SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich
  • 4.9 (677)
  • Tech News
  • Daily

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

  1. 1d ago

    SANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage

    This episode covers scans for a GPUStack authentication bypass, a ConnectWise ScreenConnect security advisory, public exploits for N-able N-central, and a Microsoft 365 outage. GPUStack Authentication Bypass Scans (CVE-2026-102895) Johannes writes up scans against GPUStack, open-source software that manages clusters of GPUs for AI workloads. An attacker can spoof the X-GPUStack-Real-IP header with the loopback address to bypass authentication. A fixed version was released in July, the CVE was assigned about a week ago, and exploitation is trivial on an exposed system. https://isc.sans.edu/diary/Exploit%20Attempts%20for%20GPUStack%20Authentication%20Bypass%20%28CVE-2026-102895%29/33514 https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr ConnectWise ScreenConnect Security Advisory ConnectWise released another ScreenConnect advisory about an ongoing investigation into the compromise of some customer and partner sites. The company is looking at 400 compromised environments and has disabled a set of third-party plugins; users should update the ScreenConnect client to version 26.6.5, which also fixes a vulnerability still being used to spread malware after those compromises. https://www.connectwise.com/company/trust/advisories N-able N-central Public Exploits Public exploits are now available for at least three of the N-able N-central vulnerabilities that were disclosed last week without first notifying the vendor. The code is in a GitHub repository that Johannes has not yet verified, so treat it with caution; if you are running an exposed unpatched N-able system, upgrade immediately and assume compromise. https://github.com/MSPNightmare/CVEs/tree/main/0-Days/N-Central%20N-Able Microsoft 365 Downtime Microsoft had a significant availability event in which large parts of Microsoft 365, including Exchange and Outlook, were unreachable, and the disruption also affected sites that rely on Microsoft 365 single sign-on, including Entra. Microsoft said it was bringing systems back online, but service was still unavailable for many Microsoft 365 Business and Enterprise users at the time of recording. https://status.cloud.microsoft/m365/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  2. 2d ago

    SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2

    This episode covers leftover Patch Tuesday issues: a critical remote code execution flaw in Apache HTTP Server's mod_http2 module (CVE-2026-119618), Fortinet's 89 advisories with 17 critical vulnerabilities especially in FortiMail, Ivanti's November 2026 update including an Endpoint Manager SQL injection and a Cloud Services Application certificate issue, an unpatched Windows Common Log File System privilege escalation called SignDrop, and N-able's N-central 2026.4 Hotfix 2. Apache HTTP Server mod_http2 Remote Code Execution (CVE-2026-119618) Apache released HTTP Server 2.4.71, fixing a critical heap overflow in the mod_http2 assign_headers function that can lead to remote code execution. No public working exploit is available yet; disabling HTTP/2 can mitigate the issue, but proxies that translate to HTTP/2 still need to watch for HTTP request smuggling. https://httpd.apache.org/security/vulnerabilities_24.html Fortinet November Advisories Fortinet published 89 advisories addressing more than 100 vulnerabilities across its product portfolio, including 17 rated critical. FortiMail received the most critical fixes, and several of the critical issues may allow unauthenticated arbitrary code execution. Fortinet used AI as part of the vulnerability discovery work behind this release. https://www.fortiguard.com/psirt Ivanti November 2026 Security Update Ivanti's November 2026 security update includes a SQL injection in Endpoint Manager (EPM) that may be leveraged for remote code execution, tracked as CVE-2026-121653, and a vulnerability in Ivanti Cloud Services Application (CSA) that allowed unauthenticated alteration of trusted EPM Core certificates (CVE-2026-121683). https://www.ivanti.com/blog/november-2026-security-update Windows SignDrop CLFS Privilege Escalation Researcher Nightmare Eclipse (MSNightmare) released SignDrop, a local privilege escalation in the Windows Common Log File System (CLFS) that abuses the HMAC-based log-file authentication Microsoft added about a year ago, along with symlink and timing tricks. A regular user can escalate to SYSTEM on Windows 11 26H2 and Windows Server 2025. A proof-of-concept is on GitHub; Microsoft has not confirmed the issue, there is no CVE, and disabling CLFS log authentication is not a recommended workaround because it would restore older CLFS attacks. https://github.com/MSNightmare/SignDrop N-able N-central 2026.4 Hotfix 2 N-able has released N-central 2026.4 Hotfix 2, and the release notes identify three CVE numbers addressed in the update, after N-able earlier shut down its hosted infrastructure in response to the reported vulnerabilities. The initial public reports described around 30 vulnerabilities, and attackers are already probing leaked paths. Shadowserver's count of exposed N-central servers dropped from about 1,338 to around 148. On-premises operators should apply the hotfix before bringing a server back online and still avoid exposing it if possible. https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  3. 3d ago

    SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)

    Microsoft's November Patch Tuesday, Apple's iOS and macOS updates, and SAP's Security Patch Day all arrived this week, including an already exploited Outlook spoofing bug and four SAP flaws with a perfect CVSS score of 10. Microsoft Patch Tuesday Microsoft is addressing 1,260 vulnerabilities this month, 68 of them critical, including 167 Chromium issues that affect Microsoft Edge. One already exploited Outlook spoofing vulnerability, CVE-2026-124194, may hide the risk of a file being opened, in a Mark of the Web style issue, though Microsoft does not rate it critical. Other notable critical issues include a Lightweight Directory Access Protocol (LDAP) remote code execution flaw in Active Directory environments (CVE-2026-119958), five critical Microsoft Queuing and Queue Manager bugs, and a Windows TCP/IP remote code execution vulnerability (CVE-2026-113859) that Microsoft rates critical despite a 7.5 Common Vulnerability Scoring System (CVSS) score. https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+November+2027/33508 Apple Patches Apple released updates for iOS, iPadOS, macOS, watchOS, and visionOS that fix only nine vulnerabilities, with iPadOS and macOS patches going back to version 18, watchOS one version back, and visionOS only for the current release. Most of the issues weaken the Bluetooth handshake so an attacker can pair with a phone or Mac, and there are also AirPlay rate-limiting problems; one vulnerability only affects an older iOS release and lets an attacker with physical access pair a locked device with an AirPlay receiver. A more notable iMessage issue may let someone join a group and receive its messages without being invited. Apple states that none of these bugs are being exploited. https://isc.sans.edu/diary/Apple+Patches+Everyting+November+2026+Edition/33506/ SAP Patch Tuesday SAP's November Security Patch Day, issued in sync with Microsoft's, includes four vulnerabilities with a perfect CVSS score of 10, three more at 9.9, and two more in the nines, including issues in SAP NetWeaver. Onapsis reported a broken access control flaw in SAP Gateway (CVE-2026-89103) tied to the proxy access control list, and a WebSocket memory-corruption bug that Onapsis has shown as a denial of service but says can also allow remote code execution (CVE-2026-76964 and CVE-2026-89126). https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/ https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  4. 4d ago

    SANS Stormcast Tuesday, November 10th, 2026: SAP NetWeaver Webshells (CVE-2025-31324); N-able N-central Offline; Chrome XML 0-Day (CVE-2026-125350); Outlook DMARC Required

    Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting mail without DMARC. Attackers Searching for SAP NetWeaver Webshells ISC honeypots are seeing probes for ant.jsp and related paths tied to SAP NetWeaver CVE-2025-31324, a CVSS 10 unauthenticated file-upload flaw attackers still use to plant webshells even after recent patches. Watch /irj/servlet_jsp/irj/root/ and other upload endpoints for leftover shells. https://isc.sans.edu/diary/Attackers%20Searching%20for%20SAP%20Netweaver%20Webshells/33502 N-able N-central Critical Security Incident N-able took Hosted N-central offline after public disclosure of roughly 30+ critical vulnerabilities with no patches yet, and advises on-premises customers to take servers offline if not isolated; no exploitation observed so far, with remediation said to be on track. https://uptime.n-able.com/ https://labs.beazley.security/advisories/BSL-A1242 Google Chrome Zero-Day Patch (CVE-2026-125350) Chrome stable updates fix nine vulnerabilities, including CVE-2026-125350, a use-after-free in the XML parser that Google says is already exploited in the wild. Update promptly; the advisory does not confirm a sandbox escape. https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html Strict Outlook DMARC Policies Outlook is rejecting mail with 550 errors when the sending domain lacks a DMARC record, even if SPF and DKIM pass. Publish at least a DMARC record (for example p=none) alongside SPF and DKIM. https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim SANS Difference Makers Vote https://www.sans.org/go/difference-makers-awards-2026 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  5. 5d ago

    SANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak

    ISC honeypots seeing sshole (CVE-2026-123158) exploitation attempts; SonicWall patches seven SonicOS flaws including an already-exploited SSL VPN MFA bypass; Microsoft cloud-fixed an Entra Device Registration elevation-of-privilege bug; Apiiro found Claude Code saving secrets into .claude/settings.local.json on GitHub. Scans for sshole Vulnerability (CVE-2026-123158) ISC honeypots are seeing long letter-A passwords that look like sshole exploitation, with clear attempts starting November 5th after earlier long passwords that were mostly buggy brute-force scripts dumping shell commands into the password field. Honeypots only keep the first 255 characters of each password, which limits what can be measured. https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498 SonicWall SonicOS Multiple Vulnerabilities (SNWLID-2026-0014) On Friday SonicWall released patches for seven SonicOS vulnerabilities; one already-exploited flaw lets attackers bypass multi-factor authentication for SSL VPN logins when an alternate authentication method without MFA is also defined. Patch promptly press and CISA associate the exploited issue with CVE-2026-19868. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014 https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/ Entra Device Registration Elevation of Privilege (CVE-2026-109469) Microsoft patched an authorization bypass in Entra Device Registration over the weekend that could let an unauthorized attacker elevate privileges. No customer action is required: it is a Microsoft-hosted cloud service, and Microsoft says there was no exploitation at the time of the fix and rates future exploitation less likely. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469 Claude Code Leaking Secrets on GitHub Apiiro reports that Anthropic's Claude Code can store credentials in .claude/settings.local.json when you tell it not to ask again about an API or command, and that on the order of a thousand-plus of those credential files have shown up on GitHub. ISC web honeypots also saw new requests for the .claude directory this weekend; rotate exposed secrets and watch for Anthropic updates. https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html SANS Difference Makers Vote https://www.sans.org/go/difference-makers-awards-2026 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  6. Nov 6

    SANS Stormcast Friday, November 6th, 2026: RootEvidence Cisco IOS Opt-Out Scans; OpenSSH musl sshhole (CVE-2026-123158); Refrigeration OT Hardening; Zyxel GS1900 OOB Write (CVE-2026-107441)

    Today: RootEvidence Cisco IOS vulnerability scans with HTTP opt-out headers; a critical OpenSSH password bypass on musl (sshole / CVE-2026-123158); a U.S. government factsheet on hardening industrial refrigeration OT; and an actively exploited Zyxel GS1900 out-of-bounds write (CVE-2026-107441). RootEvidence Cisco IOS Scans / Opt-Out Headers ISC honeypots saw Cisco IOS vulnerability scans from exposure-management firm RootEvidence. Unlike typical Internet-wide scanners, their HTTP requests include Opt-Out-Email and Opt-Out-Url headers so administrators can request exclusion. https://isc.sans.edu/diary/Vulnerability%20Scans%20for%20Older%20Cisco%20IOS%20Vulnerability%20%20%20Opt-Out%20Headers/33492 https://www.rootevidence.com/scanners/ OpenSSH musl Password Bypass (sshole / CVE-2026-123158) A critical password-authentication bypass affects OpenSSH on musl libc systems (Alpine Linux, OpenWrt, and similar) when sshd allows password logins without libpam. Passwords longer than 256 characters can authenticate accounts that have no password set (shadow field "*"). Details and walkthrough at sshhole.com; fixed in OpenSSH 10.6p2. https://sshhole.com/ https://nvd.nist.gov/vuln/detail/CVE-2026-123158 https://www.openssh.org/txt/release-10.6p2 https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ Guidance to Secure Refrigeration / Cold-Chain Systems U.S. government agencies published a joint factsheet urging owners of industrial refrigeration and cold-chain monitoring systems to harden them after grocery-store and military-base fridge attacks that spoiled large amounts of food. Advice is largely standard OT hygiene (reduce Internet exposure, isolate OT, credential security, patching) and applies beyond refrigeration. https://www.cisa.gov/sites/default/files/2026-11/joint-factsheet-usg-partners-urge-hardening-industrial-refrigeration-cold-chain-monitoring-systems-508c.pdf Zyxel GS1900 Out-of-Bounds Write Exploited (CVE-2026-107441) Zyxel released firmware updates for GS1900 series switches fixing an out-of-bounds write that is being exploited in the wild. Binarly found a Python exploit in a malware repository; attacks steal configuration data including hashed passwords. The advisory says the attacker needs network access. Patch to 2.90 Patch 3 builds. https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026 https://www.binarly.io/advisories/brly-2026-057 https://nvd.nist.gov/vuln/detail/CVE-2026-107441 SANS Difference Makers Vote https://www.sans.org/go/difference-makers-awards-2026 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  7. Nov 5

    SANS Stormcast Thursday, November 5th, 2026: Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws

