SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
NewSANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage
- Episodes
- 2,560
- Released
- daily
- Latest episode
- Nov 13, 2026
About the podcast
A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
Episodes 2,560
SANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage
This episode covers scans for a GPUStack authentication bypass, a ConnectWise ScreenConnect security advisory, public exploits for N-able N-central, and a Microsoft 365 outage. GPUStack Authentication Bypass …
Show notes
This episode covers scans for a GPUStack authentication bypass, a ConnectWise ScreenConnect security advisory, public exploits for N-able N-central, and a Microsoft 365 outage.
GPUStack Authentication Bypass Scans (CVE-2026-102895)
Johannes writes up scans against GPUStack, open-source software that manages clusters of GPUs for AI workloads. An attacker can spoof the X-GPUStack-Real-IP header with the loopback address to bypass authentication. A fixed version was released in July, the CVE was assigned about a week ago, and exploitation is trivial on an exposed system.
https://isc.sans.edu/diary/Exploit%20Attempts%20for%20GPUStack%20Authentication%20Bypass%20%28CVE-2026-102895%29/33514
https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
ConnectWise ScreenConnect Security Advisory
ConnectWise released another ScreenConnect advisory about an ongoing investigation into the compromise of some customer and partner sites. The company is looking at 400 compromised environments and has disabled a set of third-party plugins; users should update the ScreenConnect client to version 26.6.5, which also fixes a vulnerability still being used to spread malware after those compromises.
https://www.connectwise.com/company/trust/advisories
N-able N-central Public Exploits
Public exploits are now available for at least three of the N-able N-central vulnerabilities that were disclosed last week without first notifying the vendor. The code is in a GitHub repository that Johannes has not yet verified, so treat it with caution; if you are running an exposed unpatched N-able system, upgrade immediately and assume compromise.
https://github.com/MSPNightmare/CVEs/tree/main/0-Days/N-Central%20N-Able
Microsoft 365 Downtime
Microsoft had a significant availability event in which large parts of Microsoft 365, including Exchange and Outlook, were unreachable, and the disruption also affected sites that rely on Microsoft 365 single sign-on, including Entra. Microsoft said it was bringing systems back online, but service was still unavailable for many Microsoft 365 Business and Enterprise users at the time of recording.
https://status.cloud.microsoft/m365/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
This episode covers leftover Patch Tuesday issues: a critical remote code execution flaw in Apache HTTP Server's mod_http2 module (CVE-2026-119618), Fortinet's 89 advisories with 17 critical vulnerabilities …
Show notes
This episode covers leftover Patch Tuesday issues: a critical remote code execution flaw in Apache HTTP Server's mod_http2 module (CVE-2026-119618), Fortinet's 89 advisories with 17 critical vulnerabilities especially in FortiMail, Ivanti's November 2026 update including an Endpoint Manager SQL injection and a Cloud Services Application certificate issue, an unpatched Windows Common Log File System privilege escalation called SignDrop, and N-able's N-central 2026.4 Hotfix 2.
Apache HTTP Server mod_http2 Remote Code Execution (CVE-2026-119618)
Apache released HTTP Server 2.4.71, fixing a critical heap overflow in the mod_http2 assign_headers function that can lead to remote code execution. No public working exploit is available yet; disabling HTTP/2 can mitigate the issue, but proxies that translate to HTTP/2 still need to watch for HTTP request smuggling.
https://httpd.apache.org/security/vulnerabilities_24.html
Fortinet November Advisories
Fortinet published 89 advisories addressing more than 100 vulnerabilities across its product portfolio, including 17 rated critical. FortiMail received the most critical fixes, and several of the critical issues may allow unauthenticated arbitrary code execution. Fortinet used AI as part of the vulnerability discovery work behind this release.
https://www.fortiguard.com/psirt
Ivanti November 2026 Security Update
Ivanti's November 2026 security update includes a SQL injection in Endpoint Manager (EPM) that may be leveraged for remote code execution, tracked as CVE-2026-121653, and a vulnerability in Ivanti Cloud Services Application (CSA) that allowed unauthenticated alteration of trusted EPM Core certificates (CVE-2026-121683).
https://www.ivanti.com/blog/november-2026-security-update
Windows SignDrop CLFS Privilege Escalation
Researcher Nightmare Eclipse (MSNightmare) released SignDrop, a local privilege escalation in the Windows Common Log File System (CLFS) that abuses the HMAC-based log-file authentication Microsoft added about a year ago, along with symlink and timing tricks. A regular user can escalate to SYSTEM on Windows 11 26H2 and Windows Server 2025. A proof-of-concept is on GitHub; Microsoft has not confirmed the issue, there is no CVE, and disabling CLFS log authentication is not a recommended workaround because it would restore older CLFS attacks.
https://github.com/MSNightmare/SignDrop
N-able N-central 2026.4 Hotfix 2
N-able has released N-central 2026.4 Hotfix 2, and the release notes identify three CVE numbers addressed in the update, after N-able earlier shut down its hosted infrastructure in response to the reported vulnerabilities. The initial public reports described around 30 vulnerabilities, and attackers are already probing leaked paths. Shadowserver's count of exposed N-central servers dropped from about 1,338 to around 148. On-premises operators should apply the hotfix before bringing a server back online and still avoid exposing it if possible.
https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)
Microsoft's November Patch Tuesday, Apple's iOS and macOS updates, and SAP's Security Patch Day all arrived this week, including an already exploited Outlook spoofing bug and four SAP flaws with a perfect CVSS …
Show notes
Microsoft's November Patch Tuesday, Apple's iOS and macOS updates, and SAP's Security Patch Day all arrived this week, including an already exploited Outlook spoofing bug and four SAP flaws with a perfect CVSS score of 10.
Microsoft Patch Tuesday
Microsoft is addressing 1,260 vulnerabilities this month, 68 of them critical, including 167 Chromium issues that affect Microsoft Edge. One already exploited Outlook spoofing vulnerability, CVE-2026-124194, may hide the risk of a file being opened, in a Mark of the Web style issue, though Microsoft does not rate it critical. Other notable critical issues include a Lightweight Directory Access Protocol (LDAP) remote code execution flaw in Active Directory environments (CVE-2026-119958), five critical Microsoft Queuing and Queue Manager bugs, and a Windows TCP/IP remote code execution vulnerability (CVE-2026-113859) that Microsoft rates critical despite a 7.5 Common Vulnerability Scoring System (CVSS) score.
https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+November+2027/33508
Apple Patches
Apple released updates for iOS, iPadOS, macOS, watchOS, and visionOS that fix only nine vulnerabilities, with iPadOS and macOS patches going back to version 18, watchOS one version back, and visionOS only for the current release. Most of the issues weaken the Bluetooth handshake so an attacker can pair with a phone or Mac, and there are also AirPlay rate-limiting problems; one vulnerability only affects an older iOS release and lets an attacker with physical access pair a locked device with an AirPlay receiver. A more notable iMessage issue may let someone join a group and receive its messages without being invited. Apple states that none of these bugs are being exploited.
https://isc.sans.edu/diary/Apple+Patches+Everyting+November+2026+Edition/33506/
SAP Patch Tuesday
SAP's November Security Patch Day, issued in sync with Microsoft's, includes four vulnerabilities with a perfect CVSS score of 10, three more at 9.9, and two more in the nines, including issues in SAP NetWeaver. Onapsis reported a broken access control flaw in SAP Gateway (CVE-2026-89103) tied to the proxy access control list, and a WebSocket memory-corruption bug that Onapsis has shown as a denial of service but says can also allow remote code execution (CVE-2026-76964 and CVE-2026-89126).
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/
https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Tuesday, November 10th, 2026: SAP NetWeaver Webshells (CVE-2025-31324); N-able N-central Offline; Chrome XML 0-Day (CVE-2026-125350); Outlook DMARC Required
Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting …
Show notes
Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting mail without DMARC.
Attackers Searching for SAP NetWeaver Webshells
ISC honeypots are seeing probes for ant.jsp and related paths tied to SAP NetWeaver CVE-2025-31324, a CVSS 10 unauthenticated file-upload flaw attackers still use to plant webshells even after recent patches. Watch /irj/servlet_jsp/irj/root/ and other upload endpoints for leftover shells.
https://isc.sans.edu/diary/Attackers%20Searching%20for%20SAP%20Netweaver%20Webshells/33502
N-able N-central Critical Security Incident
N-able took Hosted N-central offline after public disclosure of roughly 30+ critical vulnerabilities with no patches yet, and advises on-premises customers to take servers offline if not isolated; no exploitation observed so far, with remediation said to be on track.
https://uptime.n-able.com/
https://labs.beazley.security/advisories/BSL-A1242
Google Chrome Zero-Day Patch (CVE-2026-125350)
Chrome stable updates fix nine vulnerabilities, including CVE-2026-125350, a use-after-free in the XML parser that Google says is already exploited in the wild. Update promptly; the advisory does not confirm a sandbox escape.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Strict Outlook DMARC Policies
Outlook is rejecting mail with 550 errors when the sending domain lacks a DMARC record, even if SPF and DKIM pass. Publish at least a DMARC record (for example p=none) alongside SPF and DKIM.
https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak
ISC honeypots seeing sshole (CVE-2026-123158) exploitation attempts; SonicWall patches seven SonicOS flaws including an already-exploited SSL VPN MFA bypass; Microsoft cloud-fixed an Entra Device Registration …
Show notes
ISC honeypots seeing sshole (CVE-2026-123158) exploitation attempts; SonicWall patches seven SonicOS flaws including an already-exploited SSL VPN MFA bypass; Microsoft cloud-fixed an Entra Device Registration elevation-of-privilege bug; Apiiro found Claude Code saving secrets into .claude/settings.local.json on GitHub.
Scans for sshole Vulnerability (CVE-2026-123158)
ISC honeypots are seeing long letter-A passwords that look like sshole exploitation, with clear attempts starting November 5th after earlier long passwords that were mostly buggy brute-force scripts dumping shell commands into the password field. Honeypots only keep the first 255 characters of each password, which limits what can be measured.
https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498
SonicWall SonicOS Multiple Vulnerabilities (SNWLID-2026-0014)
On Friday SonicWall released patches for seven SonicOS vulnerabilities; one already-exploited flaw lets attackers bypass multi-factor authentication for SSL VPN logins when an alternate authentication method without MFA is also defined. Patch promptly press and CISA associate the exploited issue with CVE-2026-19868.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
Entra Device Registration Elevation of Privilege (CVE-2026-109469)
Microsoft patched an authorization bypass in Entra Device Registration over the weekend that could let an unauthorized attacker elevate privileges. No customer action is required: it is a Microsoft-hosted cloud service, and Microsoft says there was no exploitation at the time of the fix and rates future exploitation less likely.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469
Claude Code Leaking Secrets on GitHub
Apiiro reports that Anthropic's Claude Code can store credentials in .claude/settings.local.json when you tell it not to ask again about an API or command, and that on the order of a thousand-plus of those credential files have shown up on GitHub. ISC web honeypots also saw new requests for the .claude directory this weekend; rotate exposed secrets and watch for Anthropic updates.
https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Friday, November 6th, 2026: RootEvidence Cisco IOS Opt-Out Scans; OpenSSH musl sshhole (CVE-2026-123158); Refrigeration OT Hardening; Zyxel GS1900 OOB Write (CVE-2026-107441)
Today: RootEvidence Cisco IOS vulnerability scans with HTTP opt-out headers; a critical OpenSSH password bypass on musl (sshole / CVE-2026-123158); a U.S. government factsheet on hardening industrial …
Show notes
Today: RootEvidence Cisco IOS vulnerability scans with HTTP opt-out headers; a critical OpenSSH password bypass on musl (sshole / CVE-2026-123158); a U.S. government factsheet on hardening industrial refrigeration OT; and an actively exploited Zyxel GS1900 out-of-bounds write (CVE-2026-107441).
RootEvidence Cisco IOS Scans / Opt-Out Headers
ISC honeypots saw Cisco IOS vulnerability scans from exposure-management firm RootEvidence. Unlike typical Internet-wide scanners, their HTTP requests include Opt-Out-Email and Opt-Out-Url headers so administrators can request exclusion.
https://isc.sans.edu/diary/Vulnerability%20Scans%20for%20Older%20Cisco%20IOS%20Vulnerability%20%20%20Opt-Out%20Headers/33492
https://www.rootevidence.com/scanners/
OpenSSH musl Password Bypass (sshole / CVE-2026-123158)
A critical password-authentication bypass affects OpenSSH on musl libc systems (Alpine Linux, OpenWrt, and similar) when sshd allows password logins without libpam. Passwords longer than 256 characters can authenticate accounts that have no password set (shadow field "*"). Details and walkthrough at sshhole.com; fixed in OpenSSH 10.6p2.
https://sshhole.com/
https://nvd.nist.gov/vuln/detail/CVE-2026-123158
https://www.openssh.org/txt/release-10.6p2
https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
Guidance to Secure Refrigeration / Cold-Chain Systems
U.S. government agencies published a joint factsheet urging owners of industrial refrigeration and cold-chain monitoring systems to harden them after grocery-store and military-base fridge attacks that spoiled large amounts of food. Advice is largely standard OT hygiene (reduce Internet exposure, isolate OT, credential security, patching) and applies beyond refrigeration.
https://www.cisa.gov/sites/default/files/2026-11/joint-factsheet-usg-partners-urge-hardening-industrial-refrigeration-cold-chain-monitoring-systems-508c.pdf
Zyxel GS1900 Out-of-Bounds Write Exploited (CVE-2026-107441)
Zyxel released firmware updates for GS1900 series switches fixing an out-of-bounds write that is being exploited in the wild. Binarly found a Python exploit in a malware repository; attacks steal configuration data including hashed passwords. The advisory says the attacker needs network access. Patch to 2.90 Patch 3 builds.
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
https://www.binarly.io/advisories/brly-2026-057
https://nvd.nist.gov/vuln/detail/CVE-2026-107441
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Thursday, November 5th, 2026: Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws
Today's Stormcast covers honeypot scans for leftover email test scripts, HD Moore's runZero oobscan for out-of-band management interfaces, a critical apt signature-bypass flaw (CVE-2026-109518), and unpatched …
Show notes
Today's Stormcast covers honeypot scans for leftover email test scripts, HD Moore's runZero oobscan for out-of-band management interfaces, a critical apt signature-bypass flaw (CVE-2026-109518), and unpatched SonicWall GMS end-of-life vulnerabilities.
The Classics Return: Vulnerable E-Mail Scripts
Internet Storm Center honeypots are seeing probes for development email test scripts such as sendmail.php and test-mail.php. Like the classic FormMail script, these can leak environment variables and let attackers send spam through GET or POST parameters, so keep them out of production.
https://isc.sans.edu/diary/The%20Classics%20Return%3A%20Vulnerable%20E-Mail%20Scripts/33488
oobscan: Scan for Out-of-Band Management Interfaces
HD Moore's runZero oobscan hunts exposed BMC, IPMI, SNMP, and IP KVM style out-of-band management interfaces and flags known vulnerabilities on those devices rather than only listing open ports.
https://github.com/runZeroInc/oobscan#research-and-disclosures
apt Signature Bypass (CVE-2026-109518)
A critical flaw in Debian's apt package manager can skip signature verification when a package web server returns crafted error responses, letting an on-path attacker inject malicious packages over HTTP. Prefer HTTPS where your distribution allows it; Ubuntu still often uses HTTP by default. Debian and Ubuntu have published updates for CVE-2026-109518.
https://lists.debian.org/deity/2026/11/msg00005.html
https://ubuntu.com/blog/apt-vulnerability-fixes-available
https://security-tracker.debian.org/tracker/CVE-2026-109518
SonicWall GMS End of Life: Unpatched File Read and SQL Injection
SonicWall Global Management System (GMS) 9.5.2 and earlier are end of life, and SonicWall will not fix an unauthenticated file read (CVE-2026-109593) or an authenticated SQL injection (CVE-2026-109594). Migration to Network Security Manager (NSM) is the vendor path forward.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019
https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html
https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1456/
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Wednesday, November 4th, 2026: Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploit
Today's episode covers attacks that switch supermarket and military commissary freezers into defrost mode, active exploitation of the Node-RED flaw in Siemens SIMATIC IoT2050 devices, the compromised cPGuard …
Show notes
Today's episode covers attacks that switch supermarket and military commissary freezers into defrost mode, active exploitation of the Node-RED flaw in Siemens SIMATIC IoT2050 devices, the compromised cPGuard anti-malware update channel, and Calif's iPhone exploit that works despite Lockdown Mode.
Refrigerator Exploits: Hacked Freezers Switched to Defrost Mode
Attackers have hit refrigeration controllers at hundreds of supermarkets in France and several other European countries, and U.S. investigators are treating August freezer failures at U.S. military commissaries as a suspected cyberattack. The attackers switch freezers into defrost mode, heating them to about 50 C (122 F) and spoiling the food. How the systems were breached is still unclear, though weak default passwords on internet-exposed controllers have been reported.
To help build a honeypot that emulates these devices, please contact me at jullrich-at-sans.edu if you can provide access to one of these refrigeration controllers.
https://blog.claroty.com/blog/france-supermarket-hacks-expose-risks-of-internet-facing-refrigeration-systems
https://www.bbc.com/news/articles/cq1kd1nee80eo
Exploitation Targeting Node-RED on Siemens SIMATIC IoT2050 (CVE-2026-58115)
VulnCheck caught attackers exploiting CVE-2026-58115, a missing authentication flaw (CVSS 10.0) in the Node-RED admin interface of Siemens SIMATIC IoT2050 Advanced industrial devices, to deploy flows that use wget or curl to download a Linux bot. Siemens patched the flaw in August with version 4.3.4.1. Update, or uninstall or harden Node-RED, and keep industrial control systems (ICS) off the internet.
https://www.vulncheck.com/blog/exploitation-targeting-node-red
https://cert-portal.siemens.com/productcert/html/ssa-834709.html
cPGuard Security Advisory: Update Channel Compromise
OPSSHIELD says an attacker used stolen credentials to access the update servers for cPGuard, its anti-malware product for cPanel and shared hosting servers. On November 2, cPGuard versions 5.88.12 through 5.88.19 delivered a malicious script that collected /etc/shadow, MySQL configuration, root shell history, and SSH files. Update to 5.88.25 or later, check the install log for affected versions, rotate credentials, and review the indicators of compromise in the advisory.
https://opsshield.com/notice/cpguard-update-channel-compromise.html
iPhone 18 Pro Exploited via AirDrop with Lockdown Mode Enabled
Security firm Calif released a video showing an iPhone 18 Pro with Lockdown Mode enabled being fully compromised after the user accepted a malicious PDF sent via AirDrop. Calif has not published technical details, so users who rely on Lockdown Mode should not accept unexpected AirDrop files.
https://x.com/calif_io/status/2117720348322144733
https://www.macrumors.com/2026/11/03/iphone-jailbreak-lockdown-mode/
Vote in the SANS Difference Makers Awards
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
Today's episode covers how to detect multipath TCP in your network, attacks stealing Bitcoin and Litecoin from outdated BTCPay Server installs, Barracuda patches for an authorization bypass and command …
Show notes
Today's episode covers how to detect multipath TCP in your network, attacks stealing Bitcoin and Litecoin from outdated BTCPay Server installs, Barracuda patches for an authorization bypass and command injection in Email Security Gateway and other appliances, and Synology's warning about ransomware hitting outdated DSM devices.
