SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

More RMM Tools In the Wild

https://isc.sans.edu/diary/More%20RMM%20Tools%20In%20the%20Wild/33400

WORDPRESS LIBHEIF RCE

https://fortbridge.co.uk/research/wordpress-libheif-rce/

SONICWALL SMA1000 SERIES APPLIANCES Vulnerabilities CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

OpenSSH 10.6 Released

https://seclists.org/oss-sec/2026/q4/58

DNSSEC Root Key Signing Key Rollover

https://blog.cloudflare.com/root-ksk-2024-rollover/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

TTY Logs and the Data it Captures

https://isc.sans.edu/diary/TTY%20Logs%20and%20the%20Data%20it%20Captures/33396

Citrix Netscaler SAML Vulnerability (0-Day) CVE-2026-88779

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/

Microsoft Exchange September 2026 V2 Update CVE-2026-96940

https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

User Agent Strings Curiosities

https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394

FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286

https://fortiguard.fortinet.com/psirt/FG-IR-26-175

Critical GitLab Vulnerability CVE-2026-90970

https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/

Updates to Full Disk Access in macOS

https://developer.apple.com/news/?id=p6zjojqw

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

ScreenConnect Client (Ab)used by Attackers

https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments

Attackers abuse ChatGPT to deliver RAT via ClickFix

https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?_sp=51406044-aa1d-4278-a4e7-adb5b8ef84b2.1790890760100

Spoofing iCloud From Address

https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/

Sender spoofing in Proton Mail via display-name homograph

https://alonsovidales.github.io/protonmail-sender-spoofing/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability CVE-2026-76504

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

WatchGuard AP Command Injection in Internal Management API Allows Command Execution

https://psirt.watchguard.com/CVE-2026-86102/

A Realistic Code Execution Exploit Chain in OpenBao and Vault

https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/

Building a post-quantum certificate authority with Merkle Tree Certificates

https://blog.cloudflare.com/pq-ca-with-mtcs/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich