x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

news tech news

All Episodes

7:41

SANS Stormcast Wednesday, August 6th, 2025:...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/08/06

Stealing Machinekeys for fun and profit (or riding the SharePoint wave)Bojan explains in detail how .NET uses Machine Keys to protect the VIEWSTATE, and how to abuse the VIEWSTATE for code execution if the Machine Keys are lost. https://isc.sans.edu/diary/Stealing%20Machine%20Keys%20for%20fun%20and%20profit%20%28or%20riding%20the%20SharePoint%20wave%29/32174 Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives Perplexity will change its User Agent, or use different

en-us

6:48

SANS Stormcast Tuesday, August 05, 2025: Daily Trends...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/08/05

Daily Trends Report A new trends report will bring you daily data highlights via e-mail. https://isc.sans.edu/diary/New%20Feature%3A%20Daily%20Trends%20Report/32170 NVidia Triton RCE Wiz found an interesting information leakage vulnerability in NVidia s Triton servers that can be leveraged to remote code execution. https://www.wiz.io/blog/nvidia-triton-cve-2025-23319-vuln-chain-to-ai-server Cursor AI MCP Vulnerability An attacker could abuse negligent Cursor MCP configurations to implement

en-us

5:17

SANS Stormcast Monday, August 4th, 2025: Legacy...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/08/04

Scans for pop3user with guessable password A particular IP assigned to a network that calls itself Unmanaged has been scanning telnet/ssh for a user called pop3user with passwords pop3user or 123456 . I assume they are looking for legacy systems that either currently run pop3 or ran pop3 in the past, and left the user enabled. https://isc.sans.edu/diary/Legacy%20May%20Kill/32166 Possible Sonicwall SSL VPN 0-Day Arcticwolf observed compromised Sonicwall SSL VPN devices used by the Akira group

en-us

5:41

SANS Stormcast Friday, August 1st, 2025: Scattered...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/08/01

Scattered Spider Related Domain Names A quick demo of our domain feeds and how they can be used to find Scattered Spider related domains https://isc.sans.edu/diary/Scattered+Spider+Related+Domain+Names/32162 Excel External Workbook Links to Blocked File Types Will Be Disabled by Default Excel will discontinue allowing links to dangerous file types starting as early as

en-us

6:40

SANS Stormcast Thursday July 31st, 2025: Firebase...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/31

Securing Firebase: Lessons Re-Learned from the Tea BreachInspried by the breach of the Tea app, Brendon Evans recorded a video to inform of Firebase security issues https://isc.sans.edu/diary/Securing%20Firebase%3A%20Lessons%20Re-Learned%20from%20the%20Tea%20Breach/32158 WebKit Vulnerability Exploited before Apple Patch A WebKit vulnerablity patched by Apple yesterday has already been exploited in Google Chrome. Google noted the exploit with its patch for the same vulnerability in

en-us

5:20

SANS Stormcast Friday, July 25th, 2025: ficheck.py;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/25

New File Integrity Tool: ficheck.pyJim created a new tool, ficheck.py, that can be used to verify file integrity. It is a drop-in replacement for an older tool, fcheck, which was written in Perl and no longer functions well on modern Linux distributions. https://isc.sans.edu/diary/New%20Tool%3A%20ficheck.py/32136 Mitel Vulnerability Mitel released a patch for a vulnerability in its MX-ONE product. The authentication bypass could provide an attacker with user or even admin

en-us

6:17

SANS Stormcast Wednesday, July 23rd, 2025: Sharepoint...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/23

Microsoft Updates SharePoint Vulnerability Guidance CVE-2025-53770 and CVE-2025-53771Microsoft released its update for SharePoint 2016, completing the updates across all currently supported versions. https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ WinZip MotW Privacy Starting with version 7.10, WinZip introduced an option to no longer include the download URL in zip files as part of the Mark of the Web

en-us

6:00

SANS Stormcast Tuesday, July 22nd, 2025: SharePoint...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/22

Microsoft Released Patches for SharePoint Vulnerability CVE-2025-53770 CVE-2025-53771 Microsoft released a patch for the currently exploited SharePoint vulnerability. It also added a second CVE number identifying the authentication bypass vulnerability. https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ How Quickly Are Systems Patched? Jan took Shodan data to check how quickly recent vulnerabilities were patched. The quick answer: Not fast

en-us

8:05

SANS Stormcast Monday July 21st, 2025: Sharepoint...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/21

SharePoint Servers Exploited via 0-day CVE-2025-53770Late last week, CodeWhite found a new remote code execution exploit against SharePoint. This vulnerability is now actively exploited. https://isc.sans.edu/diary/Critical+Sharepoint+0Day+Vulnerablity+Exploited+CVE202553770+ToolShell/32122/ Veeam Voicemail Phishing Attackers appear to impersonate VEEAM in recent voicemail-themed phishing attempts. https://isc.sans.edu/diary/Veeam%20Phishing%20via%20Wav%20File/32120 Passkey Phishing Attack A

en-us

7:29

SANS Stormcast Monday June 30th, 2025: Scattered...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/30

Scattered Spider UpdateThe threat actor known as Scattered Spider is in the news again, this time focusing on airlines. But the techniques used by Scattered Spider, social engineering, are still some of the most dangerous techniques used by various threat actors. https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations?e=48754805 AMI BIOS Vulnerability Exploited CVE-2024-54085 A vulnerability in the Redfish remote access software, including AMI s BIOS,

en-us

5:46

SANS Stormcast Friday, June 20th, 2025: New Employee...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/20

