availability and has a medium severity rating.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including LTS2024, LTS2025, and LTS2026 release versions, contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CVE-2026-86379 and has a CVSS score of 7.2, indicating high severity.
