Podcast
SANS Stormcast: Daily Cyber Security News
Hosted by Johannes Ullrich · EN
A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minutes long summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Storm Center. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
116episodes
Episodes
Newest firstAll episodes
SANS Stormcast Thursday, August 13th, 2026: Process Accounting; ShieldBreak; SharePoint JWT Vuln PoC; AI regulation
5d ago00:07:06Tap to summarizeLinux Kernel Process Accountinghttps://isc.sans.edu/diary/Linux%20Kernel%20Process%20Accounting/33240 ShieldBreak - Windows Defender 0day vulnerabilityhttps://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak/src/branch/main Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/ California law puts digital fingerprints on AI fakeshttps://digital-strategy.ec.europa.eu/en/policies/eu-icons-labelling-ai-generated-contenthttps://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Wednesday, August 12th, 2026: Microsoft Patch Tuesday; Zoom Vulnerabilities; Mozilla Revokes Key; Rogue Inflight Wifi
6d ago00:09:13Tap to summarizeMicrosoft Patch Tuesdayhttps://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20August%202026/33236 Zoom Vulnerablities CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415https://a.security/blog/asecurity-zoomsday Mozilla Revokes GPG Keyhttps://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/ Rogue Inflight Wifihttps://www.bleepingcomputer.com/news/security/delta-probes-wi-fi-deauth-attack-on-flight-carrying-def-con-attendees/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Tuesday, August 11th, 2026: Solana Attacks; AI Generated Patches; Gunra Ransomware; Neo4J/GraphQL Patch
1w ago00:06:22Tap to summarizeScans for Solana (Surfpool?) Endpointshttps://isc.sans.edu/diary/Scans%20for%20Solana%20%28Surfpool%3F%29%20Endpoints/33230 Why AI-generated vulnerability patches still require expert human reviewhttps://1password.com/blog/why-ai-generated-patches-still-require-human-review?_sp=15ec2845-9e6c-4d15-8ac5-fe9bc1fe4c08.1786396502013 Gunra Ransomwarehttps://www.cisa.gov/sites/default/files/2026-08/aa26-222a-stopransomware-gunra-ransomware_508c.pdf Neo4J/GraphQL Vulnerability CVE-2026-5423https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Monday, August 10th, 2026: Linux Shell Forensics; Criticial MacOS Patch; More N-Central Hotfixes; Exploited Metabase Vuln;
1w ago00:08:03Tap to summarizeLinux Shell Forensic: Let s Dive Into Atuin!https://isc.sans.edu/diary/Linux+Shell+Forensic+Lets+Dive+Into+Atuin/33226 Apple Patches macOS Screen Sharing Vulnerabilityhttps://support.apple.com/en-us/148170 More N-Able N-Central Issueshttps://www.n-able.com/blog/n-central-security-update-august-6-2026 Metabase Unauthenticated SQL injectionhttps://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Friday, August 7th, 2026: Fast SSH Attacks; Dell BIOS Passwd Weakness; Crypto Wallet Vuln; Benchmarking LLMs for Threat Intel
2w ago00:16:29Tap to summarize22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary]https://isc.sans.edu/diary/22+Seconds+to+Compromise+How+Automated+SSH+Actors+Move+From+Login+to+Persistence+Before+You+Can+Blink+Guest+Diary/33220 Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)https://blog.amberwolf.com/blog/2026/july/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/ Ill Bloom: Crypto Wallet Vulnerabilityhttps://illbloom.org Benchmarking Free-Tier Large Language Models as Cognitive Aids for Operationalizing Unstructured Cyber Threat Intelligencehttps://www.sans.edu/cyber-research/benchmarking-free-tier-large-language-models-cognitive-aids-operationalizing-unstructured-cyber-threat-intelligence My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Thursday, August 6th, 2026: keyv/cachable Worm IR; Apple Private Relay Leak; COLDCARD Phish
2w ago00:08:23Tap to summarizeDon't Revoke That Token Yet: Inside the keyv/cacheable npm Wormhttps://isc.sans.edu/diary/Don%27t%20Revoke%20That%20Token%20Yet%3A%20Inside%20the%20keyv%20cacheable%20npm%20Worm/33218 IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relayhttps://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/?ref=404media.co COLDCARD Issueshttps://x.com/threatinsight/status/2084328552481112429 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Wednesday, August 5th, 2026: Diagnostic Tool Hunt; Device Code Phishing; XCSSET; NuGet API Keys
2w ago00:06:30Tap to summarizeBotnet Hunting for Vulnerabilities in Diagnostic Toolshttps://isc.sans.edu/diary/Botnet%20Hunting%20for%20Vulnerabilities%20in%20Diagnostic%20Tools/33214 Inside Greatness: Telegram-Distributed M365 AiTM PhaaShttps://zerobec.com/blog/greatness-phaas-aitm-and-device-code-phishing A Deep Dive Into the Latest XCSSET Versionhttps://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/ Strengthening NuGet Supply Chain Security: Reducing API Key Lifetimehttps://devblogs.microsoft.com/dotnet/strengthening-nuget-supply-chain-security-reducing-api-key-lifetime/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Tuesday, August 4th, 2026: More Arch Linux AUR trouble; iCloud Sharing; Pass the Passkey
2w ago00:06:51Tap to summarizeAUR packages adoption disabledhttps://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/DRDEU3JUSC72CB265XHXPFA3DFSLXPBP/ Apple's iCloud File Sharing Left Ex-Employees With Access to Secret Documentshttps://www.macrumors.com/2026/08/03/apple-icloud-sharing-ex-employees/ Pass the Passkey: A Novel Attack Surface in Passwordless Authenticationhttps://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Monday, August 3rd, 2026: zipdump.py update; Atomic MacOS Analysis; OpenAI Phishing; COLDCARD Vulnerability
2w ago00:07:32Tap to summarizezipdump.py Metadata Encodinghttps://isc.sans.edu/diary/zipdumppy+Metadata+Encoding/33202/ Atomic MacOS (AMOS) stealer infectionhttps://isc.sans.edu/diary/Atomic%20MacOS%20%28AMOS%29%20stealer%20infection/33208 Phishing Campaigns Targeting AI Solutions Providershttps://isc.sans.edu/diary/Phishing+Campaigns+Targeting+AI+Solutions+Providers/33206/ Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmwarehttps://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Friday, July 31st, 2026: Pre Botnet Recon; Cisco Backdoor Exploited; Inconsistent Group Chats
3w ago00:05:51Tap to summarizeReconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Minerhttps://isc.sans.edu/diary/Reconnaissance%20First%3A%20An%20SSH%20Bot%20That%20Sizes%20Up%20Your%20Hardware%20Before%20Deploying%20a%20Miner%20%5BGuest%20Diary%5D/33198 Cisco Secure Firewall Management Center Software Static Credential Vulnerability Exploited CVE-2026-20316https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh Inconsistent Group Chatshttps://www.usenix.org/conference/usenixsecurity26/presentation/gegenhuberhttps://www.heise.de/en/news/Encrypted-but-wrong-Group-chats-vulnerable-to-manipulated-content-11384112.html My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →