SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich
  • 4.9 (677)
  • Tech News
  • Updated Daily

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

  1. 12h ago

    SANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)

    In today's episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through the EC2 instance metadata service (IMDS), and ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass. Why TLP Should Not Replace Your Internal Information Classification The Traffic Light Protocol from FIRST defines who threat intelligence may be shared with, from TLP:CLEAR to TLP:RED, but not how to protect it in transit. Organizations still need their own classification and safeguards, such as encryption, instead of sending TLP:AMBER data in plain email. https://isc.sans.edu/forums/diary/Why%20TLP%20should%20not%20replace%20your%20internal%20information%20classification/33414/ AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents. A prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service, made possible by IMDSv1 and overly broad permissions. Restrict the URLs your AI agents can reach and always use IMDSv2. https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model Palo Alto GlobalProtect VPN Vulnerability Exploited by Ransomware (CVE-2026-0257) ReliaQuest reports ransomware actors exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access to open unauthorized VPN sessions. Patch VPN gateways, and keep VPN clients updated too. https://x.com/ReliaQuestTR/status/2108647641240465707 https://security.paloaltonetworks.com/CVE-2026-0257 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  2. 3d ago

    SANS Stormcast Friday, October 9th, 2026: AI Agent Forensics; AI-Assisted Attack on South Korean Banks; IDN Typosquatting; Cisco Finesse SSRF (CVE-2026-20362)

    In today's episode: new scripts for reconstructing AI agent activity during forensic investigations, an attacker's Claude chat history recovered after breaches at South Korean financial institutions, internationalized domain name (IDN) lookalikes that still get past Chrome, and an unpatched Cisco Finesse server-side request forgery (SSRF) vulnerability. Reconstructing AI Agent Activity: Two New Scripts for Forensic Review Jim Clausing released two scripts that turn the logs left behind by the OpenCode and Hermes AI agents into searchable JSON, so incident responders can see what an AI agent did on an attacker's or a victim's system. https://isc.sans.edu/diary/Reconstructing%20AI%20Agent%20Activity%3A%20Two%20New%20Scripts%20for%20Forensic%20Review/33410 Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance While investigating breaches at South Korean financial institutions, CrowdStrike recovered the attacker's CLAUDE.md file and Claude chat history, a rare look at how a low-skill "prompt kiddie" uses AI to run an attack. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/ Turning IDN Edge Cases into Typosquats Attackers can still register convincing lookalike domains using Unicode characters that resemble Latin letters but are not on Chrome's list of known confusables. One test domain impersonating Apple displayed in Chrome but not in Safari. https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats Cisco Finesse SSRF Vulnerability (CVE-2026-20362) Cisco disclosed an unauthenticated server-side request forgery vulnerability in the Cisco Finesse web-based management interface, rated High (CVSS 7.2). Details are already public, there is no workaround, and fixed releases are not expected until January or February 2027. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  3. 4d ago

    SANS Stormcast Thursday, October 8th, 2026: Atlassian Vulnerabilities; ccTLD Compormise; Outlook blocking .msix

    Scans for Atlassian vulnerablity (CVE-2026-21589) https://isc.sans.edu/diary/Scans%20for%20Atlassian%20vulnerablity%20%28CVE-2026-21589%29/33406 .gh, .sl and .as ccTLD Compromise https://blog.google/security/chromes-response-to-recent-cctld-registry-hijacks/ Cisco Nexus 3000 and 9000 Series Switches Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU Outlook Blocking MSIX Files https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  4. 5d ago

    SANS Stormcast Wednesday, October 7th, 2026: RMM Tools; libHEIF RCE; Sonicwall SMA1000, OpenSSH updates, DNSSEC KSK Rollover

    More RMM Tools In the Wild https://isc.sans.edu/diary/More%20RMM%20Tools%20In%20the%20Wild/33400 WORDPRESS LIBHEIF RCE https://fortbridge.co.uk/research/wordpress-libheif-rce/ SONICWALL SMA1000 SERIES APPLIANCES Vulnerabilities CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017 OpenSSH 10.6 Released https://seclists.org/oss-sec/2026/q4/58 DNSSEC Root Key Signing Key Rollover https://blog.cloudflare.com/root-ksk-2024-rollover/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  5. 6d ago

    SANS Stormcast Tuesday, October 6th, 2026: cowrie tty Logs; Another Netscaler 0-Day; Exchange Patch

    TTY Logs and the Data it Captures https://isc.sans.edu/diary/TTY%20Logs%20and%20the%20Data%20it%20Captures/33396 Citrix Netscaler SAML Vulnerability (0-Day) CVE-2026-88779 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ Microsoft Exchange September 2026 V2 Update CVE-2026-96940 https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  6. Oct 5

    SANS Stormcast Monday, October 5th, 2026: Funny User-Agents; FortMail 0-Day; GitLab Patch; macOS Full Disk Access

    User Agent Strings Curiosities https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394 FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286 https://fortiguard.fortinet.com/psirt/FG-IR-26-175 Critical GitLab Vulnerability CVE-2026-90970 https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/ Updates to Full Disk Access in macOS https://developer.apple.com/news/?id=p6zjojqw My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  7. Oct 2

    SANS Stormcast Friday, October 2nd, 2026: ScreenConnect Abuse; ChatGPT Abuse; Spoofing iCloud; Proton Mail display name

    ScreenConnect Client (Ab)used by Attackers https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments Attackers abuse ChatGPT to deliver RAT via ClickFix https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?_sp=51406044-aa1d-4278-a4e7-adb5b8ef84b2.1790890760100 Spoofing iCloud From Address https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/ Sender spoofing in Proton Mail via display-name homograph https://alonsovidales.github.io/protonmail-sender-spoofing/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

  8. Oct 1

    SANS Stormcast Thursday, October 1st, 2026: Cisco Catalyst SD-WAN Manager 0-day; Watchguard AP RCE; OpenBao/Vault RCE; Post Quantum Certs

    Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability CVE-2026-76504 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU WatchGuard AP Command Injection in Internal Management API Allows Command Execution https://psirt.watchguard.com/CVE-2026-86102/ A Realistic Code Execution Exploit Chain in OpenBao and Vault https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/ Building a post-quantum certificate authority with Merkle Tree Certificates https://blog.cloudflare.com/pq-ca-with-mtcs/ My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

See All (2K)

Hosts & Guests

4.9
out of 5
677 Ratings

About

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

Information

  • Creator
    Johannes B. Ullrich
  • Years Active
    2009 - 2026
  • Episodes
    2K
  • Rating
    Clean
  • Copyright
    © (c) SANS Institute 2026 This work is licensed under a Creative Commons License - Attribution-NonCommercial-ShareAlike - https://creativecommons.org/licenses/by-nc-sa/4.0/
  • Show Website
    SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

You Might Also Like