22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary]
https://isc.sans.edu/diary/22+Seconds+to+Compromise+How+Automated+SSH+Actors+Move+From+Login+to+Persistence+Before+You+Can+Blink+Guest+Diary/33220
Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)
https://blog.amberwolf.com/blog/2026/july/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/
Ill Bloom: Crypto Wallet Vulnerability
https://illbloom.org
Benchmarking Free-Tier Large Language Models as Cognitive Aids for Operationalizing Unstructured Cyber Threat Intelligence
https://www.sans.edu/cyber-research/benchmarking-free-tier-large-language-models-cognitive-aids-operationalizing-unstructured-cyber-threat-intelligence
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm
https://isc.sans.edu/diary/Don%27t%20Revoke%20That%20Token%20Yet%3A%20Inside%20the%20keyv%20cacheable%20npm%20Worm/33218
IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay
https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/?ref=404media.co
COLDCARD Issues
https://x.com/threatinsight/status/2084328552481112429
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Botnet Hunting for Vulnerabilities in Diagnostic Tools
https://isc.sans.edu/diary/Botnet%20Hunting%20for%20Vulnerabilities%20in%20Diagnostic%20Tools/33214
Inside Greatness: Telegram-Distributed M365 AiTM PhaaS
https://zerobec.com/blog/greatness-phaas-aitm-and-device-code-phishing
A Deep Dive Into the Latest XCSSET Version
https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime
https://devblogs.microsoft.com/dotnet/strengthening-nuget-supply-chain-security-reducing-api-key-lifetime/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

AUR packages adoption disabled
https://lists.archlinux.org/archives/list/[email protected]/thread/DRDEU3JUSC72CB265XHXPFA3DFSLXPBP/
Apple's iCloud File Sharing Left Ex-Employees With Access to Secret Documents
https://www.macrumors.com/2026/08/03/apple-icloud-sharing-ex-employees/
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

zipdump.py Metadata Encoding
https://isc.sans.edu/diary/zipdumppy+Metadata+Encoding/33202/
Atomic MacOS (AMOS) stealer infection
https://isc.sans.edu/diary/Atomic%20MacOS%20%28AMOS%29%20stealer%20infection/33208
Phishing Campaigns Targeting AI Solutions Providers
https://isc.sans.edu/diary/Phishing+Campaigns+Targeting+AI+Solutions+Providers/33206/
Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware
https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner
https://isc.sans.edu/diary/Reconnaissance%20First%3A%20An%20SSH%20Bot%20That%20Sizes%20Up%20Your%20Hardware%20Before%20Deploying%20a%20Miner%20%5BGuest%20Diary%5D/33198
Cisco Secure Firewall Management Center Software Static Credential Vulnerability Exploited CVE-2026-20316
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
Inconsistent Group Chats
https://www.usenix.org/conference/usenixsecurity26/presentation/gegenhuber
https://www.heise.de/en/news/Encrypted-but-wrong-Group-chats-vulnerable-to-manipulated-content-11384112.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Apple Patch Summary / Postscript
https://isc.sans.edu/diary/Apple%20Patches%20Everything%20%28July%202026%29/33196
IPMI Admin Password Hash Leak
https://lavahq.io/research/bmc-exposure-alert
Patches for VMWare
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
OpenWRT Patch, odhcpd vulnerability CVE-2026-53921
https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

AutoIT Payload Injector
https://isc.sans.edu/diary/AutoIT%20Payload%20Injector%20/33192
Apple Security Update
https://support.apple.com/en-us/100100
SourTrade: Browser-Assembled Malware Delivered Through Malvertising
https://blog.confiant.com/p/sourtrade-browser-assembled-malware
NGINX Exploit CVE-2026-42530, CVE-2026-42533
https://github.com/DepthFirstDisclosures/Nginx-Rift/tree/main
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Java Spring Boot "heapdump" scans
https://isc.sans.edu/diary/Java%20Spring%20Boot%20%22heapdump%22%20scans/33188
VBULLETIN RUNTIME TEMPLATE RUNMATHS PREAUTH RCE
https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
Microsoft Defender for Linux Update may disable restart
https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#issues-have-been-found-with-versions-101260420000101260420009
MongoDB Updates CVE-2026-13072
https://github.com/advisories/GHSA-wvx7-gr2m-7rf5
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Scans for ESAFENET CDG 3 Document Management System Weak Logins
https://isc.sans.edu/diary/Scans%20for%20ESAFENET%20CDG%203%20Document%20Management%20System%20Weak%20Logins/33184
DNS Poisoning Tactics Expand to Hospitality Wi-Fi
https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/
Silent Replacement of Trusted macOS App Executables
https://mysk.blog/2026/07/23/macos-overwrite-app-executables/
GitHub and PyPi Defense updates
https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/
https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich