x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

news tech news

All Episodes

5:43

SANS Stormcast June, June 9th, 2025: Extracting PNG...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/09

Extracting With pngdump.pyDidier extended his pngdump.py script to make it easier to extract additional data appended to the end of the image file. https://isc.sans.edu/diary/Extracting%20With%20pngdump.py/32022 16 React Native Packages for GlueStack Backdoored Overnight 16 npm packages with over a million weekly downloads between them were compromised. The compromised packages include a remote admin tool that was seen before in similar

en-us

5:26

SANS Stormcast Thursday, June 5th, 2025: Phishing...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/05

Phishing e-mail that hides malicious links from Outlook usersJan found a phishing email that hides the malicious link from Outlook users. The email uses specific HTML comment clauses Outlook interprets to render or not render specific parts of the email s HTML code. Jan suggests that the phishing email is intented to not expose users of https://isc.sans.edu/diary/Phishing%20e-mail%20that%20hides%20malicious%20link%20from%20Outlook%20users/32010 Amazon changing default logging from blocking to

en-us

5:42

SANS Stormcast Monday, May 2nd, 2025: PNG with RAT;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/02

A PNG Image With an Embedded GiftXavier shows how Python code attached to a PNG image can be used to implement a command and control channel or a complete remote admin kit. https://isc.sans.edu/diary/A+PNG+Image+With+an+Embedded+Gift/31998 Cisco IOS XE WLC Arbitrary File Upload Vulnerability (CVE-2025-20188) Analysis Horizon3 analyzed a recently patched flaw in Cisco Wireless Controllers. This arbitrary file upload flaw can easily be used to execute arbitrary

en-us

6:37

SANS Stormcast Wednesday May 28th 2025: Securing...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/28

SSH authorized_keys FileOne of the most common techniques used by many bots is to add rogue keys to the authorized_keys file, implementing an SSH backdoor. Managing these files and detecting unauthorized changes is not hard and should be done if you operate Unix systems. https://isc.sans.edu/diary/Securing%20Your%20SSH%20authorized_keys%20File/31986 REMOTE COMMAND EXECUTION ON SMARTBEDDED METEOBRIDGE (CVE-2025-4008) Weatherstation software Meteobridge suffers from an easily exploitable

en-us

7:13

SANS Stormcast Tuesday, May 27th 2025: SVG...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/27

SVG Steganography Steganography is not only limited to pixel-based images but can be used to embed messages into vector-based formats like SVG. https://isc.sans.edu/diary/SVG%20Steganography/31978 Fortinet Vulnerability Details CVE-2025-32756 Horizon3.ai shows how it was able to find the vulnerability in Fortinet s products, and how to possibly exploit this issue. The vulnerability is already being exploited in the wild and was patched May

en-us

7:54

SANS Stormcast Friday, May 23rd 2025: Backup...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/23

Resilient Secure Backup Connectivity for SMB/Home UsersEstablishing resilient access to a home network via a second ISP may lead to unintended backdoors. Secure the access and make sure you have the visibility needed to detect abuse. https://isc.sans.edu/diary/Resilient%20Secure%20Backup%20Connectivity%20for%20SMB%20Home%20Users/31972 BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory An attacker with the ability to create service accounts may be able to manipulate these

en-us

7:51

SANS Stormcast Wednesday, May 21st 2025: Researchers...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/21

Researchers Scanning the InternetA newish RFC, RFC 9511, suggests researchers identify themselves by adding strings to the traffic they send, or by operating web servers on machines from which the scan originates. We do offer lists of researchers and just added three new groups today https://isc.sans.edu/diary/Researchers%20Scanning%20the%20Internet/31964 Cloudy with a change of Hijacking: Forgotten DNS Records Organizations do not always remove unused CNAME records. An attacker may take

en-us

6:41

SANS Stormcast Tuesday, May 20th 2025: AutoIT Code...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/20

RAT Dropped By Two Layers of AutoIT Code Xavier explains how AutoIT was used to install a remote admin tool (RAT) and how to analyse such a tool https://isc.sans.edu/diary/RAT%20Dropped%20By%20Two%20Layers%20of%20AutoIT%20Code/31960 RVTools compromise confirmed Robware.net, the site behind the popular tool RVTools now confirmed that it was compromised. The site is currently offline. https://www.robware.net/readMore Trojaned Version of Keepass used to install info stealer and Cobalt Strike beacon

en-us

6:30

SANS Stormcast Monday, May 18th 2025: xorsearch...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/19

xorsearch.py: Python FunctionsDidier s xorsearch tool now supports python functions to filter output https://isc.sans.edu/diary/xorsearch.py%3A%20Python%20Functions/31858 Pwn2Own Berlin 2025 Last weeks Pwn2Own contest in Berlin allowed researchers to demonstrate a number of new exploits with a large focus on privilege escalation and virtual machine escape. https://www.zerodayinitiative.com/blog/2025/5/17/pwn2own-berlin-2025-day-three-results Senior US Officials Impersonated in Malicious Messaging

en-us

4:57

SANS Stormcast Friday, May 9th: SSH Exfil Tricks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/09