    Today's Stormcast covers honeypot scans for leftover email test scripts, HD Moore's runZero oobscan for out-of-band management interfaces, a critical apt signature-bypass flaw (CVE-2026-109518), and unpatched SonicWall GMS end-of-life vulnerabilities. The Classics Return: Vulnerable E-Mail Scripts Internet Storm Center honeypots are seeing probes for development email test scripts such as sendmail.php and test-mail.php. Like the classic FormMail script, these can leak environment variables and let attackers send spam through GET or POST parameters, so keep them out of production. https://isc.sans.edu/diary/The%20Classics%20Return%3A%20Vulnerable%20E-Mail%20Scripts/33488 oobscan: Scan for Out-of-Band Management Interfaces HD Moore's runZero oobscan hunts exposed BMC, IPMI, SNMP, and IP KVM style out-of-band management interfaces and flags known vulnerabilities on those devices rather than only listing open ports. https://github.com/runZeroInc/oobscan#research-and-disclosures apt Signature Bypass (CVE-2026-109518) A critical flaw in Debian's apt package manager can skip signature verification when a package web server returns crafted error responses, letting an on-path attacker inject malicious packages over HTTP. Prefer HTTPS where your distribution allows it; Ubuntu still often uses HTTP by default. Debian and Ubuntu have published updates for CVE-2026-109518. https://lists.debian.org/deity/2026/11/msg00005.html https://ubuntu.com/blog/apt-vulnerability-fixes-available https://security-tracker.debian.org/tracker/CVE-2026-109518 SonicWall GMS End of Life: Unpatched File Read and SQL Injection SonicWall Global Management System (GMS) 9.5.2 and earlier are end of life, and SonicWall will not fix an unauthenticated file read (CVE-2026-109593) or an authenticated SQL injection (CVE-2026-109594). Migration to Network Security Manager (NSM) is the vendor path forward. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019 https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1456/ SANS Difference Makers Vote https://www.sans.org/go/difference-makers-awards-2026 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  8. Nov 4

    SANS Stormcast Wednesday, November 4th, 2026: Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploit

    Today's episode covers attacks that switch supermarket and military commissary freezers into defrost mode, active exploitation of the Node-RED flaw in Siemens SIMATIC IoT2050 devices, the compromised cPGuard anti-malware update channel, and Calif's iPhone exploit that works despite Lockdown Mode. Refrigerator Exploits: Hacked Freezers Switched to Defrost Mode Attackers have hit refrigeration controllers at hundreds of supermarkets in France and several other European countries, and U.S. investigators are treating August freezer failures at U.S. military commissaries as a suspected cyberattack. The attackers switch freezers into defrost mode, heating them to about 50 C (122 F) and spoiling the food. How the systems were breached is still unclear, though weak default passwords on internet-exposed controllers have been reported. To help build a honeypot that emulates these devices, please contact me at jullrich-at-sans.edu if you can provide access to one of these refrigeration controllers. https://blog.claroty.com/blog/france-supermarket-hacks-expose-risks-of-internet-facing-refrigeration-systems https://www.bbc.com/news/articles/cq1kd1nee80eo Exploitation Targeting Node-RED on Siemens SIMATIC IoT2050 (CVE-2026-58115) VulnCheck caught attackers exploiting CVE-2026-58115, a missing authentication flaw (CVSS 10.0) in the Node-RED admin interface of Siemens SIMATIC IoT2050 Advanced industrial devices, to deploy flows that use wget or curl to download a Linux bot. Siemens patched the flaw in August with version 4.3.4.1. Update, or uninstall or harden Node-RED, and keep industrial control systems (ICS) off the internet. https://www.vulncheck.com/blog/exploitation-targeting-node-red https://cert-portal.siemens.com/productcert/html/ssa-834709.html cPGuard Security Advisory: Update Channel Compromise OPSSHIELD says an attacker used stolen credentials to access the update servers for cPGuard, its anti-malware product for cPanel and shared hosting servers. On November 2, cPGuard versions 5.88.12 through 5.88.19 delivered a malicious script that collected /etc/shadow, MySQL configuration, root shell history, and SSH files. Update to 5.88.25 or later, check the install log for affected versions, rotate credentials, and review the indicators of compromise in the advisory. https://opsshield.com/notice/cpguard-update-channel-compromise.html iPhone 18 Pro Exploited via AirDrop with Lockdown Mode Enabled Security firm Calif released a video showing an iPhone 18 Pro with Lockdown Mode enabled being fully compromised after the user accepted a malicious PDF sent via AirDrop. Calif has not published technical details, so users who rely on Lockdown Mode should not accept unexpected AirDrop files. https://x.com/calif_io/status/2117720348322144733 https://www.macrumors.com/2026/11/03/iphone-jailbreak-lockdown-mode/ Vote in the SANS Difference Makers Awards https://www.sans.org/go/difference-makers-awards-2026 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

See All (2K)

Hosts & Guests

4.9
out of 5
677 Ratings

About

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

Information

  • Creator
    Johannes B. Ullrich
  • Years Active
    2009 - 2026
  • Episodes
    2K
  • Rating
    Clean
  • Copyright
    © (c) SANS Institute 2026 This work is licensed under a Creative Commons License - Attribution-NonCommercial-ShareAlike - https://creativecommons.org/licenses/by-nc-sa/4.0/
  • Show Website
    SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

You Might Also Like