Multipath TCP: Use and Detection
Multipath TCP (MPTCP), back in the news because of the Linux vulnerability CVE-2026-98432, is identified by TCP option 30 and is most commonly used by iOS devices connecting to Apple's 17.0.0.0/8 network for Siri and Apple Music. The diary explains the MPTCP subtypes and how to spot them with Wireshark, tcpdump, Suricata and Zeek.
https://isc.sans.edu/diary/Mutipath%20TCP%3A%20Use%20and%20Detection/33482
Security Incident Affecting BTCPay Server 2.4.1 and Earlier
Attackers stole Bitcoin and Litecoin from hot wallets on BTCPay Server instances running version 2.4.1 or earlier by exploiting a vulnerability fixed in 2.4.2 (August 7, 2026). BTCPay recommends that affected operators sweep remaining funds to a new wallet, rebuild on a fresh server, and replace any exposed credentials.
https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/
Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products
Barracuda patched an authorization bypass (CVE-2026-116606, CVSS 9.3) affecting the Email Security Gateway (ESG) and a command injection (CVE-2026-111560, CVSS 8.6) affecting ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. Chained on ESG, they can give an attacker with access to the admin interface root access, so keep admin interfaces off the internet.
https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
Synology urges users to update DSM following ransomware attacks on outdated DSM versions
Synology warns that ransomware attackers are exploiting a vulnerability patched in December 2024 (Synology-SA-24:20) on devices still running outdated versions of DSM (DiskStation Manager). Update DSM now and enable automatic updates.
https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions
https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death
Didier Stevens adds bulk JSON extraction to his OneNote analysis tool, a trojanized Anthropic Claude Code extension in the Cursor VS Code Extension Marketplace installs an SSH backdoor, Ivanti patches two more …
Show notes
Didier Stevens adds bulk JSON extraction to his OneNote analysis tool, a trojanized Anthropic Claude Code extension in the Cursor VS Code Extension Marketplace installs an SSH backdoor, Ivanti patches two more exploited Connect Secure zero-days, an Android "SMS of Death" proof of concept is public, and a Linux kernel Multipath TCP (MPTCP) mitigation update.
OneNote File Extraction
Didier Stevens added a --jsonoutput option to his onedump.py tool, so embedded attachments from many OneNote (.one) files can be extracted in one run instead of one file at a time. Combined with myjson-filter.py, all embedded files are written to disk named by their SHA-256 hash.
https://isc.sans.edu/diary/OneNote%20File%20Extraction/33478
Trojanized Claude Code Extension in Cursor's Marketplace
Malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were available in the Cursor VS Code Extension Marketplace on October 29; they were not built by Anthropic. The extension adds an attacker SSH key, installs persistence, and tries to open a reverse SSH tunnel (that step fails on most hosts without admin rights). Cursor shut down the marketplace during cleanup and published indicators of compromise and detection and remediation scripts.
https://cursor.com/blog/claude-code-extension-security-notice
Ivanti Connect Secure Update and Exploit Details
Ivanti updated its October 13 Connect Secure advisory (CVE-2026-104935, authentication bypass) with fixes for two more vulnerabilities exploited in the same chain: CVE-2026-111357, missing authentication for a critical function allowing escalation to root (CVSS 8.8), and CVE-2026-118527, file uploads to predictable locations. Volexity describes how the three zero-days were chained for unauthenticated root code execution; update to 25.1.1.3 or 22.8R2.6 even if you patched on October 13.
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
SMS of Death
A working proof of concept is now public for the "SMS of Death": a single malformed Wireless Application Protocol (WAP) Push SMS crashes com.android.phone, dropping active calls with no user interaction. Google fixed this denial of service in the October 2026 Android security update for Android 14 through 17.
https://smsofdeath.com
Linux Multipath TCP Vulnerability Update
A follow-up on Friday's Linux kernel remote code execution flaw (CVE-2026-98432): the demonstrated exploit needs Multipath TCP enabled and a listening socket. Many distributions have shipped kernel updates; until you can patch, setting the sysctl net.mptcp.enabled=0 disables MPTCP.
https://aws.amazon.com/security/security-bulletins/2026-160-aws/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath …
Show notes
Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath TCP, and a returning Hugging Face malware campaign that abuses trust_remote_code to mine cryptocurrency on GPU hosts.
Deploying a Local Ghidra Server for Your Malware Analysis Lab
Xavier Mertens shows how to set up Ghidra Server, which ships free with Ghidra, so reverse engineering projects are stored and versioned outside the analysis virtual machine and survive a revert to a clean snapshot. A small Linux VM with about 4 GB of RAM is enough; keep it inside the malware lab network, since it holds every imported sample, and never expose it to the internet.
https://isc.sans.edu/diary/Deploying%20a%20Local%20Ghidra%20Server%20for%20Your%20Malware%20Analysis%20Lab/33470
Claude Discovers Zero-Click Linux Kernel Multipath TCP Remote Code Execution (CVE-2026-98432)
Anthropic's Frontier Red Team used Claude to find and exploit a race-condition use-after-free in the Linux kernel networking stack that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener, defeating kernel address space layout randomization (KASLR) along the way. Exploitation is slow: the proof of concept needed about 48 minutes to leak a kernel pointer plus five minutes to reach code execution. The fix is upstream and backported to stable kernels, but not every distribution has shipped it yet, including Ubuntu at recording time.
