Saturday, 5 September 2026

A related follow-on flaw, CVE-2026-46300 ("Fragnesia", tracked in its own entry), reopens this vulnerability's page-cache-write primitive on hosts patched only against CVE-2026-43284: a 13-year-old bug in the kernel's skb-coalescing code drops the shared-fragment marker the original fix relies on. Public Kubernetes-context proof-of-concept exploits now exist, and Red Hat confirms RHEL kernels need the CVE-2026-46300 fix too. EPSS scores (FIRST.org, 2026-09-04) are now populated: 0.9324 for CVE-2026-43284 and 0.9286 for CVE-2026-43500.

A related flaw, CVE-2026-46300 ("Fragnesia", tracked in its own entry), reopens this vulnerability's underlying page-cache-write primitive even on hosts already patched against CVE-2026-43284: a thirteen-year-old bug (dating to 2013) in the kernel's skb_try_coalesce() fails to preserve the marker that flags a fragment as page-cache-backed, which the original xfrm-ESP fix depends on to decide whether it is safe to decrypt in place (Aikido Security). Red Hat's own security bulletin groups all three CVEs under the collective "Dirty Frag" name (noting the family's similarity to the earlier CVE-2026-31431 "Copy Fail" is close enough that Red Hat also refers to it as "Copy Fail 2", even though the two remain distinct CVEs with their own code paths) and confirms CVE-2026-46300 affects supported Red Hat Enterprise Linux kernels; administrators who patched only against CVE-2026-43284/CVE-2026-43500 should verify the CVE-2026-46300 fix is applied too (Red Hat RHSB-2026-003). Public proof-of-concept exploits for this family now target Kubernetes specifically, extending the exposure to container-shared-kernel environments beyond the bare-metal/VM case originally described (Aikido Security).

CVE-2026-46300's CVSS score has now been published (7.8) and Red Hat's own bulletin confirms RHEL kernels are affected (unlike sibling CVE-2026-43500, which Red Hat states does not affect its products). Public proof-of-concept exploits now target Kubernetes specifically, and Red Hat's bulletin groups this CVE under the collective "Dirty Frag" name alongside CVE-2026-43284/CVE-2026-43500, confirming the ESP-in-TCP exploitation path this entry already described and the coalescing-marker root cause are the same flaw.

CVE-2026-46300 now carries a published score, CVSS 7.8 (MITRE CVE Program, 2026-09-01), and Red Hat's own security bulletin groups it under the collective "Dirty Frag" name alongside CVE-2026-43284 and CVE-2026-43500, labelling it specifically "Fragnesia (skb coalescing via ESP-in-TCP)": "three vulnerabilities, collectively known as 'Dirty Frag', have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products" (Red Hat RHSB-2026-003). Applicability splits per CVE: "Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them" (Aikido Security, 2026-09-04), any RHEL, OpenShift or RHEL CoreOS estate must confirm the CVE-2026-46300 fix specifically, not only the earlier two. Exploitation now extends to a container-relevant proof-of-concept: "researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape" (Aikido Security, 2026-09-04), because containers share the host kernel, a compromised workload that can reach the vulnerable code path (governed by seccomp, pod security policy and user-namespace settings) can escalate to root on the node. No source states confirmed in-the-wild exploitation of this specific CVE; Microsoft's previously reported limited in-the-wild activity ("privilege escalation involving 'su'") was itself stated as ambiguous between the "Dirty Frag" family and the separate, earlier "Copy Fail" vulnerability (CVE-2026-31431) from process logs alone (Microsoft Security Blog, 2026-05-08), not a distinction between the two Dirty Frag CVEs themselves, and not specific evidence of exploitation for CVE-2026-46300.

Kaspersky's GERT team documents two new Toy Ghouls backdoors, mqtt-bird-agent and matrix-bird-agent, deployed onto already-compromised Windows hosts over WinRM using Evil-WinRM and WinRM-fs. Both route command-and-control through legitimate, widely-trusted services (a public MQTT broker and a Matrix/Element homeserver) to blend into normal egress traffic; both persist as Windows services, protect their configuration with MachineGuid-keyed ChaCha20-Poly1305 encryption, and execute tasking through hidden PowerShell sessions. Kaspersky's own article names a fourth alias, Feral Wolf, not previously recorded for this actor.

