Summary4 min read

SANS Stormcast Summary – February 24, 2026

Host: Johannes B. Ullrich
Episode Theme: Critical vulnerabilities and recent malware trends in compressed images, popular eBook software, PDF generation libraries, and webmail platforms.

Episode Overview

This brief daily update covers:

A detailed malware analysis of a malicious JPEG campaign
Two critical vulnerabilities patched in Calibre, a popular eBook reader
An object injection flaw in the jsPDF JavaScript library
Active exploitation of Roundcube webmail due to an older vulnerability

Key Discussion Points & Insights

1. Malicious JPEG Analysis

[00:32 – 02:04]

Malware Diary by Jan Yann:
Investigated a malicious campaign using a JPEG image as a final payload.
- Initial Infection Vector:
  - Arrival artifact: A ZIP file containing compressed JavaScript.
  - File appears over 1MB due to large volumes of random garbage data—an obfuscation tactic.
    "The attacker is just adding some random garbage to the file... to extend its size, make it a little bit more difficult to sort of analyze it and sometimes also fool then anti malware engines into not actually looking at the file." – Johannes [00:42]
  - After cleaning, only a few lines of actionable JavaScript remained—a standard downloader.
- Malware Delivery:
  - Downloader fetches an image (JPEG) with attached scripts.
  - End goal: Installation of Remcos RAT (remote access tool).
- Security Lessons:
  - Sender's address was forged.
  - Attack could be blocked by proper DMARC, DKIM, and SPF configuration on the mail server.
  - Some anti-malware engines may still miss such simple attacks.
  - Emphasized defense-in-depth:
    "Having that extra layer of basically fairly straightforward and simple defenses like DMARC certainly can make a difference here." – Johannes [01:53]

2. Calibre Critical Vulnerabilities

[02:04 – 03:02]

Nature of the Flaws:
- Two critical bugs patched allow for arbitrary path traversal and, therefore, code execution.
- Exploit methodology:
  Attackers craft malicious ebooks. When opened, these can cause files to be saved in attacker-chosen directories, leading to code execution. "This is a very common issue… ebooks are often distributed in these compressed formats that then extract into multiple files." – Johannes [02:32]
Severity:
- Both vulnerabilities score 9.3 on the CVSS scale.
Recommendation:
- Update Calibre immediately.
- Be cautious with ebooks from untrusted sources.

3. jsPDF Object Injection Vulnerability

[03:02 – 03:52]

About jsPDF:
- A JavaScript library used for creating, reading, and parsing PDF files.
- Vulnerable to injected JavaScript if PDFs mishandle embedded scripts: "The problem with PDFs is that they may include JavaScript and that's sort of where you have that good old problem: bad data [and] code being mixed." – Johannes [03:23]
Exploit Details:
- If JavaScript in PDFs isn't properly closed or sanitized, arbitrary code may execute.
- Attack's severity is dependent on how you use jsPDF and the trustworthiness of input PDFs.
Recommendation:
- Patch jsPDF.
- Understand your exposure ("depends a little bit on how you're using jsPDF…what PDFs you're creating with it, where the data is coming from" [03:36]).

4. Roundcube and Webmail Exploitation

[03:52 – 05:02]

Webmail Is a Difficult Target:
Johannes notes the challenge in securing webmail systems and why vulnerabilities are especially significant for sensitive users: "I have the utmost respect for people who dare to create webmail systems. I think it's a very difficult thing to do securely given the complexities and of course the attack surface of email." – Johannes [04:05]
Active Exploitation:
- Roundcube patched a PHP deserialization vulnerability in June; now being exploited in the wild.
- Similar exploitation is ongoing against SmarterMail.
- Takeaway: On-premises/open source webmail users, especially those handling sensitive information, must patch rapidly as exploits emerge soon after disclosure.
Recommendation:
- Ensure webmail systems are up to date, especially if not using large commercial/cloud providers.

Memorable Quotes & Moments

"Simple stuff like [DMARC] gets missed by some anti malware engines. So having that extra layer…can make a difference here." – Johannes [01:53]
"Ebooks are often distributed in these compressed formats that then extract into multiple files. And that's exactly sort of what's here happening..." – Johannes [02:32]
"Bad data [and] code being mixed, not properly sort of separated from each other." – Johannes on jsPDF [03:23]
"I have the utmost respect for people who dare to create webmail systems. I think it's a very difficult thing to do securely..." – Johannes [04:05]

Notable Timestamps

00:32: Malicious JPEG/JavaScript malware analysis
01:53: Email authentication (DMARC/DKIM/SPF) importance
02:04 – 03:02: Calibre critical vulnerabilities detailed
03:02 – 03:52: jsPDF object injection
03:52 – 05:02: Webmail vulnerabilities, Roundcube & SmarterMail exploitation
05:02: End of main content

Summary

This episode highlights persistent threats coming from seemingly innocuous files (JPEGs, ebooks, PDFs), emphasizes the need for patching widely-used open source software, and underlines the ongoing exploitation risk in webmail platforms. The overarching message: Layered defenses and prompt updates remain critical for defending against both complex and deceptively simple attacks.

