Épisodes

  • SANS Stormcast Friday, February 27th, 2026: Finding Singal (@sans_edu intern); Google API Keys and Gemini; AirSnitch Breaking Client Isolation

    SANS Stormcast Friday, February 27th, 2026: Finding Singal (@sans_edu intern); Google API Keys and Gemini; AirSnitch Breaking Client Isolation
    Feb 27 2026

    Finding Signal in the Noise: Lessons Learned Running a Honeypot with AI Assistance [Guest Diary]
    https://isc.sans.edu/diary/Finding%20Signal%20in%20the%20Noise%3A%20Lessons%20Learned%20Running%20a%20Honeypot%20with%20AI%20Assistance%20%5BGuest%20Diary%5D/32744
    Google API Keys Weren't Secrets. But then Gemini Changed the Rules.
    https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
    AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks
    https://www.ndss-symposium.org/ndss-paper/airsnitch-demystifying-and-breaking-client-isolation-in-wi-fi-networks/
    Afficher plus Afficher moins
    9 min
  • SANS Stormcast Thursday, February 26th, 2026: CLAIR Model; Cisco SD-WAN 0-Day; Cortex XDR Abuse; OpenSSL Vuln;

    SANS Stormcast Thursday, February 26th, 2026: CLAIR Model; Cisco SD-WAN 0-Day; Cortex XDR Abuse; OpenSSL Vuln;
    Feb 26 2026

    The CLAIR Model: A Synthesized Conceptual Framework for Mapping Critical Infrastructure Interdependencies [Guest Diary]
    https://isc.sans.edu/diary/The+CLAIR+Model+A+Synthesized+Conceptual+Framework+for+Mapping+Critical+Infrastructure+Interdependencies+Guest+Diary/32748
    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability CVE-2026-20127
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk https://blog.talosintelligence.com/uat-8616-sd-wan/
    Abusing Cortex XDR Live
    https://labs.infoguard.ch/posts/abusing_cortex_xdr_live_response_as_c2/
    OpenSSL Vulnerability CVE-2025-15467
    https://seclists.org/oss-sec/2026/q1/220
    Afficher plus Afficher moins
    7 min
  • SANS Stormcast Wednesday, February 25th, 2026: Open Redirects; setHTML in Firefox; telnetd issues

    SANS Stormcast Wednesday, February 25th, 2026: Open Redirects; setHTML in Firefox; telnetd issues
    Feb 25 2026

    Open Redirects: A Forgotten Vulnerability?
    https://isc.sans.edu/diary/Open%20Redirects%3A%20A%20Forgotten%20Vulnerability%3F/32742
    Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148
    https://hacks.mozilla.org/2026/02/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148/
    More telnetd issues
    https://seclists.org/oss-sec/2026/q1/199
    Afficher plus Afficher moins
    7 min
  • SANS Stormcast Tuesday, February 24th, 2026: Malicious JPEG Analysis; Calibre Vuln; jsPDF object injection; Roundcube Exploited

    SANS Stormcast Tuesday, February 24th, 2026: Malicious JPEG Analysis; Calibre Vuln; jsPDF object injection; Roundcube Exploited
    Feb 24 2026

    Another day, another malicious JPEG
    https://isc.sans.edu/diary/Another%20day%2C%20another%20malicious%20JPEG/32738
    Calibre Path Traversal Leading to Arbitrary File Write and Potentially Code Execution CVE-2026-26064 CVE-2026-26065
    https://github.com/kovidgoyal/calibre/security/advisories/GHSA-72ch-3hqc-pgmp
    https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vmfh-7mr7-pp2w
    CVE-2026-25755: PDF Object Injection in jsPDF (addJS Method)
    https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md
    Roundcube Webmail Exploited CVE-2025-49113 https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
    https://www.openwall.com/lists/oss-security/2025/06/02/3
    Afficher plus Afficher moins
    7 min
  • SANS Stormcast Monday, February 23rd, 2026: Japanese Phishing; AI Agents Ignoring Instructions; Starkiller MFA Phishing

    SANS Stormcast Monday, February 23rd, 2026: Japanese Phishing; AI Agents Ignoring Instructions; Starkiller MFA Phishing
    Feb 23 2026

    Japanese-Language Phishing Emails
    https://isc.sans.edu/diary/Japanese-Language%20Phishing%20Emails/32734
    'God-Like' Attack Machines: AI Agents Ignore Security Policies
    https://www.darkreading.com/application-security/ai-agents-ignore-security-policies
    Starkiller: New Phishing Framework Proxies Real Login Pages to Bypass MFA
    https://abnormal.ai/blog/starkiller-phishing-kit
    Afficher plus Afficher moins
    7 min
  • SANS Stormcast Friday, February 20th, 2026: DynoWiper Analysis; Vibe Passwords; IDE Extension Vulns; Gransstream GXP 1600 Vuln and PoC

    SANS Stormcast Friday, February 20th, 2026: DynoWiper Analysis; Vibe Passwords; IDE Extension Vulns; Gransstream GXP 1600 Vuln and PoC
    Feb 20 2026

    Under the Hood of DynoWiper
    https://isc.sans.edu/diary/Under%20the%20Hood%20of%20DynoWiper/32730
    Vibe Password Generation: Predictable by Design
    https://www.irregular.com/publications/vibe-password-generation
    Vulnerabilities (CVE-2025-65715, CVE-2025-65716, CVE-2025-65717) in four popular IDE Extensions
    https://www.ox.security/blog/four-vulnerabilities-expose-a-massive-security-blind-spot-in-ide-extensions/
    Grandstream GXP1600 VoIP Phones
    https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/
    Afficher plus Afficher moins
    6 min
  • SANS Stormcast Thursday, February 19th, 2026: Malware Image Resuse; Dell RecoveryPoint; Admin Center Vuln; DNS-PERSIST-01

    SANS Stormcast Thursday, February 19th, 2026: Malware Image Resuse; Dell RecoveryPoint; Admin Center Vuln; DNS-PERSIST-01
    Feb 19 2026

    Tracking Malware Campaigns With Reused Material
    https://isc.sans.edu/diary/Tracking%20Malware%20Campaigns%20With%20Reused%20Material/32726
    From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day
    https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day
    Windows Admin Center Elevation of Privilege Vulnerability CVE-2026-26119
    https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26119
    DNS-PERSIST-01: A New Model for DNS-based Challenge Validation
    https://letsencrypt.org/2026/02/18/dns-persist-01.html
    Defending Web Apps
    https://www.sans.org/cyber-security-courses/application-security-securing-web-apps-api-microservices
    Afficher plus Afficher moins
    7 min
  • SANS Stormcast Wednesday, February 18th, 2026: IR Phishing; Neenadu Android Backdoor; NiFi Bugs; LLMs Phishing; Encrypted RCS

    SANS Stormcast Wednesday, February 18th, 2026: IR Phishing; Neenadu Android Backdoor; NiFi Bugs; LLMs Phishing; Encrypted RCS
    Feb 18 2026

    Fake Incident Report Used in Phishing Campaign
    https://isc.sans.edu/diary/Fake%20Incident%20Report%20Used%20in%20Phishing%20Campaign/32722
    Divide and conquer: how the new Keenadu backdoor exposed links between major Android botnets https://securelist.com/keenadu-android-backdoor/118913/
    CVE-2026-25903: Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates https://seclists.org/oss-sec/2026/q1/166
    The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time
    https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/
    Encrypted RCS in iOS/iPadOS
    https://developer.apple.com/documentation/ios-ipados-release-notes/ios-ipados-26_4-release-notes
    Afficher plus Afficher moins
    8 min