Kaspersky's GERT team documents two previously undocumented backdoors fielded by Toy Ghouls (internally named mqtt-bird-agent and matrix-bird-agent) pushed onto already-compromised Windows hosts over WinRM: "in this campaign, the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems. The group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this" (Kaspersky Securelist, 2026-09-04). This is a lateral-movement and deployment step onto hosts the group already controls, not a new initial-access vector. The MQTT variant uses the public HiveMQ broker (broker.hivemq.com) as its command-and-control channel; the Matrix variant instead uses an attacker-controlled Matrix/Element homeserver. Both install as a Windows service for persistence and protect their configuration by "applying the ChaCha20-Poly1305 algorithm with a key derived from the value of the HKLM\Software\Microsoft\Cryptography\MachineGuid registry key," binding the configuration to the specific machine. Operator tasking executes through hidden PowerShell sessions: "commands are executed via PowerShell.exe in hidden mode, using the -NonInteractive -NoProfile -Command parameters." The reusable defender takeaway is architectural: both variants route C2 through legitimate, widely-trusted internet services (a public IoT message broker, a public chat federation protocol) specifically to blend into normal egress traffic and evade domain/IP-based blocking. Kaspersky's own article names a fourth alias for the group, Feral Wolf, alongside the previously recorded Bearlyfy, Labubu and Laboo.boo.

FulcrumSec published the full stolen dataset rather than merely claiming it, and the scale is substantially larger than the ~86GB previously claimed: roughly 550GB, comprising 8,672,291 customer profiles, over 1.16 billion Iterable platform events, and vehicle-plate and future-booking data. Have I Been Pwned processed and added the breach, confirming approximately 8.8 million unique email addresses and phone numbers. No new access-vector information; the client-side API-credential vector is unchanged.

FulcrumSec has now published the full dataset rather than merely claiming it, and the confirmed scale is substantially larger than the ~86GB previously claimed: roughly 550GB uncompressed, comprising 8,672,291 customer profiles (email, name, mobile, home town, postal region, and the residential IP address the account last connected from), over 1.16 billion Iterable platform events (email sends, opens, clicks and bounces), 2,482,763 historical parking, lounge and Fast Track purchase records, 461,433 SMS messages containing booking date, car-park and vehicle-registration details in plain text, and roughly 108,000 distinct UK vehicle registration plates tied to owner contact and booking details (Security Affairs, 2026-09-04). Have I Been Pwned has processed the published dataset and added it to its breach database, confirming approximately 8.8 million unique email addresses and phone numbers alongside names, IP addresses, purchase history and vehicle registration plates. FulcrumSec's leak-site post separately claims the dataset includes government, judicial, military, police, NHS and defence-industry employees among the exposed customers, and that it withheld a subset of upcoming-travel records that would otherwise reveal when a victim's home will be empty; both claims are the extortion group's own framing and are not independently verified. No new access-vector information accompanies this development; the client-side API-credential vector already recorded above is unchanged.

At the 3 September 2026 Advisory Council Digital Switzerland meeting, the Federal Department of Justice and Police announced it is further strengthening security in the E-ID's online issuance process specifically against AI-enabled threats: additional technical safeguards against malware injection onto end devices during issuance, and reinforced deepfake detection in the identity-verification step. The release reaffirmed open-source transparency, penetration testing and bug bounties as the programme's standing controls.

At the 3 September 2026 meeting of the Advisory Council Digital Switzerland, chaired by Justice Minister Beat Jans with Federal Chancellor Viktor Rossi participating, the Federal Department of Justice and Police stated that security in the E-ID's online issuance process is currently being further strengthened in light of recent AI developments: "in particular, through the use of additional technical safeguards, it should become harder to introduce malware onto end devices, and the detection of deepfakes should be strengthened" (eid.admin.ch, 2026-09-03). The release, attributing the emphasis on learning from mistakes to Jans, names the programme's standing security controls as the mechanism for finding such gaps: "transparency through open source, the conducting of penetration tests, and bug bounty programmes" (eid.admin.ch, 2026-09-03). No technical specification of the "additional technical safeguards" (an attestation mechanism, device-integrity check or liveness-detection method) has been published; this is a policy-level commitment, not yet an implementation detail defenders can act on.

Rhysida's ultimatum lapsed on 2026-09-04 after Berlin's Senate refused to pay; the group then published the full stolen dataset on its darknet leak site, replacing its prior partial "auction" listing. Chaos Computer Club spokesperson Joachim Selzer confirmed the complete dataset is now publicly accessible to anyone, but whether it actually contains the drinking-water vulnerability analyses and administration credentials the group had earlier claimed remains what the Senate itself must still verify, per a state-parliament faction leader's own account.

Rhysida's one-week ultimatum expired on 2026-09-04 at roughly 15:35 local time; the Berlin Senate had publicly committed not to pay, and about an hour after the deadline the group published the full stolen dataset on its darknet leak site, replacing the prior partial "auction" listing (heise online, 2026-09-04). Chaos Computer Club spokesperson Joachim Selzer confirmed the complete dataset (including personnel files and documents Selzer describes seeing directly, such as employment references) is now publicly accessible to anyone. Whether the dataset actually contains the drinking-water vulnerability analyses and administration credentials the group had earlier claimed remains unverified by any party this entry cites: Left-party parliamentary faction leader Tobias Schulze stated the Senate now has the opportunity to check whether the prior assumptions about the leaked data are accurate, and should notify affected individuals and organizations as quickly as possible once it does. No further technical root-cause detail beyond the phishing vector has been disclosed by the Senate.