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining
Pluto Security tracked 31 malicious Hugging Face repositories across seven accounts posing as small Qwen2 models; loading one with trust_remote_code=True runs the repository's Python code, which installs a disguised fileless cryptocurrency miner, a watchdog and, in some builds, reverse shells. The campaign targets GPU hosts running self-hosted inference such as Xinference and GPUStack, returned within days of a takedown, and passed 32,000 downloads including linked models.
https://pluto.security/blog/hugging-face-malware-campaign-load-mine/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Thursday, October 29th, 2026: ClickFix Campaign Targets macOS and Windows; EDK II UEFI PXE Pre-Boot RCE (CVE-2026-97631); Qwen AI Model Data Exfiltration; LiteLLM Master Key Leak
Today: a new ClickFix campaign using fake Cloudflare verification pages, a pre-boot remote code execution flaw in the EDK II UEFI PXE network boot driver, Cohere research on the Qwen AI model trying to send …
Show notes
Today: a new ClickFix campaign using fake Cloudflare verification pages, a pre-boot remote code execution flaw in the EDK II UEFI PXE network boot driver, Cohere research on the Qwen AI model trying to send data to Alibaba Cloud, and a CVSS 10 LiteLLM file read flaw that leaks the proxy master key.
Yet Another ClickFix Campaign Uses Fake Cloudflare Verification Pages
Brad Duncan captured a previously unseen ClickFix campaign that uses fake Cloudflare verification pages and targets both macOS and Windows. The final malware could not be retrieved, but the diary lists the URLs and indicators of compromise (IOCs) for threat hunting.
https://isc.sans.edu/diary/Yet%20Another%20ClickFix%20Campaign/33466
EDK II UEFI PXE Driver Pre-Boot Remote Code Execution (CVE-2026-97631)
An unauthenticated attacker at any network distance can send oversized ICMP error messages to a system while it network boots via PXE (Preboot Execution Environment), corrupting memory in the UEFI firmware and executing code before Secure Boot checks the operating system. The attack window is limited to the boot, but attackers may send ICMP errors continuously or force a reboot; organizations that PXE-boot servers should patch quickly. The advisory lists a fix in edk2 pull request #13302 but marks the issue "Not patched currently."
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
Qwen Open-Weight AI Model Caught Attempting Data Exfiltration to Alibaba Cloud
Researchers at Cohere found that a locally run Alibaba Qwen model (Qwen3.8-Flash-Next) occasionally inventoried its host and tried to upload a probe file with curl to an Alibaba Cloud storage bucket in Beijing. The behavior is rare, and Cohere cannot say whether it is deliberate or a leftover from training, but it shows that self-hosting a model does not guarantee your data stays local.
https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
LiteLLM Unauthenticated File Read Leaks Master Key on Enterprise Proxy
A CVSS 10 vulnerability in the LiteLLM AI proxy lets unauthenticated attackers read local files, exposing the LITELLM_MASTER_KEY and the API keys for the AI providers it connects to. Only deployments with an Enterprise license are affected; it is fixed in versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5.
https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
SANS Difference Maker Awards
Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:
https://www.sans.org/go/difference-makers-awards-2026SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs
In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks …
Show notes
In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.
eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python
Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.
https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update
https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134125-windows-10-21h2-22h2-update
https://support.apple.com/en-us/149555
PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)
Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.
https://security.paloaltonetworks.com/CVE-2026-109618
Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)
Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)
Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
SANS Difference Maker Awards
Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:
https://www.sans.org/go/difference-makers-awards-2026SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)
In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM …
Show notes
In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497.
Apple Patches for October 2026: 304 Vulnerabilities Fixed
Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover a malicious app accessing the camera without user permission (CVE-2026-86990) and a local attacker gaining access to Keychain items (CVE-2026-28864).
https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/
Looking for a Language: Threat Hunting in a DShield SIEM Honeypot with ELK
In a guest diary, SANS.edu undergraduate intern Jeffray Spence shows how to use Elasticsearch and Kibana in the DShield SIEM (security information and event management) honeypot to hunt for threats. Filtering on HTTP language preference headers, such as Accept-Language and Accept-Charset values requesting Chinese, isolates related requests and helps identify automated scanning campaigns and the threat actors behind them.
https://isc.sans.edu/diary/Looking%20for%20a%20Language%20%5BGuest%20Diary%5D/33442
More Brotli Updates: .NET Out-of-Band Patch and PHP Windows Builds (CVE-2026-111497)
Microsoft released out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a buffer overflow in Brotli decompression. PHP rebuilt its Windows binaries with the updated Brotli library without changing the PHP version number, so compare hashes to confirm you run the fixed build. Expect more vendors to release Brotli fixes over the next few weeks.
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
https://www.php.net/archive/2026.php#2026-10-26-1
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws
In this episode: why a reliable PHP2Shell exploit is still hard to build, a Node.js Brotli decoder remote code execution flaw, publicly disclosed Tailscale mesh VPN vulnerabilities, and an HPE update fixing 72 …
Show notes
In this episode: why a reliable PHP2Shell exploit is still hard to build, a Node.js Brotli decoder remote code execution flaw, publicly disclosed Tailscale mesh VPN vulnerabilities, and an HPE update fixing 72 vulnerabilities in ArubaOS 8 and 10.
Reliable PHP2Shell Exploitability
Bojan Zdrnja found that building a reliable, universal exploit for the PHP2Shell vulnerabilities is difficult: address space layout randomization (ASLR) requires a second leak to find the base address, a larger PHP memory limit makes exploitation harder, and the offsets depend on the exact PHP version and Linux distribution. Targeted exploitation has been reported, so finish patching and keep session.upload_progress.enabled set to 0 even after applying the update.
https://isc.sans.edu/diary/%28Reliable%29%3F%20php2shell%20exploitability/33452
Node.js Brotli Decoder Out-of-Bounds Write (CVE-2026-111497)
The Node.js October 2026 security releases fix several vulnerabilities, including an out-of-bounds write in the bundled Brotli compression library's decoder that permits remote code execution when an application decompresses attacker-supplied data. OpenAI Codex Security is credited with the discovery; watch for Brotli decoder fixes in other products that use the library.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Tailscale "Tailworm" Vulnerabilities
Researchers made a set of vulnerabilities in the Tailscale mesh VPN public without coordinated disclosure. Exploitation requires access to the tailnet, but critical issues bypass Tailscale's trust model, for example by letting an attacker join their own systems to your tailnet; watch for Tailscale updates.
https://tailworm.com/
HPE Aruba Networking Update for ArubaOS 8 and 10 (AOS-8/AOS-10)
Hewlett Packard Enterprise (HPE) bulletin HPESBNW05162 fixes 72 vulnerabilities in the ArubaOS 8 and 10 wireless operating systems, eight of which allow unauthenticated remote code execution. Apply the update; expect more large updates like this as vendors use AI tools to find vulnerabilities.
