SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

By Johannes B. UllrichNews Tech News

Ranking
29th
on Tech News
Favorites
340
Followers
Typical duration
7 min
per episode
If it hooks
60%
finish an episode

Based on Podcast App listening data

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) episodes

October 05 SANS Stormcast Monday, October 5th, 2026: Funny User-Agents; FortMail 0-Day; GitLab Patch; macOS Full Disk Access

User Agent Strings Curiosities
https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394
FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286
https://fortiguard.fortinet.com/psirt/FG-IR-26-175
Critical GitLab Vulnerability CVE-2026-90970
https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/
Updates to Full Disk Access in macOS
https://developer.apple.com/news/?id=p6zjojqw
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
8 min
October 02 SANS Stormcast Friday, October 2nd, 2026: ScreenConnect Abuse; ChatGPT Abuse; Spoofing iCloud; Proton Mail display name

ScreenConnect Client (Ab)used by Attackers
https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments
Attackers abuse ChatGPT to deliver RAT via ClickFix
https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?_sp=51406044-aa1d-4278-a4e7-adb5b8ef84b2.1790890760100
Spoofing iCloud From Address
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
Sender spoofing in Proton Mail via display-name homograph
https://alonsovidales.github.io/protonmail-sender-spoofing/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
7 min
October 01 SANS Stormcast Thursday, October 1st, 2026: Cisco Catalyst SD-WAN Manager 0-day; Watchguard AP RCE; OpenBao/Vault RCE; Post Quantum Certs

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability CVE-2026-76504
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
WatchGuard AP Command Injection in Internal Management API Allows Command Execution
https://psirt.watchguard.com/CVE-2026-86102/
A Realistic Code Execution Exploit Chain in OpenBao and Vault
https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/
Building a post-quantum certificate authority with Merkle Tree Certificates
https://blog.cloudflare.com/pq-ca-with-mtcs/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
6 min
September 30 SANS Stormcast Wednesday, September 30th, 2026: Wordfence Scans; MikroTik Vulnerability; Poper Blocker Spyware

Scans for Wordfence Protected Websites
https://isc.sans.edu/diary/Scans%20for%20Wordfence%20Protected%20Websites/33382
MikroTik RouterOS Vulnerability (CVE-2026-84411)
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06
Poper Blocker: The Adblocker That Spies on You
https://amibeingpwned.com/blog/poper-blocker-the-adblocker-that-spies-on-you
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
6 min
September 29 SANS Stormcast Tuesday, September 29th, 2026: MacOS/iOS 0-Day Patch; macOS priv. escalation 0-day; File Notification Attacks

Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950)
https://isc.sans.edu/diary/Apple%20Emergency%20Patch%20for%20iOS%2026%2C%20macOS26%2C%20macOS15%20%28CVE-2026-86950%29/33376
https://support.apple.com/en-us/100100
Proof of concept for macOS CoreServices Priv. Escalation (CVE-2026-43786)
https://github.com/Malwation/CVE-2026-43786
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/
File Notification Attacks https://inoti.fyi/pubs/file-notification-attacks.pdf
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
7 min
September 28 SANS Stormcast Monday, September 28th, 2026: Macfinger Details; NetScaler 0-Day; KiteWorks 0-Day; ShinyHunters and PeopleSoft

A Closer Look at Malware From the Macfinger ClickFix Campaign
https://isc.sans.edu/diary/A%20Closer%20Look%20at%20Malware%20From%20the%20Macfinger%20ClickFix%20Campaign/33368
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
KiteWorks Urges Customers to Shut Down Servers
https://www.heise.de/en/news/Imminent-Zero-Day-Attack-KiteWorks-Urges-Customers-to-Shut-Down-Servers-11466375.html
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
7 min
September 25 SANS Stormcast Friday, September 25th, 2026: Tricky Phishing URL; MacSync Malware Update; SolarWinds Observable Patch

One URL, Three Different Tricks
https://isc.sans.edu/diary/33366
Send GitLab an email, push to main
https://www.aikido.dev/blog/gitlab-email-push-to-main
macOS MacSync Malware Update
https://securelist.com/macsync-new-version/121383/
SolarWinds Observability Self-Hosted 2026.2.3
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
8 min
September 24 SANS Stormcast Thursday, September 24th, 2026: Macfinger ClickFix; Malicious Terraform; MikroTik and F5 Big IP Vulnerability Details

Macfinger ClickFix Campaign
https://isc.sans.edu/diary/Macfinger%20ClickFix%20campaign/33360
Graphalgo campaign spreads to Terraform providers and Go Modules
https://www.aikido.dev/blog/graphalgo-terraform-go-modules
MikroTik vulnerabilities technical analysis,
https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/
F5 Big-IP Vulnerability Details CVE-2026-94127
https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
6 min
September 23 SANS Stormcast Wednesday, September 23rd, 2026: GET with Body; Checkpoint, VeloCloud, BigIP and Microsoft Defender 0-days

The Truth about GET and HTTP Standards
https://isc.sans.edu/diary/The%20Truth%20about%20GET%20and%20HTTP%20Standards/33358
CVE-2026-93616: 0-Day Remote Code Execution Vulnerability patch in Checkpoint Management Server
https://support.checkpoint.com/results/sk/sk1000171/
VeloCloud Orchestrator (VCO) Patch for Exploited Vulnerability CVE-2026-93952
https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
F5 BigIP APM Exploited Vulnerability Patched CVE-2026-94127
https://my.f5.com/manage/s/article/K000162605
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
5 min
September 22 SANS Stormcast Tuesday, September 22nd, 2026: PNG Stego Analysis; NPM BTree Malware; Pi-Hole Advisory

TerminalFix PNG Steganography
https://isc.sans.edu/diary/TerminalFix%3A%20PNG%20Steganography/33318
NPM Btree Malware Campaign Without Install Script
https://checkmarx.com/zero-post/npm-btree-malware-campaign-affects-millions-of-downloads-no-need-for-install-script/
Pi-Hole Update and Advisory
https://github.com/pi-hole/FTL/security/advisories/GHSA-2794-hrj8-5jg9
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
6 min

About SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

From the publisher's feed

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of…