SANS.edu Internet Storm Center

SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs https://isc.sans.edu/podcastdetail/10154

SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497) https://isc.sans.edu/podcastdetail/10152

Apple Patches Everything: October 2026 edition. https://isc.sans.edu/diary/33458

Looking for a Language [Guest Diary] https://isc.sans.edu/diary/33442

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws https://isc.sans.edu/podcastdetail/10150

YARA-X 1.22.0 Release https://isc.sans.edu/diary/33454

(Reliable)? php2shell exploitability https://isc.sans.edu/diary/33452

PHP Vulnerability Wrap-Up https://isc.sans.edu/diary/33450

SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked https://isc.sans.edu/podcastdetail/10148

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More https://isc.sans.edu/podcastdetail/10146

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC https://isc.sans.edu/podcastdetail/10144

SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA https://isc.sans.edu/podcastdetail/10142

Orphaned VBA Projects Inside DWG Files: YARA Rule https://isc.sans.edu/diary/33434

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure https://isc.sans.edu/podcastdetail/10140

Small Agents, Smaller Blast Radius: Controlling What AI Can Do https://isc.sans.edu/diary/33430

SANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE https://isc.sans.edu/podcastdetail/10138

Panchan’s Mining Island [Guest Diary] https://isc.sans.edu/diary/33426

Orphaned VBA Projects Inside DWG Files https://isc.sans.edu/diary/33420

SANS Stormcast Wednesday, October 14th, 2026: October 2026 Patch Tuesday: Microsoft Fixes 1,417 Vulnerabilities; Ivanti Connect Secure Exploited; Adobe ColdFusion and Commerce Critical Patches https://isc.sans.edu/podcastdetail/10136

October 2026 Microsoft Patch Tuesday https://isc.sans.edu/diary/33422

SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches https://isc.sans.edu/podcastdetail/10134

SANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257) https://isc.sans.edu/podcastdetail/10132

Why TLP should not replace your internal information classification https://isc.sans.edu/diary/33414

SANS Stormcast Friday, October 9th, 2026: AI Agent Forensics; AI-Assisted Attack on South Korean Banks; IDN Typosquatting; Cisco Finesse SSRF (CVE-2026-20362) https://isc.sans.edu/podcastdetail/10130

Reconstructing AI Agent Activity: Two New Scripts for Forensic Review https://isc.sans.edu/diary/33410

SANS Stormcast Thursday, October 8th, 2026: Atlassian Vulnerabilities; ccTLD Compormise; Outlook blocking .msix https://isc.sans.edu/podcastdetail/10128

Scans for Atlassian vulnerablity (CVE-2026-21589) https://isc.sans.edu/diary/33406

SANS Stormcast Wednesday, October 7th, 2026: RMM Tools; libHEIF RCE; Sonicwall SMA1000, OpenSSH updates, DNSSEC KSK Rollover https://isc.sans.edu/podcastdetail/10126

SANS Stormcast Tuesday, October 6th, 2026: cowrie tty Logs; Another Netscaler 0-Day; Exchange Patch https://isc.sans.edu/podcastdetail/10124

More RMM Tools In the Wild https://isc.sans.edu/diary/33400

SANS Stormcast Monday, October 5th, 2026: Funny User-Agents; FortMail 0-Day; GitLab Patch; macOS Full Disk Access https://isc.sans.edu/podcastdetail/10122

TTY Logs and the Data it Captures https://isc.sans.edu/diary/33396

User Agent Strings Curiosities https://isc.sans.edu/diary/33394

YARA-X 1.21.0 Release https://isc.sans.edu/diary/33392

SANS Stormcast Friday, October 2nd, 2026: ScreenConnect Abuse; ChatGPT Abuse; Spoofing iCloud; Proton Mail display name https://isc.sans.edu/podcastdetail/10120

ScreenConnect Client (Ab)used by Attackers https://isc.sans.edu/diary/33388

SANS Stormcast Thursday, October 1st, 2026: Cisco Catalyst SD-WAN Manager 0-day; Watchguard AP RCE; OpenBao/Vault RCE; Post Quantum Certs https://isc.sans.edu/podcastdetail/10118

SANS Stormcast Wednesday, September 30th, 2026: Wordfence Scans; MikroTik Vulnerability; Poper Blocker Spyware https://isc.sans.edu/podcastdetail/10116

Scans for Wordfence Protected Websites https://isc.sans.edu/diary/33382

SANS Stormcast Tuesday, September 29th, 2026: MacOS/iOS 0-Day Patch; macOS priv. escalation 0-day; File Notification Attacks https://isc.sans.edu/podcastdetail/10114

Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950) https://isc.sans.edu/diary/33376

SANS Stormcast Monday, September 28th, 2026: Macfinger Details; NetScaler 0-Day; KiteWorks 0-Day; ShinyHunters and PeopleSoft https://isc.sans.edu/podcastdetail/10112

Wireshark 4.6.9 Released https://isc.sans.edu/diary/33372

ISC Diary: A Closer Look at Malware From the Macfinger ClickFix Campaign https://isc.sans.edu/diary/33368

SANS Stormcast Friday, September 25th, 2026: Tricky Phishing URL; MacSync Malware Update; SolarWinds Observable Patch https://isc.sans.edu/podcastdetail/10110

One URL, Three Different Tricks https://isc.sans.edu/diary/33366

SANS Stormcast Thursday, September 24th, 2026: Macfinger ClickFix; Malicious Terraform; MikroTik and F5 Big IP Vulnerability Details https://isc.sans.edu/podcastdetail/10108

SANS Stormcast Wednesday, September 23rd, 2026: GET with Body; Checkpoint, VeloCloud, BigIP and Microsoft Defender 0-days https://isc.sans.edu/podcastdetail/10106

ISC diary: #Macfinger #ClickFix campaign https://isc.sans.edu/diary/33360