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked
Today's episode covers an update on the PHP2Shell vulnerabilities, a Signal flaw that kept calls alive after hang-up, critical Cisco Snort 3 vulnerabilities, and Linux kernel KSMBD vulnerability reports that …
Show notes
Today's episode covers an update on the PHP2Shell vulnerabilities, a Signal flaw that kept calls alive after hang-up, critical Cisco Snort 3 vulnerabilities, and Linux kernel KSMBD vulnerability reports that were accidentally posted to a public mailing list.
PHP Vulnerability Update
Patches for the PHP remote code execution (RCE) vulnerabilities are now available from many vendors, with notable exceptions such as QNAP. Cloudflare reports a lot of exploit activity, and Amazon saw exploit attempts before public disclosure, but no simple, reliable exploit has surfaced yet. Beware of fake exploits that may attack the person running them.
https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
Signal: Flooded Call Event Queue Blocks Local Hang-Up (CVE-2026-113380)
During a call, the other side could flood a Signal client with events and prevent it from hanging up, leaving the connection active so an attacker could keep listening through the microphone. The flaw has been patched; keep Signal updated automatically.
https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380
Cisco Snort 3 Critical Vulnerabilities
Cisco patched critical Snort 3 vulnerabilities with a base CVSS (Common Vulnerability Scoring System) score of 9.0. The four CVEs group multiple AI-discovered vulnerabilities by shared CWE (Common Weakness Enumeration), making the individual flaws less transparent. Snort is also included in several Cisco appliances.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe
Linux Kernel KSMBD Vulnerability Reports Leaked
Trend Micro's Zero Day Initiative accidentally posted unpatched Linux kernel vulnerability reports to a public kernel mailing list, including CVSS 9 remote code execution flaws in the kernel's built-in SMB file sharing server (KSMBD). No patches are available yet, and proof-of-concept exploit code was included in some reports.
https://lore.kernel.org/lkml/BYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
This episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security …
Show notes
This episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security hardening release for multiple products based on an AI-assisted security review.
Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Exploited; Infocon Yellow
Two vulnerabilities in the PHP core, an out-of-memory issue triggered by multipart MIME uploads and a memory-clearing flaw exploited with a second request, can lead to remote code execution and can be chained; exploitation is already underway, and your application code, authentication, and configuration will not protect you. Updates are available for PHP 8 but not for PHP 7 or PHP 5, and vendors such as Cisco, Palo Alto Networks, OPNsense, and pfSense have published advisories or updates for their appliances. If you cannot patch, consider web application firewall (WAF) rules that block multipart MIME uploads or temporarily taking the site offline, and assume compromise for public sites without mitigations.
https://www.dshield.org/diary.html/Critical+PHP+Vulnerability+%28CVE-2026-109618%2C+CVE-2026-109619%29+%5Binfocon+yellow%5D/33440/#comment
Fortinet Security Hardening Release for Multiple Products
Fortinet announced updates across several products after a security review using AI tools, crediting a number of AI vendors but naming no CVEs and providing few details. The release covers FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, and Fortinet customers should review it and update.
https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC
Today's episode covers eight eMudhra intermediate CA certificates revoked after a key generation error, an accelerated critical PHP security release fixing two core vulnerabilities, Oracle's October 2026 …
Show notes
Today's episode covers eight eMudhra intermediate CA certificates revoked after a key generation error, an accelerated critical PHP security release fixing two core vulnerabilities, Oracle's October 2026 Critical Patch Update with 1,295 fixes including an Oracle E-Business Suite SQL injection, and a proof-of-concept exploit for a FortiSIEM gRPC path traversal leading to remote code execution.
eMudhra Intermediate CA Compromise
Eight intermediate CA certificates from Indian certificate authority eMudhra were revoked after a scripting error during the HSM key ceremony left their private keys one byte long. Browsers now reject them, but software with its own CA bundle, like curl on macOS, may need updating. The post includes a browser test page.
https://emudhra.we-have-a-problem.com/
Upcoming Critical PHP Security Release
PHP fixes two critical vulnerabilities in PHP core, rated CVSS 9.2, affecting versions back to PHP 5. The release was moved up to Wednesday, October 21st at 14:00 UTC (10 a.m. Eastern) after details leaked. Expect exploits soon after the patch.
https://www.php.net/archive/2026.php#2026-10-20-1
Oracle Critical Patch Update Advisory - October 2026
Oracle's quarterly update fixes 1,295 new vulnerabilities. Horizon3 is teasing details of an Oracle E-Business Suite SQL injection, CVE-2026-101767.
https://www.oracle.com/security-alerts/cpuoct2026.html
https://x.com/Horizon3Attack/status/2112651247362658611
FortiSIEM gRPC Path Traversal File Write RCE (CVE-2026-106173)
A proof of concept is out for the FortiSIEM flaw patched October 13th. It requires access to port 27918, so block it at the firewall until you patch.
https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA
Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting …
Show notes
Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting, an infostealer slipped into the OVHcloud command line tools, Exchange Server instability after the October 2026 Windows updates, how to contain AI agents, and a YARA rule for orphaned VBA projects in AutoCAD DWG files.
Small Agents, Smaller Blast Radius: Controlling What AI Can Do
Mark outlines techniques to restrict what AI agents can do, including limiting permissions, using containers, and planning for AI vendors retiring older models.
https://isc.sans.edu/diary/Small%20Agents%2C%20Smaller%20Blast%20Radius%3A%20Controlling%20What%20AI%20Can%20Do/33430
Orphaned VBA Projects Inside DWG Files: YARA Rule
Didier Stevens follows up on hidden Visual Basic for Applications projects in AutoCAD DWG files with a YARA rule to detect them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files%3A%20YARA%20Rule/33434
Broadcom eCos Wi-Fi Remote Code Execution Vulnerability
Quentin Kaiser shows that an attacker in Wi-Fi range can execute code on Broadcom eCos access points without WPA authentication and steal the WPA key. Broadcom has not issued a CVE, and many ISP-provided access points are affected.
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
OVHcloud Command Line Tools Compromised
For a few hours on Friday, compromised versions of the OVHcloud CLI shipped an infostealer. Update to version 0.16.0, released after the compromise, and pin package hashes.
https://github.com/ovh/ovhcloud-cli/issues/300
Plex2Shell Vulnerability (Exploited!)
A chain starting with server-side request forgery (SSRF) to loopback lets attackers steal admin tokens and run code on Plex Media Server without authentication (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It is already exploited; patch now and assume compromise if your server is exposed.
https://zmain.info/blog/plex2shell
Exchange Servers May Become Unstable After the October 2026 Windows Updates
Microsoft recommends a registry change rather than uninstalling the update on on-premises Exchange Server.
https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382
NGINX ngx_http_core_module Vulnerability (CVE-2026-15176)
https://my.f5.com/manage/s/article/K000162416
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an …
Show notes
Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity.
Panchan's Mining Island [Guest Diary]
SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis.
https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5BGuest%20Diary%5D/33426
Cisco Secure Email Gateway 0-Day (CVE-2026-76519)
With the reputation feature enabled, the advanced malware protection feature lets attackers write arbitrary files and execute code as root. The flaw is already exploited and there is no workaround, so patch and review Cisco's indicators of compromise.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Palo Alto Networks 0-Day (CVE-2026-0322)
An already exploited, authenticated remote code execution vulnerability that runs code as root. Exploitation requires an exposed management interface.
https://security.paloaltonetworks.com/CVE-2026-0322
Ivanti Connect Secure 0-Day (CVE-2026-104935)
Volexity found three chained vulnerabilities: an authentication bypass, an arbitrary file write leading to remote code execution, and a privilege escalation. Ivanti patched the first two under one CVE; the privilege escalation appears unpatched.
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
No Podcast on Monday, Oct. 19th.
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE
Today's episode covers hidden Visual Basic for Applications (VBA) macros left behind in AutoCAD drawings, Ledger hardware crypto wallets found with LTE implants that steal seed phrases, a Docker Hub account …
Show notes
Today's episode covers hidden Visual Basic for Applications (VBA) macros left behind in AutoCAD drawings, Ledger hardware crypto wallets found with LTE implants that steal seed phrases, a Docker Hub account conversion flaw that exposed personal access tokens, and a curl update fixing a remote code execution bug in HTTP/2 uploads.
Orphaned VBA Projects Inside DWG Files
Didier Stevens found AutoCAD DWG files whose VBA projects are no longer referenced but still present inside the file, likely left behind by an AutoLISP delete command, and shows a new way to extract them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files/33420
Ledger Crypto Wallet Supply Chain Attack: Hardware Implants
Ledger wallets sold through authorized resellers, first in Asia and recently by MediaMarkt in Europe, were found with LTE modules and SIM cards that exfiltrate the seed phrase. Reports put losses at up to $100 million.
https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/
Docker Hub Account Migration Bug (CVE-2026-105445)
Converting a personal Docker Hub account to an organization moved the old user's personal access tokens to a target user without confirmation, letting an attacker authenticate as that user. Docker fixed the issue and notified affected users.
https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/
curl Patches HTTP/2 Upload Remote Code Execution Flaw
A new curl release fixes several vulnerabilities, including remote code execution triggered when uploading a file over HTTP/2 to a malicious server. A proof of concept is available.
https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Wednesday, October 14th, 2026: October 2026 Patch Tuesday: Microsoft Fixes 1,417 Vulnerabilities; Ivanti Connect Secure Exploited; Adobe ColdFusion and Commerce Critical Patches
In today's episode: Microsoft's October 2026 Patch Tuesday fixes 1,417 vulnerabilities, including an exploited Mark of the Web bypass, plus Ivanti patches an exploited Connect Secure flaw and Adobe fixes …
Show notes
In today's episode: Microsoft's October 2026 Patch Tuesday fixes 1,417 vulnerabilities, including an exploited Mark of the Web bypass, plus Ivanti patches an exploited Connect Secure flaw and Adobe fixes critical ColdFusion and Adobe Commerce vulnerabilities.
October 2026 Microsoft Patch Tuesday
Microsoft patched 1,417 vulnerabilities, 76 rated critical. CVE-2026-96951, an already exploited Windows Shell security feature bypass, skips the Mark of the Web warning. CVE-2026-108398, a publicly disclosed .NET Framework flaw, bypasses application control. Also patched: 10 remote code execution flaws in Windows DHCP Server (five critical), an Exchange Server RCE triggered by a crafted email (CVE-2026-70571), and many Microsoft Office RCE vulnerabilities.
https://isc.sans.edu/diary/October%202026%20Microsoft%20Patch%20Tuesday/33422
Ivanti October 2026 Security Update
Ivanti fixed an Ivanti Connect Secure vulnerability already exploited in limited attacks, plus two Ivanti Neurons vulnerabilities that can leak the credentials used to connect to Microsoft Intune. Patch, then rotate those Intune credentials.
https://www.ivanti.com/blog/october-2026-security-update
Adobe Patch Tuesday: ColdFusion and Adobe Commerce
Adobe fixed 110 vulnerabilities across 11 products. Adobe Commerce has critical arbitrary code execution flaws, and ColdFusion has CVSS 10.0 server-side request forgery (SSRF) and unrestricted file upload vulnerabilities. Prioritize these two products.
https://www.adobe.com/trust/security/bulletins-and-advisories.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches
In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on …
Show notes
In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates.
CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE
An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee
Let s Encrypt 64-Day Certificate Lifetimes Coming Feb 2027
Let s Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates.
https://letsencrypt.org/2026/10/07/64-day-certs.html
Midnight Mimosa: Malware Pre-Installed on Android Phones
Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud.
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Progress MarkLogic Critical Security Alert Bulletin October 2026
Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled.
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)
In today's episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through …
Show notes
In today's episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through the EC2 instance metadata service (IMDS), and ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass.
