Dell Expands PowerStore Advisory with Two Additional Critical Vulnerabilities
Dell has updated its security advisory for the Dell PowerStore storage platform, expanding the list of addressed vulnerabilities and confirming the availability of additional firmware updates.
The original advisory, published on August 10, 2026, covered multiple issues in PowerStoreT OS rated as Critical. Subsequent revisions on August 27 and August 31 added new details about affected versions and two previously undisclosed vulnerabilities.
The August 27 update introduced patches for PowerStoreT OS versions 4.3.1.2-2771239 and 4.1.0.6-2771237 in addition to the previously listed 5.0.0.2-2761110 build. The August 31 revision added CVE-2026-58566 and CVE-2026-79687 to the remediation list, confirming that both issues are resolved by the updates released earlier in the month.
CVE-2026-79687 affects Dell PowerStore SDNAS and stems from missing authentication in a critical component, potentially allowing remote attackers to access the file system without credentials. CVE-2026-58566 is described as an authorization bypass vulnerability that can result in privilege escalation. The two flaws received CVSSv3.1 base scores of 9.0 and 8.8 respectively.
The full list of vulnerabilities referenced in the advisory includes: CVE-2026-58566, CVE-2026-58567, CVE-2026-58569, CVE-2026-58571, CVE-2026-58572, CVE-2026-58574, CVE-2026-58575, CVE-2026-67262, CVE-2026-67271, CVE-2026-70415, CVE-2026-76111, CVE-2026-79682, CVE-2026-79683, CVE-2026-79684, CVE-2026-79685, CVE-2026-79686, and CVE-2026-79687.
Related articles
SonicWall SMA 1000 Series Affected by Critical Vulnerabilities with Evidence of Exploitation
SonicWall has disclosed two serious vulnerabilities in its SMA 1000 series remote access appliances. The issues, tracked as CVE-2026-83548 and CVE-2026-83549, affect the SMA 6210, SMA 7210, and SMA 8200v models. CVE-2026-83548 is a server-side request forgery flaw in the WorkPlace interface that permits unauthenticated remote access to otherwise restricted functions. CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console that can lead to remote command execution after authentication under certain conditions. Both vulnerabilities received high CVSS scores, with one reaching the maximum of 10.0. The vendor published the advisory on September 1, 2026, and confirmed cases where the flaws appear to have been exploited in the wild.
Code Signing Myths: Why a Valid Digital Signature Does Not Equal File Safety
Digital signatures confirm only that a file was issued by a specific publisher at a given time and remained unchanged afterward. They do not verify current safety, the legitimacy of the current holder, or whether the private key was stolen months earlier. Attackers obtain legitimate certificates through build-system leaks, supply-chain compromises such as the 2019 ASUS ShadowHammer incident, or weak reseller validation. Expired certificates remain usable because verification can be performed at the timestamp recorded by an RFC 3161 TSA token rather than the current system clock. Signature hashes in Authenticode deliberately exclude the checksum field, certificate table, and attribute certificate table, allowing limited tampering that older WinVerifyTrust implementations did not fully block. Revocation checks are soft by default, and revocation dates can leave an exploitation window open. Organizations should enforce publisher thumbprint allow-lists in WDAC or AppLocker and store signing keys exclusively in HSMs.
Attackers Exploit Critical Langflow and Ruby on Rails Flaws for Credential Theft and C2 Infrastructure
Active exploitation has been confirmed for CVE-2026-0768 in Langflow and CVE-2026-66066 in Ruby on Rails. Attackers first focus on reconnaissance and secret exfiltration before establishing command-and-control channels, with potential escalation to remote code execution. In Langflow the flaw allows arbitrary Python code execution as root due to insufficient input validation, enabling attackers to dump environment variables and locate cloud credentials. The Ruby on Rails issue, tracked as KindaRails2Shell, stems from an arbitrary file read triggered when Active Storage processes untrusted image uploads with libvips, exposing secret_key_base and other sensitive keys. Observed campaigns show traffic originating from Russia against Langflow instances and activity targeting canaries in Singapore, Israel, and the United Kingdom for Rails deployments. Defenders are advised to inventory public instances, apply the latest patches, rotate exposed secrets, and monitor for suspicious file reads and C2 communications.
Critical Vulnerabilities in PaperCut NG and PaperCut MF Exploited in the Wild
PaperCut Software has disclosed two serious vulnerabilities in its printing management solutions PaperCut NG and PaperCut MF. The issues were detailed in an advisory published on August 27, 2026, followed by emergency patches. Exploitation has already been confirmed in customer environments. CVE-2026-81578 stems from improper access controls in the web management interface, allowing unauthenticated remote changes to system settings. CVE-2026-82078 involves insecure dynamic class loading in database connections, enabling arbitrary Java bytecode execution with server privileges when combined with the first flaw. CVSS scores are 9.4 (Critical) and 8.8 (High) respectively, and both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities Catalog.