SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
Johannes B. Ullrich
A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
Episodes
Mentioned books
Oct 22, 2026 • 13min
SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
Active exploitation of two critical PHP flaws puts websites and network appliances at risk, with emergency patching, WAF rules, shutdowns, and compromise assessments on the table. The discussion also covers the challenges of leaving legacy PHP behind, the importance of accurate asset inventories, and Fortinet’s AI-assisted security hardening updates across multiple products.
Oct 21, 2026 • 6min
SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC
Eight eMudhra intermediate certificates are revoked after a bizarre one-byte key-generation error. A rushed PHP security release tackles two critical core flaws, while Oracle’s massive patch update includes a serious E-Business Suite SQL injection. A new FortiSIEM proof of concept turns path traversal into remote code execution, putting exposed systems on the fast track to trouble.
5 snips
Oct 20, 2026 • 7min
SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA
Plex Media Server flaws are being exploited for unauthenticated code execution, while nearby attackers can compromise Broadcom Wi-Fi access points and steal WPA keys. Compromised OVHcloud CLI packages delivered an infostealer. Also covered: Exchange instability after October updates, practical AI agent containment, and a YARA rule for hidden VBA in AutoCAD DWG files.
7 snips
Oct 16, 2026 • 6min
SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
A crypto-mining worm spreads through SSH, steals keys, installs a rootkit, and uses Discord for command and control. The discussion also covers three actively exploited zero-days affecting Cisco Secure Email Gateway, Palo Alto Networks PAN-OS, and Ivanti Connect Secure, including root-level code execution and a complex exploit chain.
Oct 15, 2026 • 6min
SANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE
Hidden VBA projects lurking in AutoCAD drawings, counterfeit Ledger wallets fitted with LTE implants, and a Docker Hub migration flaw that exposed personal access tokens headline this cybersecurity roundup. It also explores a newly patched curl HTTP/2 upload vulnerability capable of remote code execution, with practical urgency around affected deployments.
Oct 14, 2026 • 6min
SANS Stormcast Wednesday, October 14th, 2026: October 2026 Patch Tuesday: Microsoft Fixes 1,417 Vulnerabilities; Ivanti Connect Secure Exploited; Adobe ColdFusion and Commerce Critical Patches
Microsoft’s October Patch Tuesday tackles 1,417 vulnerabilities, including an exploited Windows warning bypass, DHCP and Exchange remote-code-execution flaws, and a wave of Office bugs. Ivanti Connect Secure and Neurons updates address active exploitation and Intune credential exposure. Adobe’s latest fixes spotlight critical Commerce issues and severe ColdFusion server-side request forgery and file-upload vulnerabilities.
7 snips
Oct 13, 2026 • 6min
SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches
A critical GitLab flaw enables unauthenticated code execution through CI/CD. Let’s Encrypt prepares to shorten certificate lifetimes to 64 days, putting automation to the test. Cheap Android phones arrive with Midnight Mimosa malware, while MarkLogic patches severe vulnerabilities that could lead to arbitrary code execution.
7 snips
Oct 12, 2026 • 6min
SANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)
Today’s briefing explores why the Traffic Light Protocol cannot replace robust internal data classification, and how an Amazon Bedrock AI agent flaw exposed cloud credentials through SSRF. It also examines ransomware attacks exploiting Palo Alto GlobalProtect VPN authentication bypasses, with practical focus on securing AI agents and VPN infrastructure.
Oct 9, 2026 • 6min
SANS Stormcast Friday, October 9th, 2026: AI Agent Forensics; AI-Assisted Attack on South Korean Banks; IDN Typosquatting; Cisco Finesse SSRF (CVE-2026-20362)
Forensic tools reveal what AI agents do on compromised systems, while recovered Claude logs expose an AI-assisted campaign against South Korean financial institutions. Unicode lookalikes continue to enable convincing browser typosquats. Also covered: a public, unauthenticated Cisco Finesse SSRF flaw that remains unpatched.
Oct 8, 2026 • 7min
SANS Stormcast Thursday, October 8th, 2026: Atlassian Vulnerabilities; ccTLD Compormise; Outlook blocking .msix
This cybersecurity briefing covers active scans targeting Atlassian Jira, Bitbucket, and Confluence flaws, including techniques for reading sensitive files. It also examines compromises of .gh, .sl, and .as domain registries, critical Cisco Nexus switch vulnerabilities enabling remote code execution, and Microsoft Outlook’s move to block risky MSIX attachments.