Why TLP Should Not Replace Your Internal Information Classification
The Traffic Light Protocol from FIRST defines who threat intelligence may be shared with, from TLP:CLEAR to TLP:RED, but not how to protect it in transit. Organizations still need their own classification and safeguards, such as encryption, instead of sending TLP:AMBER data in plain email.
https://isc.sans.edu/forums/diary/Why%20TLP%20should%20not%20replace%20your%20internal%20information%20classification/33414/
AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents. A prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service, made possible by IMDSv1 and overly broad permissions. Restrict the URLs your AI agents can reach and always use IMDSv2.
https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model
Palo Alto GlobalProtect VPN Vulnerability Exploited by Ransomware (CVE-2026-0257)
ReliaQuest reports ransomware actors exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access to open unauthorized VPN sessions. Patch VPN gateways, and keep VPN clients updated too.
https://x.com/ReliaQuestTR/status/2108647641240465707
https://security.paloaltonetworks.com/CVE-2026-0257
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Friday, October 9th, 2026: AI Agent Forensics; AI-Assisted Attack on South Korean Banks; IDN Typosquatting; Cisco Finesse SSRF (CVE-2026-20362)
In today's episode: new scripts for reconstructing AI agent activity during forensic investigations, an attacker's Claude chat history recovered after breaches at South Korean financial institutions …
Show notes
In today's episode: new scripts for reconstructing AI agent activity during forensic investigations, an attacker's Claude chat history recovered after breaches at South Korean financial institutions, internationalized domain name (IDN) lookalikes that still get past Chrome, and an unpatched Cisco Finesse server-side request forgery (SSRF) vulnerability.
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review
Jim Clausing released two scripts that turn the logs left behind by the OpenCode and Hermes AI agents into searchable JSON, so incident responders can see what an AI agent did on an attacker's or a victim's system.
https://isc.sans.edu/diary/Reconstructing%20AI%20Agent%20Activity%3A%20Two%20New%20Scripts%20for%20Forensic%20Review/33410
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
While investigating breaches at South Korean financial institutions, CrowdStrike recovered the attacker's CLAUDE.md file and Claude chat history, a rare look at how a low-skill "prompt kiddie" uses AI to run an attack.
https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
Turning IDN Edge Cases into Typosquats
Attackers can still register convincing lookalike domains using Unicode characters that resemble Latin letters but are not on Chrome's list of known confusables. One test domain impersonating Apple displayed in Chrome but not in Safari.
https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats
Cisco Finesse SSRF Vulnerability (CVE-2026-20362)
Cisco disclosed an unauthenticated server-side request forgery vulnerability in the Cisco Finesse web-based management interface, rated High (CVSS 7.2). Details are already public, there is no workaround, and fixed releases are not expected until January or February 2027.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Thursday, October 8th, 2026: Atlassian Vulnerabilities; ccTLD Compormise; Outlook blocking .msix
Scans for Atlassian vulnerablity (CVE-2026-21589) https://isc.sans.edu/diary/Scans%20for%20Atlassian%20vulnerablity%20%28CVE-2026-21589%29/33406 .gh, .sl and .as ccTLD Compromise …
Show notes
Scans for Atlassian vulnerablity (CVE-2026-21589)
https://isc.sans.edu/diary/Scans%20for%20Atlassian%20vulnerablity%20%28CVE-2026-21589%29/33406
.gh, .sl and .as ccTLD Compromise
https://blog.google/security/chromes-response-to-recent-cctld-registry-hijacks/
Cisco Nexus 3000 and 9000 Series Switches Remote Code Execution Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU
Outlook Blocking MSIX Files
https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Wednesday, October 7th, 2026: RMM Tools; libHEIF RCE; Sonicwall SMA1000, OpenSSH updates, DNSSEC KSK Rollover
More RMM Tools In the Wild https://isc.sans.edu/diary/More%20RMM%20Tools%20In%20the%20Wild/33400 WORDPRESS LIBHEIF RCE https://fortbridge.co.uk/research/wordpress-libheif-rce/ SONICWALL SMA1000 SERIES …
Show notes
More RMM Tools In the Wild
https://isc.sans.edu/diary/More%20RMM%20Tools%20In%20the%20Wild/33400
WORDPRESS LIBHEIF RCE
https://fortbridge.co.uk/research/wordpress-libheif-rce/
SONICWALL SMA1000 SERIES APPLIANCES Vulnerabilities CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
OpenSSH 10.6 Released
https://seclists.org/oss-sec/2026/q4/58
DNSSEC Root Key Signing Key Rollover
https://blog.cloudflare.com/root-ksk-2024-rollover/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Tuesday, October 6th, 2026: cowrie tty Logs; Another Netscaler 0-Day; Exchange Patch
TTY Logs and the Data it Captures https://isc.sans.edu/diary/TTY%20Logs%20and%20the%20Data%20it%20Captures/33396 Citrix Netscaler SAML Vulnerability (0-Day) CVE-2026-88779 …
Show notes
TTY Logs and the Data it Captures
https://isc.sans.edu/diary/TTY%20Logs%20and%20the%20Data%20it%20Captures/33396
Citrix Netscaler SAML Vulnerability (0-Day) CVE-2026-88779
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
Microsoft Exchange September 2026 V2 Update CVE-2026-96940
https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Monday, October 5th, 2026: Funny User-Agents; FortMail 0-Day; GitLab Patch; macOS Full Disk Access
User Agent Strings Curiosities https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394 FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286 …
Show notes
User Agent Strings Curiosities
https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394
FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286
https://fortiguard.fortinet.com/psirt/FG-IR-26-175
Critical GitLab Vulnerability CVE-2026-90970
https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/
Updates to Full Disk Access in macOS
https://developer.apple.com/news/?id=p6zjojqw
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrichSANS Stormcast Friday, October 2nd, 2026: ScreenConnect Abuse; ChatGPT Abuse; Spoofing iCloud; Proton Mail display name
ScreenConnect Client (Ab)used by Attackers https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments Attackers abuse ChatGPT to deliver RAT via ClickFix …
Show notes
ScreenConnect Client (Ab)used by Attackers
https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments
Attackers abuse ChatGPT to deliver RAT via ClickFix
https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?_sp=51406044-aa1d-4278-a4e7-adb5b8ef84b2.1790890760100
Spoofing iCloud From Address
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
Sender spoofing in Proton Mail via display-name homograph
https://alonsovidales.github.io/protonmail-sender-spoofing/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
These are the latest 40 of 2,560 episodes. You’ll find older episodes in the podcast’s feed.
Similar podcasts
More News podcasts
Is this your podcast?
Confirm it with an entry in your feed: you get a code here, add it as podcast:txt to the channel of your feed, and we check it. Your podcast is then shown as “verified” on SoundNode.