SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Today's episode covers an update on the PHP2Shell vulnerabilities, a Signal flaw that kept calls alive after hang-up, critical Cisco Snort 3 vulnerabilities, and Linux kernel KSMBD vulnerability reports that were accidentally posted to a public mailing list.

PHP Vulnerability Update

Patches for the PHP remote code execution (RCE) vulnerabilities are now available from many vendors, with notable exceptions such as QNAP. Cloudflare reports a lot of exploit activity, and Amazon saw exploit attempts before public disclosure, but no simple, reliable exploit has surfaced yet. Beware of fake exploits that may attack the person running them.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

Signal: Flooded Call Event Queue Blocks Local Hang-Up (CVE-2026-113380)

During a call, the other side could flood a Signal client with events and prevent it from hanging up, leaving the connection active so an attacker could keep listening through the microphone. The flaw has been patched; keep Signal updated automatically.

https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380

Cisco Snort 3 Critical Vulnerabilities

Cisco patched critical Snort 3 vulnerabilities with a base CVSS (Common Vulnerability Scoring System) score of 9.0. The four CVEs group multiple AI-discovered vulnerabilities by shared CWE (Common Weakness Enumeration), making the individual flaws less transparent. Snort is also included in several Cisco appliances.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe

Linux Kernel KSMBD Vulnerability Reports Leaked

Trend Micro's Zero Day Initiative accidentally posted unpatched Linux kernel vulnerability reports to a public kernel mailing list, including CVSS 9 remote code execution flaws in the kernel's built-in SMB file sharing server (KSMBD). No patches are available yet, and proof-of-concept exploit code was included in some reports.

https://lore.kernel.org/lkml/BYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

This episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security hardening release for multiple products based on an AI-assisted security review.

Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Exploited; Infocon Yellow

Two vulnerabilities in the PHP core, an out-of-memory issue triggered by multipart MIME uploads and a memory-clearing flaw exploited with a second request, can lead to remote code execution and can be chained; exploitation is already underway, and your application code, authentication, and configuration will not protect you. Updates are available for PHP 8 but not for PHP 7 or PHP 5, and vendors such as Cisco, Palo Alto Networks, OPNsense, and pfSense have published advisories or updates for their appliances. If you cannot patch, consider web application firewall (WAF) rules that block multipart MIME uploads or temporarily taking the site offline, and assume compromise for public sites without mitigations.

https://www.dshield.org/diary.html/Critical+PHP+Vulnerability+%28CVE-2026-109618%2C+CVE-2026-109619%29+%5Binfocon+yellow%5D/33440/#comment

Fortinet Security Hardening Release for Multiple Products

Fortinet announced updates across several products after a security review using AI tools, crediting a number of AI vendors but naming no CVEs and providing few details. The release covers FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, and Fortinet customers should review it and update.

https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers eight eMudhra intermediate CA certificates revoked after a key generation error, an accelerated critical PHP security release fixing two core vulnerabilities, Oracle's October 2026 Critical Patch Update with 1,295 fixes including an Oracle E-Business Suite SQL injection, and a proof-of-concept exploit for a FortiSIEM gRPC path traversal leading to remote code execution.

eMudhra Intermediate CA Compromise

Eight intermediate CA certificates from Indian certificate authority eMudhra were revoked after a scripting error during the HSM key ceremony left their private keys one byte long. Browsers now reject them, but software with its own CA bundle, like curl on macOS, may need updating. The post includes a browser test page.

https://emudhra.we-have-a-problem.com/

Upcoming Critical PHP Security Release

PHP fixes two critical vulnerabilities in PHP core, rated CVSS 9.2, affecting versions back to PHP 5. The release was moved up to Wednesday, October 21st at 14:00 UTC (10 a.m. Eastern) after details leaked. Expect exploits soon after the patch.

https://www.php.net/archive/2026.php#2026-10-20-1

Oracle Critical Patch Update Advisory - October 2026

Oracle's quarterly update fixes 1,295 new vulnerabilities. Horizon3 is teasing details of an Oracle E-Business Suite SQL injection, CVE-2026-101767.

https://www.oracle.com/security-alerts/cpuoct2026.html

https://x.com/Horizon3Attack/status/2112651247362658611

FortiSIEM gRPC Path Traversal File Write RCE (CVE-2026-106173)

A proof of concept is out for the FortiSIEM flaw patched October 13th. It requires access to port 27918, so block it at the firewall until you patch.

https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting, an infostealer slipped into the OVHcloud command line tools, Exchange Server instability after the October 2026 Windows updates, how to contain AI agents, and a YARA rule for orphaned VBA projects in AutoCAD DWG files.

Small Agents, Smaller Blast Radius: Controlling What AI Can Do

Mark outlines techniques to restrict what AI agents can do, including limiting permissions, using containers, and planning for AI vendors retiring older models.

https://isc.sans.edu/diary/Small%20Agents%2C%20Smaller%20Blast%20Radius%3A%20Controlling%20What%20AI%20Can%20Do/33430

Orphaned VBA Projects Inside DWG Files: YARA Rule

Didier Stevens follows up on hidden Visual Basic for Applications projects in AutoCAD DWG files with a YARA rule to detect them.

https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files%3A%20YARA%20Rule/33434

Broadcom eCos Wi-Fi Remote Code Execution Vulnerability

Quentin Kaiser shows that an attacker in Wi-Fi range can execute code on Broadcom eCos access points without WPA authentication and steal the WPA key. Broadcom has not issued a CVE, and many ISP-provided access points are affected.

https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/

OVHcloud Command Line Tools Compromised

For a few hours on Friday, compromised versions of the OVHcloud CLI shipped an infostealer. Update to version 0.16.0, released after the compromise, and pin package hashes.

https://github.com/ovh/ovhcloud-cli/issues/300

Plex2Shell Vulnerability (Exploited!)

A chain starting with server-side request forgery (SSRF) to loopback lets attackers steal admin tokens and run code on Plex Media Server without authentication (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It is already exploited; patch now and assume compromise if your server is exposed.

https://zmain.info/blog/plex2shell

Exchange Servers May Become Unstable After the October 2026 Windows Updates

Microsoft recommends a registry change rather than uninstalling the update on on-premises Exchange Server.

https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382

NGINX ngx_http_core_module Vulnerability (CVE-2026-15176)

https://my.f5.com/manage/s/article/K000162416

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity.

Panchan's Mining Island [Guest Diary]

SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis.

https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5BGuest%20Diary%5D/33426

Cisco Secure Email Gateway 0-Day (CVE-2026-76519)

With the reputation feature enabled, the advanced malware protection feature lets attackers write arbitrary files and execute code as root. The flaw is already exploited and there is no workaround, so patch and review Cisco's indicators of compromise.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

Palo Alto Networks 0-Day (CVE-2026-0322)

An already exploited, authenticated remote code execution vulnerability that runs code as root. Exploitation requires an exposed management interface.

https://security.paloaltonetworks.com/CVE-2026-0322

Ivanti Connect Secure 0-Day (CVE-2026-104935)

Volexity found three chained vulnerabilities: an authentication bypass, an arbitrary file write leading to remote code execution, and a privilege escalation. Ivanti patched the first two under one CVE; the privilege escalation appears unpatched.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

No Podcast on Monday, Oct. 19th.

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers hidden Visual Basic for Applications (VBA) macros left behind in AutoCAD drawings, Ledger hardware crypto wallets found with LTE implants that steal seed phrases, a Docker Hub account conversion flaw that exposed personal access tokens, and a curl update fixing a remote code execution bug in HTTP/2 uploads.

Orphaned VBA Projects Inside DWG Files

Didier Stevens found AutoCAD DWG files whose VBA projects are no longer referenced but still present inside the file, likely left behind by an AutoLISP delete command, and shows a new way to extract them.

https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files/33420

Ledger Crypto Wallet Supply Chain Attack: Hardware Implants

Ledger wallets sold through authorized resellers, first in Asia and recently by MediaMarkt in Europe, were found with LTE modules and SIM cards that exfiltrate the seed phrase. Reports put losses at up to $100 million.

https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/

Docker Hub Account Migration Bug (CVE-2026-105445)

Converting a personal Docker Hub account to an organization moved the old user's personal access tokens to a target user without confirmation, letting an attacker authenticate as that user. Docker fixed the issue and notified affected users.

https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

curl Patches HTTP/2 Upload Remote Code Execution Flaw

A new curl release fixes several vulnerabilities, including remote code execution triggered when uploading a file over HTTP/2 to a malicious server. A proof of concept is available.

https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: Microsoft's October 2026 Patch Tuesday fixes 1,417 vulnerabilities, including an exploited Mark of the Web bypass, plus Ivanti patches an exploited Connect Secure flaw and Adobe fixes critical ColdFusion and Adobe Commerce vulnerabilities.

October 2026 Microsoft Patch Tuesday

Microsoft patched 1,417 vulnerabilities, 76 rated critical. CVE-2026-96951, an already exploited Windows Shell security feature bypass, skips the Mark of the Web warning. CVE-2026-108398, a publicly disclosed .NET Framework flaw, bypasses application control. Also patched: 10 remote code execution flaws in Windows DHCP Server (five critical), an Exchange Server RCE triggered by a crafted email (CVE-2026-70571), and many Microsoft Office RCE vulnerabilities.

https://isc.sans.edu/diary/October%202026%20Microsoft%20Patch%20Tuesday/33422

Ivanti October 2026 Security Update

Ivanti fixed an Ivanti Connect Secure vulnerability already exploited in limited attacks, plus two Ivanti Neurons vulnerabilities that can leak the credentials used to connect to Microsoft Intune. Patch, then rotate those Intune credentials.

https://www.ivanti.com/blog/october-2026-security-update

Adobe Patch Tuesday: ColdFusion and Adobe Commerce

Adobe fixed 110 vulnerabilities across 11 products. Adobe Commerce has critical arbitrary code execution flaws, and ColdFusion has CVSS 10.0 server-side request forgery (SSRF) and unrestricted file upload vulnerabilities. Prioritize these two products.

https://www.adobe.com/trust/security/bulletins-and-advisories.html

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates.

CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE

An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee

Let s Encrypt 64-Day Certificate Lifetimes Coming Feb 2027

Let s Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates.

https://letsencrypt.org/2026/10/07/64-day-certs.html

Midnight Mimosa: Malware Pre-Installed on Android Phones

Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud.

https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware

Progress MarkLogic Critical Security Alert Bulletin October 2026

Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled.

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through the EC2 instance metadata service (IMDS), and ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass.

Why TLP Should Not Replace Your Internal Information Classification

The Traffic Light Protocol from FIRST defines who threat intelligence may be shared with, from TLP:CLEAR to TLP:RED, but not how to protect it in transit. Organizations still need their own classification and safeguards, such as encryption, instead of sending TLP:AMBER data in plain email.

https://isc.sans.edu/forums/diary/Why%20TLP%20should%20not%20replace%20your%20internal%20information%20classification/33414/

AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model

Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents. A prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service, made possible by IMDSv1 and overly broad permissions. Restrict the URLs your AI agents can reach and always use IMDSv2.

https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model

Palo Alto GlobalProtect VPN Vulnerability Exploited by Ransomware (CVE-2026-0257)

ReliaQuest reports ransomware actors exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access to open unauthorized VPN sessions. Patch VPN gateways, and keep VPN clients updated too.

https://x.com/ReliaQuestTR/status/2108647641240465707

https://security.paloaltonetworks.com/CVE-2026-0257

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: new scripts for reconstructing AI agent activity during forensic investigations, an attacker's Claude chat history recovered after breaches at South Korean financial institutions, internationalized domain name (IDN) lookalikes that still get past Chrome, and an unpatched Cisco Finesse server-side request forgery (SSRF) vulnerability.

Reconstructing AI Agent Activity: Two New Scripts for Forensic Review

Jim Clausing released two scripts that turn the logs left behind by the OpenCode and Hermes AI agents into searchable JSON, so incident responders can see what an AI agent did on an attacker's or a victim's system.

https://isc.sans.edu/diary/Reconstructing%20AI%20Agent%20Activity%3A%20Two%20New%20Scripts%20for%20Forensic%20Review/33410

Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

While investigating breaches at South Korean financial institutions, CrowdStrike recovered the attacker's CLAUDE.md file and Claude chat history, a rare look at how a low-skill "prompt kiddie" uses AI to run an attack.

https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/

Turning IDN Edge Cases into Typosquats

Attackers can still register convincing lookalike domains using Unicode characters that resemble Latin letters but are not on Chrome's list of known confusables. One test domain impersonating Apple displayed in Chrome but not in Safari.

https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats

Cisco Finesse SSRF Vulnerability (CVE-2026-20362)

Cisco disclosed an unauthenticated server-side request forgery vulnerability in the Cisco Finesse web-based management interface, rated High (CVSS 7.2). Details are already public, there is no workaround, and fixed releases are not expected until January or February 2027.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich