SANS Stormcast: Daily Cyber Security News

In today's episode: Microsoft's October 2026 Patch Tuesday fixes 1,417 vulnerabilities, including an exploited Mark of the Web bypass, plus Ivanti patches an exploited Connect Secure flaw and Adobe fixes critical ColdFusion and Adobe Commerce vulnerabilities.
October 2026 Microsoft Patch Tuesday
Microsoft patched 1,417 vulnerabilities, 76 rated critical. CVE-2026-96951, an already exploited Windows Shell security feature bypass, skips the Mark of the Web warning. CVE-2026-108398, a publicly disclosed .NET Framework flaw, bypasses application control. Also patched: 10 remote code execution flaws in Windows DHCP Server (five critical), an Exchange Server RCE triggered by a crafted email (CVE-2026-70571), and many Microsoft Office RCE vulnerabilities.
https://isc.sans.edu/diary/October%202026%20Microsoft%20Patch%20Tuesday/33422
Ivanti October 2026 Security Update
Ivanti fixed an Ivanti Connect Secure vulnerability already exploited in limited attacks, plus two Ivanti Neurons vulnerabilities that can leak the credentials used to connect to Microsoft Intune. Patch, then rotate those Intune credentials.
https://www.ivanti.com/blog/october-2026-security-update
Adobe Patch Tuesday: ColdFusion and Adobe Commerce
Adobe fixed 110 vulnerabilities across 11 products. Adobe Commerce has critical arbitrary code execution flaws, and ColdFusion has CVSS 10.0 server-side request forgery (SSRF) and unrestricted file upload vulnerabilities. Prioritize these two products.
https://www.adobe.com/trust/security/bulletins-and-advisories.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates.
CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE
An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee
Let s Encrypt 64-Day Certificate Lifetimes Coming Feb 2027
Let s Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates.
https://letsencrypt.org/2026/10/07/64-day-certs.html
Midnight Mimosa: Malware Pre-Installed on Android Phones
Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud.
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Progress MarkLogic Critical Security Alert Bulletin October 2026
Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled.
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through the EC2 instance metadata service (IMDS), and ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass.
Why TLP Should Not Replace Your Internal Information Classification
The Traffic Light Protocol from FIRST defines who threat intelligence may be shared with, from TLP:CLEAR to TLP:RED, but not how to protect it in transit. Organizations still need their own classification and safeguards, such as encryption, instead of sending TLP:AMBER data in plain email.
https://isc.sans.edu/forums/diary/Why%20TLP%20should%20not%20replace%20your%20internal%20information%20classification/33414/
AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents. A prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service, made possible by IMDSv1 and overly broad permissions. Restrict the URLs your AI agents can reach and always use IMDSv2.
https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model
Palo Alto GlobalProtect VPN Vulnerability Exploited by Ransomware (CVE-2026-0257)
ReliaQuest reports ransomware actors exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access to open unauthorized VPN sessions. Patch VPN gateways, and keep VPN clients updated too.
https://x.com/ReliaQuestTR/status/2108647641240465707
https://security.paloaltonetworks.com/CVE-2026-0257
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: new scripts for reconstructing AI agent activity during forensic investigations, an attacker's Claude chat history recovered after breaches at South Korean financial institutions, internationalized domain name (IDN) lookalikes that still get past Chrome, and an unpatched Cisco Finesse server-side request forgery (SSRF) vulnerability.
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review
Jim Clausing released two scripts that turn the logs left behind by the OpenCode and Hermes AI agents into searchable JSON, so incident responders can see what an AI agent did on an attacker's or a victim's system.
https://isc.sans.edu/diary/Reconstructing%20AI%20Agent%20Activity%3A%20Two%20New%20Scripts%20for%20Forensic%20Review/33410
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
While investigating breaches at South Korean financial institutions, CrowdStrike recovered the attacker's CLAUDE.md file and Claude chat history, a rare look at how a low-skill "prompt kiddie" uses AI to run an attack.
https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
Turning IDN Edge Cases into Typosquats
Attackers can still register convincing lookalike domains using Unicode characters that resemble Latin letters but are not on Chrome's list of known confusables. One test domain impersonating Apple displayed in Chrome but not in Safari.
https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats
Cisco Finesse SSRF Vulnerability (CVE-2026-20362)
Cisco disclosed an unauthenticated server-side request forgery vulnerability in the Cisco Finesse web-based management interface, rated High (CVSS 7.2). Details are already public, there is no workaround, and fixed releases are not expected until January or February 2027.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Scans for Atlassian vulnerablity (CVE-2026-21589)
https://isc.sans.edu/diary/Scans%20for%20Atlassian%20vulnerablity%20%28CVE-2026-21589%29/33406
.gh, .sl and .as ccTLD Compromise
https://blog.google/security/chromes-response-to-recent-cctld-registry-hijacks/
Cisco Nexus 3000 and 9000 Series Switches Remote Code Execution Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU
Outlook Blocking MSIX Files
https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

More RMM Tools In the Wild
https://isc.sans.edu/diary/More%20RMM%20Tools%20In%20the%20Wild/33400
WORDPRESS LIBHEIF RCE
https://fortbridge.co.uk/research/wordpress-libheif-rce/
SONICWALL SMA1000 SERIES APPLIANCES Vulnerabilities CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
OpenSSH 10.6 Released
https://seclists.org/oss-sec/2026/q4/58
DNSSEC Root Key Signing Key Rollover
https://blog.cloudflare.com/root-ksk-2024-rollover/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

TTY Logs and the Data it Captures
https://isc.sans.edu/diary/TTY%20Logs%20and%20the%20Data%20it%20Captures/33396
Citrix Netscaler SAML Vulnerability (0-Day) CVE-2026-88779
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
Microsoft Exchange September 2026 V2 Update CVE-2026-96940
https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

User Agent Strings Curiosities
https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394
FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286
https://fortiguard.fortinet.com/psirt/FG-IR-26-175
Critical GitLab Vulnerability CVE-2026-90970
https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/
Updates to Full Disk Access in macOS
https://developer.apple.com/news/?id=p6zjojqw
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

ScreenConnect Client (Ab)used by Attackers
https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments
Attackers abuse ChatGPT to deliver RAT via ClickFix
https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?_sp=51406044-aa1d-4278-a4e7-adb5b8ef84b2.1790890760100
Spoofing iCloud From Address
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
Sender spoofing in Proton Mail via display-name homograph
https://alonsovidales.github.io/protonmail-sender-spoofing/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability CVE-2026-76504
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
WatchGuard AP Command Injection in Internal Management API Allows Command Execution
https://psirt.watchguard.com/CVE-2026-86102/
A Realistic Code Execution Exploit Chain in OpenBao and Vault
https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/
Building a post-quantum certificate authority with Merkle Tree Certificates
https://blog.cloudflare.com/pq-ca-with-mtcs/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich