Dolphin: a wave of AI-found vulnerabilities, and a hacked build machine
By Tgames · · 3 min read
The progress report for Dolphin 2609, published on 24 September 2026, devotes two sections to security rather than new features. They are worth reading, because they concern everyone who runs GameCube and Wii games on PC.
One vulnerability report in 2024, zero in 2025, more than ten in 2026
The team is clear about the cause:artificial intelligence. Anyone can now unleash agents on an open-source project and let them hunt for vulnerabilities for days. Dolphin points out two things, and the second is surprising:
What it changes for you, in practice
Update Dolphin. Security fixes shipped in 2606, many more in 2606a, and a few more in 2609. The team puts it bluntly: if you use an older version, assume it contains known vulnerabilities. In that case, do not open files of dubious origin with it, and do not play NetPlay with strangers. No malicious exploitation has been observed to date.
Fixing things quickly came at a price, openly acknowledged: the rewrite of Wii NAND save states broke state loading in some games such as Donkey Kong Country Returns, and a check added to DOL files broke booting of Wii menus modified by Priiloader. Both have been fixed.
The machine that builds the macOS versions was compromised
The story is instructive. On 6 August, Apple fixed in macOS Tahoe 26.6.1 a vulnerability in Screen Sharing that allowed logging in without valid credentials. An attacker analysed the patch, understood the flaw, and swept the Internet: he added his SSH key to the administrator account, blocked the Screen Sharing port behind him so nobody else could take over the machine, then installed a Monero miner.
The Mac mini that produces Dolphin's macOS builds had not been updated in time. It was compromised on 8 August, and the team noticed on 15. In between, the machine produced builds: development builds 2606-294 to 2606-302, and release 2606a.
The conclusion is reassuring, and it has been verified: every file was analysed by hand and then submitted to VirusTotal, and no build is infected. Only the macOS builds were at stake — Windows, Linux and Android were never affected. The machine was wiped and reinstalled on 18 August, and Screen Sharing is no longer exposed to the Internet.
So what about new features?
There are some. 2609 brings NetPlay on Android, with a caveat: between an ARM phone and an x86 PC, the code translators are not identical and games can desync. Also added: a real-time display of the game's output resolution, the Balance Board properly recognised via a DolphinBar, a search in the Android settings and rumble fixes.
Our recommended settings are in PC emulation: the right emulators in 2026, and for phones in Emulation on Android.
Sources: Progress report 2609 · Dolphin
One vulnerability report in 2024, zero in 2025, more than ten in 2026
The team is clear about the cause:artificial intelligence. Anyone can now unleash agents on an open-source project and let them hunt for vulnerabilities for days. Dolphin points out two things, and the second is surprising:
- The reports received are visibly written by an AI, endless, and the triage work falls on volunteers.
- But none were made up: each one contained a real bug, most often a buffer overflow. That is not the case everywhere — the curl project, swamped with bogus reports, ended up suspending its bounties.
What it changes for you, in practice
Update Dolphin. Security fixes shipped in 2606, many more in 2606a, and a few more in 2609. The team puts it bluntly: if you use an older version, assume it contains known vulnerabilities. In that case, do not open files of dubious origin with it, and do not play NetPlay with strangers. No malicious exploitation has been observed to date.
Fixing things quickly came at a price, openly acknowledged: the rewrite of Wii NAND save states broke state loading in some games such as Donkey Kong Country Returns, and a check added to DOL files broke booting of Wii menus modified by Priiloader. Both have been fixed.
The machine that builds the macOS versions was compromised
The story is instructive. On 6 August, Apple fixed in macOS Tahoe 26.6.1 a vulnerability in Screen Sharing that allowed logging in without valid credentials. An attacker analysed the patch, understood the flaw, and swept the Internet: he added his SSH key to the administrator account, blocked the Screen Sharing port behind him so nobody else could take over the machine, then installed a Monero miner.
The Mac mini that produces Dolphin's macOS builds had not been updated in time. It was compromised on 8 August, and the team noticed on 15. In between, the machine produced builds: development builds 2606-294 to 2606-302, and release 2606a.
The conclusion is reassuring, and it has been verified: every file was analysed by hand and then submitted to VirusTotal, and no build is infected. Only the macOS builds were at stake — Windows, Linux and Android were never affected. The machine was wiped and reinstalled on 18 August, and Screen Sharing is no longer exposed to the Internet.
So what about new features?
There are some. 2609 brings NetPlay on Android, with a caveat: between an ARM phone and an x86 PC, the code translators are not identical and games can desync. Also added: a real-time display of the game's output resolution, the Balance Board properly recognised via a DolphinBar, a search in the Android settings and rumble fixes.
Our recommended settings are in PC emulation: the right emulators in 2026, and for phones in Emulation on Android.
Sources: Progress report 2609 · Dolphin
No comments