Doyensec research post (17 September 2026) shows Open vSwitch’s kernel datapath can strip SKBFL_SHARED_FRAG from a still-forwarded packet, re-opening the Fragnesia Dirty COW-class primitive: an unprivileged user can cause in-place ESP decrypt over page-cache pages they may only read, writing attacker-chosen bytes into root-owned file page cache. Tracked as CVE-2026-90049, CVE-2026-89487 and CVE-2026-80977; reported to the Linux kernel security team and coordinated with OVS maintainers. Builds on prior Dirty Frag / Fragnesia work (including CVE-2026-43284 and CVE-2026-43500). Impact surface: virtualisation/container stacks using OVS (OpenStack Neutron, oVirt, Antrea/OVN-Kubernetes, libvirt bridges, etc.). Primary: Doyensec blog; await distro/kernel OVS package advisories for fixed revisions.
BleepingComputer (17 September 2026) reports the US FBI seized nightmare-stresser[.]com and nightmarestresser[.]org used by NightmareStresser, a long-running DDoS-for-hire (booter) service. FBI Cyber Division said that since 2022 the service was used to launch hundreds of thousands of actual or attempted DDoS attacks worldwide. Seizure banners cite Operation PowerOFF, the international law-enforcement effort against DDoS-as-a-service infrastructure. Historical context: Searchlight Cyber (2023) previously assessed ~566k registered users and up to ~200 Gbps multi-layer attacks; DOJ had seized nightmarestresser[.]com once before in December 2022 with related arrests. Primary wire: BleepingComputer quoting FBI Cyber Division / PowerOFF seizure banner.
ESET Research (17 September 2026; “Beware the SparroWock”) documents SparroWocky, the new flagship modular C++ backdoor of China-aligned APT FamousSparrow, replacing SparrowDoor in campaigns focused on Latin American government targets (Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, Venezuela per BleepingComputer). ESET attributes with high confidence (early SparroWocky deployments via SparrowDoor). Capabilities include command/file execution, in-memory BOF load, system/network/user enumeration, file ops, screenshot streaming, cross-session process create, TCP proxy, and self-removal; persistence via Windows service (e.g. ProcAuditManager) or registry Run key (e.g. SnapCart); DLL side-load after RC4 .dat decrypt. Evasion includes MinHook CreateThread spoofing (AnimateWindow start address), call-stack spoofing, and dynamic API resolve. C2 over 443/8080 or HTTP/SOCKS5 proxies (ESET lists ≥18 addresses). No CVE. Primary: ESET; wire: BleepingComputer 17 Sep 2026.
ESET Research — Beware the SparroWock (17 Sep 2026)
CISA published guidance (September 2026; SecurityWeek 17 September) on deploying cyber decoys to strengthen detection and response for critical infrastructure. Decoys complement Zero Trust by assuming breach and helping organisations detect, observe, and block malicious activity. Document: Using Cyber Decoys to Strengthen Detection and Response (508c PDF). No CVE. Primary: CISA PDF; wire: SecurityWeek.
CISA — Using cyber decoys to strengthen detection and response (Sep 2026 PDF)
The US Department of Health and Human Services (HHS) Office for Civil Rights breach portal lists AngMar Management Services, a Texas business associate, with 126,196 individuals affected, in a report submitted on 16 September 2026 as a hacking/IT incident involving a network server. The portal entry does not describe what information was involved. Primary: HHS OCR breach portal. Correction (25 Oct 2026): the card now rests on the HHS breach portal entry; details from a wire report we cannot verify (the type of data, the timeline and a leak-site claim) have been removed. (source: HHS) Correction (25 Oct 2026): the card date has moved from 5 October to 16 September 2026, the breach report submission date the HHS portal lists; HHS gives a US date with no time. (source: HHS)
HHS Office for Civil Rights — breach portal: cases under investigation (AngMar Management Services, TX, 126,196, submitted 16 Sep 2026)
Trend Micro Zero Day Initiative advisory ZDI-26-708 / ZDI-CAN-29849 (published 16 September 2026; CVSS 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) documents an unpatched Microsoft Windows privilege-escalation issue in HTTP proxy authentication handling. A low-privileged local attacker who can change the user proxy setting to an attacker-controlled server can coerce NTLM authentication in the machine-account context (commonly via Network Connectivity Status Indicator / WinHTTP connectivity checks running as NETWORK SERVICE). Microsoft acknowledged the report (May 2026), initially indicated a September fix, then on 31 August 2026 said the issue did not meet the Windows security servicing bar; ZDI published as a 0-day on 16 Sep. No CVE assigned. ITRESIT Labs (28 Sep) describes a pentest chain using the coercion into AD CS Web Enrollment relay when EPA/HTTPS are not enforced — that chain is environmental, not part of ZDI’s scored impact. Primary: ZDI-26-708; technical write-up: ITRESIT 28 Sep.
ZDI-26-708 — Microsoft Windows HTTP Proxy Privilege Escalation (0-day, 16 Sep 2026)
Varonis Threat Labs (Elad Ghvarh; blog 16 September 2026; BleepingComputer amplify 22 September 2026) documents TrustSink: a post-compromise technique that registers a rogue External Authentication Method (EAM) so the provider-controlled MFA step shows a pixel-accurate Microsoft-style password page and captures plaintext passwords (with timestamp and source IP) while returning a valid signed token so Entra still treats MFA as satisfied. Builds on the EAM trust boundary Dirk-jan Mollema highlighted (x33fcon 2025 “Bringing Your Own Identity”). Requires Global Administrator or Authentication Policy Administrator to change Authentication Methods Policy / app / service principal / consent — not an unauthenticated phishing kit. Password reset alone does not remove the rogue provider; it keeps capturing replacements on the next sign-in. Demo used a minimal FastAPI OIDC provider; real attackers need a public HTTPS endpoint. Defenders: audit EAMs and unexpected authentication-method policy changes before mass resets; remove rogue providers first. Primary: Varonis; docs: Microsoft Entra external method providers; wire: BleepingComputer 22 Sep 2026.
oss-security disclosure by Hyunwoo Kim (17 September 2026; embargo lift) and CVE published 16 September 2026: CVE-2026-89775 is a guest-to-host escape in KVM/arm64 when nested virtualization is enabled. Type truncation of the stage-1 walk level can make VNCR pseudo-TLB size computation return 0 (“size unknown”); invalidation treats that as an empty range and skips, leaving a freed host page mapped writable so a malicious guest gets 64-bit R/W without trap/VM-exit. Introduced mainline 7270cc9157f47 (14 May 2025); fixed 8053393680d4 (6 Aug 2026). Red Hat rates Important, CVSS 3.1 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). On hosts with nested virt and world-writable /dev/kvm (e.g. some RHEL configs), also a local root LPE path. Primary: oss-security; Red Hat CVE page; wire: The Hacker News / Cyber Security News 22 Sep 2026.
