Alliance Graduate School (AGS)

Source notice: This entry is based on a Facebook post by Nullsec Philippines, reviewed via screenshots provided to this site, together with reporting by BetterGov.PH and Rappler that names Alliance Graduate School among the websites reportedly defaced on November 5, 2026. This site has not observed the defacement directly, and AGS has not issued a public statement. The defaced URLs are not linked from this site.

What Happened

On November 5, 2026, the Facebook page Nullsec Philippines published a post opening with "Today is November 5. The Million Mask March is here." followed by a manifesto, the slogan "Wake up. Speak up. Stand up.", and the heading "DEFACE!!!!" with five links. Two of the links point to Alliance Graduate School (AGS):

• a path in the attachments directory of the school's main website
• the root of a prototype subdomain

The other three links point to a provincial government intranet and two non-school organizations. The post closes in Tagalog with a promise that more leaks and defacements will follow.

The same day, BetterGov.PH listed Alliance Graduate School among the websites reportedly defaced, and Rappler, reporting on the National Privacy Commission's response to the November 5 incidents, listed it among the nongovernment entities reportedly affected. Newsbytes.PH, in its November 6 report on the same NPC response, also listed Alliance Graduate School among the website defacements reported by Deep Web Konek and BetterGov.PH.

What the Post Shows

• An attachments directory. A defacement served from an attachments folder usually means the attacker could upload a file to the server, often through a file-upload feature that does not check what is uploaded. That kind of flaw can also allow a web shell, which would give much deeper access than a replaced page.
• A prototype subdomain. Test and prototype sites are often left online with older code, default settings, or weaker passwords, and may share a server or database with the live site.
• No data claim. The post claims defacements only, though it promises "leaks" to come.

Why the Methodology Treats This as 'Investigating'

The school is named because BetterGov.PH and Rappler both named Alliance Graduate School in their reporting of the November 5 incidents. The entry is 'investigating' rather than 'confirmed' because both describe the school as reportedly affected, this site has not observed the defaced pages, and AGS has not issued a statement.

Threat-Actor Persona and Cross-References

The manifesto in this post matches, almost word for word, the manifesto in the dark-web forum posts behind the NEUST admission-records exposure (by imken, November 5) and the USLS student data claim (by pocherowithpetchay, November 6). The shared text ties those forum accounts to the Nullsec Philippines page, or at least to a manifesto circulated within its network.

Nullsec Philippines has a long record of claims on this site. On November 6 it also posted the defacement of a Metro Manila public high school's e-learning site. For the wider campaign, see The #MMM2026 Wave.

Why This Claim Warrants Attention

• An upload flaw is more than a defacement. If the attacker could place a page in the attachments folder, they may have been able to place executable code as well.
• Prototype sites widen the attack surface. A forgotten test site can be the easiest way into a production server.
• The post promises more. "Leaks and defacements" are explicitly promised to follow.

What Is Not Known

• How the files were placed, and whether anything other than a defacement page was uploaded.
• Whether the prototype subdomain shares a server or database with the main site.
• Whether any data was accessed.
• Whether the pages have been removed.

Recommended Actions for the School

1. 1.Remove the defacement files and look for others, especially executable files (such as PHP scripts) in upload and attachments folders.
2. 2.Fix the upload feature so it accepts only expected file types, stores uploads outside the web root, and never executes them.
3. 3.Take the prototype subdomain offline or put it behind authentication.
4. 4.Review server logs for uploads and access from unfamiliar addresses around November 5.
5. 5.Reset administrator and hosting passwords, and enable multi-factor authentication.
6. 6.Assess whether personal data was exposed, and notify the NPC within 72 hours under NPC Circular 16-03 if there is reasonable belief that it was.
7. 7.Issue a short public statement.

How to Prevent This Pattern

1. 1.Block script execution in upload directories.
2. 2.Keep test and prototype sites off the public internet.
3. 3.Update the CMS and plugins regularly.
4. 4.Monitor for file changes on web servers.
5. 5.Publish a security contact for private vulnerability reports.