Loading summary

Transcript1 lines

[00:05]
A
Hello and welcome to the Tuesday, February 24, 2026 edition of the SANS Internet Storm Center's Stormcast. My name is Johannes Ulrich recording today from Jacksonville, Florida and this episode is brought to you by the Sans Edu Bachelor's degree program in Applied Cybersecurity. Well in diaries today we have a malware analysis diary from Jan Yann looked at well as he calls it yet another malicious JPEG file. An image in this case. But what actually arrived initially and Jan focus a little bit more on the downloader here was well a good old compressed zip compressed JavaScript file. Once decompressed there was over a megabyte of data. However most of the data was garbage. So first obfuscation technique here where the attacker is just adding some random garbage to the file in order to extend its size, make it a little bit more difficult to sort of analyze it and sometimes also fool then anti malware engines into not actually looking at the file. Well once all of that was removed there were only a couple kilobytes left. Actually in the end only about a dozen or so lines left that Jan actually had to deobuscate further. And well that's where he ended up with your standard downloader that would then download an image with attached scripts that would then in the end end up installing the Remco rat well remote access tool. So overall fairly standard malware. A couple lessons here from this one. The from was actually faked and would not make it pass properly configured dmarc, DKIM SPF so those techniques are definitely very useful. Often even simple stuff like this gets missed by some anti malware engines. So having that extra layer of basically fairly straightforward and simple defenses like DMARC certainly can make a difference here. And if you're using calibre in order to read ebooks, well pay attention. There are two critical vulnerabilities that were patched a couple days ago that allow for arbitrary path transversal and with that also for code execution. The way this would be exploited is by someone tricking you into opening a crafted malicious ebook and that would then save files in ARPDRA directories as you're opening it. And with that of course you easily then have arbitrary code execution if these files are then being saved in the right directories. This is a very common issue we've talked about is a lot with sort of various compressed formats. Of course ebooks are often distributed in these compressed formats that then extract into multiple files. And that's exactly sort of what's here happening where caliper isn't careful enough as to where it actually extracts those files and then you have sort of a standard path traversal. Again there are two distinct vulnerabilities, but they're very similar and both same css score of 9.3. Then we have well, a little bit ebook related to a vulnerability in JSPDF. JSPDF is a JavaScript library to create, read, parse PDFs. Of course the problem with PDFs is that they may include JavaScript and that's sort of where you have that good old problem, bad data code being mixed, not properly sort of separated from each other. And yes, If a particular JavaScript segment is open but they're not properly closed, you may have this execution of the JavaScript happening. This vulnerability is a little bit tricky in the sense that yes, it's something patch available exploit is available as well for it, but whether or not this is a problem for you depends a little bit on how you're using JSPDF, like what kind of PDFs you're rendering, what PDFs you're creating with it, where the data is coming from. So lots of dependencies here. So how risky this is in your particular use case. Of course all depends then on what untrusted data is really being fed here to jspdf. I would still plead with you to just get it updated. Next vulnerability that I was a little bit contemplating whether I should cover it and the reason I do cover it is that, well, it's in a webmail system and I have the utmost respect for people who dare to create webmail systems. I think it's a very difficult thing to do securely given the complexities and of course the attack surface of email. But most people don't really use webmail systems that much that they created themselves or that are open source. So many people are going cloud these days for email and with that also for their webmail. The problem is that these systems are often used by people that deal with more sensitive data that they don't just want to put in possibly an adversary's cloud. So that's why I think this probably these kind of vulnerabilities are more important than one would sort of think offhand. Latest example here is Roundcube. There was a PHP deceleration vulnerability that was patched last June. It's now actively being exploited. We also had a couple of weeks ago, and I didn't cover it back then, probably should have in Smarter Mail, another sort of open source and commercial webmail system that also is actively being exploited. Actually a more recent vulnerability that got hit there. So if if you're running your own webmail system on prem, make sure it's up to date. These vulnerabilities are often exploited fairly soon after they have been made public. Well, and this is it for today. So thanks for listening, thanks for liking, and thanks for subscribing to this podcast. And just a reminder, if you're interested in any classes, the next class I'll be teaching is in April in Orlando and then end of April in Amsterdam. So take a look on the United Storm Center's website just below the show notes for the podcast. Thanks and talk to you again tomorrow. Bye.