Podcast
SANS Stormcast: Daily Cyber Security News
Hosted by Johannes Ullrich · EN
A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minutes long summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Storm Center. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
118episodes
Episodes
Newest firstAll episodes
SANS Stormcast Monday, August 3rd, 2026: zipdump.py update; Atomic MacOS Analysis; OpenAI Phishing; COLDCARD Vulnerability
2w ago00:07:32Tap to summarizezipdump.py Metadata Encodinghttps://isc.sans.edu/diary/zipdumppy+Metadata+Encoding/33202/ Atomic MacOS (AMOS) stealer infectionhttps://isc.sans.edu/diary/Atomic%20MacOS%20%28AMOS%29%20stealer%20infection/33208 Phishing Campaigns Targeting AI Solutions Providershttps://isc.sans.edu/diary/Phishing+Campaigns+Targeting+AI+Solutions+Providers/33206/ Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmwarehttps://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Friday, July 31st, 2026: Pre Botnet Recon; Cisco Backdoor Exploited; Inconsistent Group Chats
3w ago00:05:51Tap to summarizeReconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Minerhttps://isc.sans.edu/diary/Reconnaissance%20First%3A%20An%20SSH%20Bot%20That%20Sizes%20Up%20Your%20Hardware%20Before%20Deploying%20a%20Miner%20%5BGuest%20Diary%5D/33198 Cisco Secure Firewall Management Center Software Static Credential Vulnerability Exploited CVE-2026-20316https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh Inconsistent Group Chatshttps://www.usenix.org/conference/usenixsecurity26/presentation/gegenhuberhttps://www.heise.de/en/news/Encrypted-but-wrong-Group-chats-vulnerable-to-manipulated-content-11384112.html My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Thursday, July 30th, 2026: Apple Patches; IPMI Admin PW Hash Leak; VMWare Patches; OpenWRT Patch
3w ago00:06:57Tap to summarizeApple Patch Summary / Postscripthttps://isc.sans.edu/diary/Apple%20Patches%20Everything%20%28July%202026%29/33196 IPMI Admin Password Hash Leakhttps://lavahq.io/research/bmc-exposure-alert Patches for VMWarehttps://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 OpenWRT Patch, odhcpd vulnerability CVE-2026-53921https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Wednesday, July 29th, 2026: AutoIT Payload Injector; Appele Patches; SourTrade Malware; NGINX Exploit
3w ago00:07:00Tap to summarizeAutoIT Payload Injectorhttps://isc.sans.edu/diary/AutoIT%20Payload%20Injector%20/33192 Apple Security Updatehttps://support.apple.com/en-us/100100 SourTrade: Browser-Assembled Malware Delivered Through Malvertisinghttps://blog.confiant.com/p/sourtrade-browser-assembled-malware NGINX Exploit CVE-2026-42530, CVE-2026-42533https://github.com/DepthFirstDisclosures/Nginx-Rift/tree/main My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Tuesday, July 28th, 2026: Spring Boot Scans; VBulletin Vulnerability; MSFT Defender for Linux; MongoDB Update
3w ago00:05:27Tap to summarizeJava Spring Boot "heapdump" scanshttps://isc.sans.edu/diary/Java%20Spring%20Boot%20%22heapdump%22%20scans/33188 VBULLETIN RUNTIME TEMPLATE RUNMATHS PREAUTH RCEhttps://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/ Microsoft Defender for Linux Update may disable restarthttps://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#issues-have-been-found-with-versions-101260420000101260420009 MongoDB Updates CVE-2026-13072https://github.com/advisories/GHSA-wvx7-gr2m-7rf5 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Monday, July 27th, 2026: ESAFENET CDG Scans; DNS Poisoning; macOS Gatekeeper bypass; GitHub and PyPi updates
3w ago00:07:09Tap to summarizeScans for ESAFENET CDG 3 Document Management System Weak Loginshttps://isc.sans.edu/diary/Scans%20for%20ESAFENET%20CDG%203%20Document%20Management%20System%20Weak%20Logins/33184 DNS Poisoning Tactics Expand to Hospitality Wi-Fihttps://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/ Silent Replacement of Trusted macOS App Executableshttps://mysk.blog/2026/07/23/macos-overwrite-app-executables/ GitHub and PyPi Defense updateshttps://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Friday, July 24th, 2026: OpenAI vs. Huggingface; Zimbra Exploited; Notepad++ Abuse; Browser as C2
4w ago00:06:55Tap to summarizeWhen the "Autonomous Attacker" Is Your Own AI Modelhttps://isc.sans.edu/diary/When%20the%20%22Autonomous%20Attacker%22%20Is%20Your%20Own%20AI%20Model/33180 Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbrahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204ahttps://cert.gov.ua/article/6318634https://cybersecuritynews.com/hackers-abuse-notepad-plugins/ Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channelhttps://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Thursday, July 23rd, 2026: Rondo and Geoserver; Oracle Patches; Checkpoint 0-day; OpenAI vs Huggingface
4w ago00:06:27Tap to summarizeRondo Meets Geoserverhttps://isc.sans.edu/diary/Rondo%20Meets%20Geoserver/33176 Oracle July Patch Updatehttps://www.oracle.com/security-alerts/cpujul2026.html OpenAI and Hugging Face partner to address security incident during model evaluationhttps://openai.com/index/hugging-face-model-evaluation-security-incident/ Checkpoint July 2026 Security Advisory (CVE-2026-16232)https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Wednesday, July 22nd, 2026: Captive Portals; Critical Serv-U and Zimbra Update; Apple Hide-My-Email fix
4w ago00:05:31Tap to summarizeCaptive Portal Detectionhttps://isc.sans.edu/diary/Captive%20Portal%20Detection/33172 Critical SolarWinds Serv-U Updatehttps://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm Zimbra Update with Critical Security Fixeshttps://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/ Apple Fixed Hide My E-Mail Leakhttps://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →SANS Stormcast Tuesday, July 21st, 2026: More Wordpress Details; HOLLOWGRAPH MSFT Calendar Abuse; Gitea Vulnerability
4w ago00:08:36Tap to summarizeWordPress Exploitation Underway (CVE-2026-63030)https://isc.sans.edu/diary/WordPress%20Exploitation%20Underway%20%28CVE-2026-63030%29/33168 HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channelshttps://www.group-ib.com/blog/hollowgraph-microsoft-365/ Gitea Vulnerablity CVE-2026-58443https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich
Transcribe →