How Long Until the Phishing Starts? About Two WeeksAfter setting up a Google Workspace and adding a new user, it took only two weeks for the new employee to receive somewhat targeted phishing emails. https://isc.sans.edu/diary/How%20Long%20Until%20the%20Phishing%20Starts%3F%20About%20Two%20Weeks/32052 Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone numbers Scammers are placing Google ads that point to legitimate companies sites, but are injecting

en-us

6:27

SANS Stormcast Thursday, June 12th, 2025: Quasar RAT;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/12

Quasar RAT Delivered Through Bat FilesXavier is walking you through a quick reverse analysis of a script that will injection code extracted from a PNG image to implement a Quasar RAT. https://isc.sans.edu/diary/Quasar%20RAT%20Delivered%20Through%20Bat%20Files/32036 Delayed Windows 11 24H2 Rollout Microsoft slightly throttled the rollout of windows 11 24H2 due to issues stemming from the patch Tuesday fixes. https://learn.microsoft.com/en-us/windows/release-health/windows-message-center#3570 An

en-us

5:43

SANS Stormcast June, June 9th, 2025: Extracting PNG...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/09

Extracting With pngdump.pyDidier extended his pngdump.py script to make it easier to extract additional data appended to the end of the image file. https://isc.sans.edu/diary/Extracting%20With%20pngdump.py/32022 16 React Native Packages for GlueStack Backdoored Overnight 16 npm packages with over a million weekly downloads between them were compromised. The compromised packages include a remote admin tool that was seen before in similar

en-us

5:26

SANS Stormcast Thursday, June 5th, 2025: Phishing...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/05

Phishing e-mail that hides malicious links from Outlook usersJan found a phishing email that hides the malicious link from Outlook users. The email uses specific HTML comment clauses Outlook interprets to render or not render specific parts of the email s HTML code. Jan suggests that the phishing email is intented to not expose users of https://isc.sans.edu/diary/Phishing%20e-mail%20that%20hides%20malicious%20link%20from%20Outlook%20users/32010 Amazon changing default logging from blocking to

en-us

5:42

SANS Stormcast Monday, May 2nd, 2025: PNG with RAT;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/02

A PNG Image With an Embedded GiftXavier shows how Python code attached to a PNG image can be used to implement a command and control channel or a complete remote admin kit. https://isc.sans.edu/diary/A+PNG+Image+With+an+Embedded+Gift/31998 Cisco IOS XE WLC Arbitrary File Upload Vulnerability (CVE-2025-20188) Analysis Horizon3 analyzed a recently patched flaw in Cisco Wireless Controllers. This arbitrary file upload flaw can easily be used to execute arbitrary

en-us

6:37

SANS Stormcast Wednesday May 28th 2025: Securing...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/28

SSH authorized_keys FileOne of the most common techniques used by many bots is to add rogue keys to the authorized_keys file, implementing an SSH backdoor. Managing these files and detecting unauthorized changes is not hard and should be done if you operate Unix systems. https://isc.sans.edu/diary/Securing%20Your%20SSH%20authorized_keys%20File/31986 REMOTE COMMAND EXECUTION ON SMARTBEDDED METEOBRIDGE (CVE-2025-4008) Weatherstation software Meteobridge suffers from an easily exploitable

en-us

7:13

SANS Stormcast Tuesday, May 27th 2025: SVG...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/27

SVG Steganography Steganography is not only limited to pixel-based images but can be used to embed messages into vector-based formats like SVG. https://isc.sans.edu/diary/SVG%20Steganography/31978 Fortinet Vulnerability Details CVE-2025-32756 Horizon3.ai shows how it was able to find the vulnerability in Fortinet s products, and how to possibly exploit this issue. The vulnerability is already being exploited in the wild and was patched May

en-us

7:54

SANS Stormcast Friday, May 23rd 2025: Backup...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/23

Resilient Secure Backup Connectivity for SMB/Home UsersEstablishing resilient access to a home network via a second ISP may lead to unintended backdoors. Secure the access and make sure you have the visibility needed to detect abuse. https://isc.sans.edu/diary/Resilient%20Secure%20Backup%20Connectivity%20for%20SMB%20Home%20Users/31972 BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory An attacker with the ability to create service accounts may be able to manipulate these

en-us

7:51

SANS Stormcast Wednesday, May 21st 2025: Researchers...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/21

Researchers Scanning the InternetA newish RFC, RFC 9511, suggests researchers identify themselves by adding strings to the traffic they send, or by operating web servers on machines from which the scan originates. We do offer lists of researchers and just added three new groups today https://isc.sans.edu/diary/Researchers%20Scanning%20the%20Internet/31964 Cloudy with a change of Hijacking: Forgotten DNS Records Organizations do not always remove unused CNAME records. An attacker may take

en-us

6:41

SANS Stormcast Tuesday, May 20th 2025: AutoIT Code...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/20

RAT Dropped By Two Layers of AutoIT Code Xavier explains how AutoIT was used to install a remote admin tool (RAT) and how to analyse such a tool https://isc.sans.edu/diary/RAT%20Dropped%20By%20Two%20Layers%20of%20AutoIT%20Code/31960 RVTools compromise confirmed Robware.net, the site behind the popular tool RVTools now confirmed that it was compromised. The site is currently offline. https://www.robware.net/readMore Trojaned Version of Keepass used to install info stealer and Cobalt Strike beacon

en-us

2,081 results

Similar Podcasts

DW Noticias

DW

JIJI English News-時事通信英語ニュース-

時事通信社

Legal AF by MeidasTouch

MeidasTouch Network

Mark Levin Podcast

Cumulus Podcast Network

朝日新聞AJW 英語ニュース（The Asahi Shimbun Asia & Japan Watch）

朝日新聞ポッドキャスト