Veeam KB4852 documents CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows: a low-privileged local user can obtain SYSTEM by abusing elevated session UIDs cached against a client-controlled session UID on the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe (UIDs readable from C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log). Vendor CVSS 4.0 score 7.3 High (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). KB4852 says the flaws it lists affect Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds. Fixed starting with Veeam Backup & Replication 13.0.2.29; Veeam's Agent for Windows fix list (KB3108) shows CVE-2026-32996 fixed in Agent build 13.0.3.1220. Arctic Wolf warned of active exploitation after a public proof-of-concept (PoC) exploit was posted on GitHub, as reported by The Hacker News (22 September 2026) — prioritise shared workstations, admin endpoints, and multi-user hosts. Same KB also ships CVE-2026-32997 (Backup Administrator arbitrary file write on Linux Veeam Software Appliance; CVSS 4.0 8.6) fixed in the same 13.0.2.29 build. Primary: Veeam KB4852; Agent fix build: Veeam KB3108; exploitation context: Arctic Wolf via The Hacker News 22 Sep 2026. Correction (24 Oct 2026): KB4852 gives the affected range as Veeam Backup & Replication 13.0.1.2067 and earlier version 13 builds, not Agent builds; the fixed Agent build 13.0.3.1220 is now sourced to Veeam KB3108 because the Arctic Wolf post no longer loads. (source: Veeam KB4852)
Dexus (ASX: DXS) ASX release (16 September 2026) confirms Australian Data Centres (ADC; Dexus 85% interest) holds a 25% interest in a consortium with Zerra DC and Macquarie Capital developing a hyperscale data-centre campus in Queensland’s Western Downs region for an Australian subsidiary of Anthropic. The consortium has entered lease documentation for delivery of the first stage, subject to customary approvals (incl. Dexus board for ADC funding obligations). ADC is raising capital for additional partners; Dexus has not decided whether to participate. Developer Zerra DC's project page lists up to 1.44 GW of proposed IT capacity across four stages, anchored by a long-term lease commitment from Anthropic, with the development application under assessment. ABC News (16 Sep) reports the facility will be built near Dalby, that Anthropic aims to start using it in 2027, that the ABC understands Anthropic would use it to power Claude to answer user questions rather than to train models, and that the lease is subject to Foreign Investment Review Board approval; Queensland Premier David Crisafulli said the deal was a direct result of his recent trade mission to the US. Distinct from Anthropic TI misuse cards on this desk. Primary: Dexus ASX/EQS release; developer: Zerra DC; wire: ABC News 16 Sep (iTnews 17 Sep carries the Reuters report, paywalled). Correction (26 Oct 2026): removed details credited to Reuters and iTnews that no readable source supports (a 2.16 GW campus about 250 km from Brisbane, cooling and power-purchase details, and a confirmation 'in state parliament'); the capacity now comes from developer Zerra DC's page and the timing, use and approval details from ABC News. (source: ABC News)
Dexus ASX/EQS — Australian Data Centres / Western Downs Digital Park (16 Sep 2026)
Zscaler ThreatLabz (blog 16 September 2026; The Hacker News wire 18 September) tracks Pakistan-nexus APT36 (Transparent Tribe / Earth Karkaddan) activity in August 2026 as Operation RapidRust against government and defence entities in India and Afghanistan. New tooling: RUSTYSHADE — 64-bit Windows Rust backdoor using attacker-controlled private GitHub repos via REST API for C2 (hardcoded PAT; AES-256-GCM with key from SHA256(PAT)); RUSTYMOVE — post-compromise copier that stages malware onto removable media to reach air-gapped networks; PSNATCH — PowerShell file stealer exfiltrating matched extensions to private GitHub; BASHNATCH — bash analogue for Linux. Delivery includes typosquatted Indian news domains staging PowerShell; sample post-compromise wget of DriverInstaller.zip from Backblaze B2. Related to earlier GOGITTER/GITSHELLPAD GitHub-C2 tradecraft but Rust + encrypted C2. Primary: Zscaler ThreatLabz; wire: THN.
Check Point advisory sk1000155 (disclosed 16 September 2026; NVD published same day) documents CVE-2026-91843, a stack overflow (CWE-121) in the unauthenticated login process on Security Management and Log Servers. Check Point CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker without credentials can run arbitrary code as root over the network; Check Point states the vulnerable path runs through the Trusted Clients setting (hosts allowed to connect via SmartConsole). Vendor and CISA SSVC: no indication of in-the-wild exploitation; not in KEV as of mid-September catalog checks. Affected branches by Jumbo Hotfix Take (or older): R82.20 (apply Take 29+), R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below; R81.10/R81/R80.x End of Support (ticket Check Point for fix or upgrade). Standalone, Log Server, and Multi-Domain deployments also vulnerable per vendor confirmation (THN update 18 Sep). Smart-1 Cloud hosted management is not affected (fix already deployed). Remediation: LivePatch per sk1000155; customers with automatic updates (sk175504) already protected. Distinct from desk card checkpoint-vpn-cert-20260910 (VPN CVE-2026-85102/85103). Primary: Check Point sk1000155; secondary: NVD / Censys advisory.
Check Point sk1000155 — CVE-2026-91843 Security Management/Log Server (16 Sep 2026)
