SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
Johannes B. Ullrich
A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
Episodes
Mentioned books
8 snips
Nov 12, 2026 • 6min
SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
A rapid tour of leftover Patch Tuesday dangers: Apache’s mod_http2 exposes a critical route to remote code execution, while Fortinet’s sweeping advisory release includes severe FortiMail flaws. Ivanti patches an Endpoint Manager SQL injection and certificate weakness. SignDrop targets Windows CLFS, and N-able issues an N-central hotfix for exposed systems.
Nov 11, 2026 • 10min
SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)
Microsoft’s massive November security release includes an exploited Outlook spoofing flaw, critical Active Directory and Windows issues, and hundreds of Edge fixes. Apple addresses Bluetooth pairing weaknesses, AirPlay problems, and an iMessage group privacy bug across its platforms. SAP’s patch day features multiple CVSS 10 vulnerabilities, including NetWeaver Gateway access-control and WebSocket threats.
Nov 10, 2026 • 6min
SANS Stormcast Tuesday, November 10th, 2026: SAP NetWeaver Webshells (CVE-2025-31324); N-able N-central Offline; Chrome XML 0-Day (CVE-2026-125350); Outlook DMARC Required
Attackers are probing SAP NetWeaver servers for webshells tied to a critical file-upload flaw. N-able takes hosted N-central offline amid dozens of unpatched vulnerabilities. Chrome patches an actively exploited XML parser zero-day. Outlook tightens email defenses by rejecting messages from domains without DMARC records.
4 snips
Nov 9, 2026 • 7min
SANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak
Security scanners are probing the newly disclosed sshole vulnerability, while SonicWall rushes to address an actively exploited SSL VPN MFA bypass. Microsoft quietly fixes an Entra authorization flaw in its cloud service. Meanwhile, Claude Code’s credential-handling habits leave roughly 1,500 sensitive settings files exposed on GitHub.
Nov 6, 2026 • 8min
SANS Stormcast Friday, November 6th, 2026: RootEvidence Cisco IOS Opt-Out Scans; OpenSSH musl sshhole (CVE-2026-123158); Refrigeration OT Hardening; Zyxel GS1900 OOB Write (CVE-2026-107441)
Internet-wide Cisco IOS scans come with an unusual opt-out mechanism. A critical OpenSSH password bypass threatens musl-based systems such as Alpine Linux and OpenWrt. New guidance targets the hardening of industrial refrigeration and cold-chain OT. Meanwhile, Zyxel GS1900 switches face active exploitation, configuration theft, and a firmware fix.
Nov 5, 2026 • 6min
SANS Stormcast Thursday, November 5th, 2026: Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws
Leftover email test scripts are drawing probes and can expose secrets or enable spam. A new runZero tool scans for vulnerable BMC, IPMI, SNMP, and IP KVM interfaces. A critical apt flaw can bypass package signature checks, while end-of-life SonicWall GMS faces unpatched file-read and SQL injection vulnerabilities.
5 snips
Nov 4, 2026 • 6min
SANS Stormcast Wednesday, November 4th, 2026: Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploit
Cyberattacks are turning supermarket and military freezers into ovens, spoiling food across multiple countries. Siemens industrial devices are being actively exploited to install malware through an exposed Node-RED interface. A compromised cPGuard update channel put sensitive hosting data at risk, while an AirDrop exploit reportedly bypassed iPhone Lockdown Mode.
5 snips
Nov 3, 2026 • 6min
SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
Learn how to spot Multipath TCP traffic with tools like Wireshark, tcpdump, Suricata, and Zeek. The discussion covers cryptocurrency thefts targeting outdated BTCPay Server installations, critical Barracuda appliance flaws, and ransomware attacks exploiting unpatched Synology DSM devices.
13 snips
Nov 2, 2026 • 6min
SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death
A OneNote tool now extracts embedded files in bulk, while a fake Claude Code extension in Cursor’s marketplace planted SSH backdoors. Ivanti Connect Secure faces an expanded zero-day exploit chain enabling unauthenticated root access. Also covered: an Android “SMS of Death” proof of concept that crashes phone services and a Linux MPTCP vulnerability mitigation.
Oct 30, 2026 • 8min
SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
Learn how a local Ghidra Server keeps malware analysis projects safe through virtual machine resets. Explore Claude’s discovery of a zero-click Linux kernel flaw enabling remote code execution via Multipath TCP. Plus, malicious Hugging Face models return, using trust_remote_code to install cryptocurrency miners on GPU-powered systems.