No Internet Access: SSH to the RescueIf faced with restrictive outbound network access policies, a single inbound SSH connection can quickly be turned into a tunnel or a full-blown VPN https://isc.sans.edu/diary/No%20Internet%20Access%3F%20SSH%20to%20the%20Rescue!/31932 SAMSUNG magicINFO 9 Server Flaw Still exploitable The SAMSUNG magicINFO 9 Server Vulnerability we found being exploited last week is apparently still not completely patched, and current versions are vulnerable to the exploit

en-us

5:41

SANS Stormcast Thursday, May 8th: Modular Malware;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/08

Example of Modular MalwareXavier analyzes modular malware that downloads DLLs from GitHub if specific features are required. In particular, the webcam module is inspected in detail. https://isc.sans.edu/diary/Example%20of%20%22Modular%22%20Malware/31928 Sysaid XXE Vulnerabilities IT Service Management Software Sysaid patched a number of XXE vulnerabilities. Without authentication, an attacker is able to obtain confidential data and completely compromise the system. watchTowr published a

en-us

8:51

SANS Stormcast Wednesday, April 30th: SMS Attacks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/30

More Scans for SMS Gateways and APIsAttackers are not just looking for SMS Gateways like the scans we reported on last week, but they are also actively scanning for other ways to use APIs and add on tools to send messages using other people s credentials. https://isc.sans.edu/diary/More%20Scans%20for%20SMS%20Gateways%20and%20APIs/31902 AirBorne: AirPlay Vulnerabilities Researchers at Oligo revealed over 20 weaknesses they found in Apple s implementation of the AirPlay protocol. These

en-us

7:37

SANS Stormcast Tuesday, April 29th: SRUM-DUMP 3;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/29

SRUM-DUMP Version 3: Uncovering Malware Activity in Forensics Mark Baggett released SRUM-DUMP Version 3. The tool simplifies data extraction from Widnows System Resource Usage Monitor (SRUM). This database logs how much resources software used for 30 days, and is invaluable to find out what software was executed when and if it sent or received network data. https://isc.sans.edu/diary/SRUM-DUMP%20Version%203%3A%20Uncovering%20Malware%20Activity%20in%20Forensics/31896 Novel Universal Bypass For

en-us

7:55

SANS Stormcast Monday, April 28th: Image...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/28

Example of a Payload Delivered Through SteganographyXavier and Didier published two diaries this weekend, building on each other. First, Xavier showed an example of an image being used to smuggle an executable past network defenses, and second, Didier showed how to use his tools to extract the binary. https://isc.sans.edu/diary/Example%20of%20a%20Payload%20Delivered%20Through%20Steganography/31892 SAP Netweaver Exploited CVE-2025-31324 An arbitrary file upload vulnerability in SAP s Netweaver

en-us

5:54

SANS Stormcast Wednesday Apr 16th: File Upload...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/16

Online Services Again Abused to Exfiltrate DataAttackers like to abuse free online services that can be used to exfiltrate data. From the originals , like pastebin, to past favorites like anonfiles.com. The latest example is gofile.io. As a defender, it is important to track these services to detect exfiltration early https://isc.sans.edu/diary/Online%20Services%20Again%20Abused%20to%20Exfiltrate%20Data/31862 OpenSSH 10.0 Released OpenSSH 10.0 was released. This release adds quantum-safe

en-us

5:35

SANS Stormcast Tuesday April 15th: xorsearch Update;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/15

xorsearch Update Diedier updated his "xorsearch" tool. It is now a python script, not a compiled binary, and supports Yara signatures. With Yara support also comes support for regular expressions. https://isc.sans.edu/diary/xorsearch.py%3A%20Searching%20With%20Regexes/31854 Shorter Lived Certificates The CA/Brower Forum passed an update to reduce the maximum livetime of certificates. The reduction will be implemented over the next four years. EFF also released an update to certbot introducing

en-us

7:07

SANS Stormcast Monday April 14th: Langlow AI Attacks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/14

Exploit Attempts for Recent Langflow AI Vulnerability (CVE-2025-3248) After spotting individaul attempts to exploit the recent Langflow vulnerability late last weeks, we now see more systematic internet wide scans attempting to verify the vulnerability. https://isc.sans.edu/forums/diary/Exploit+Attempts+for+Recent+Langflow+AI+Vulnerability+CVE20253248/31850/ Fortinet Analysis of Threat Actor Activity Fortinet oberved recent vulnerablities in its devices being used to add a symlink to ease future

en-us

5:34

SANS Stormcast Friday April 11th: Network...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/11

Network InfraxploitOur undergraduate intern, Matthew Gorman, wrote up a walk through of CVE-2018-0171, an older Cisco vulnerability, that is still actively being exploited. For example, VOLT TYPHOON recently exploited this problem. https://isc.sans.edu/diary/Network+Infraxploit+Guest+Diary/31844 Windows Update Issues / Windows 10 Update Microsoft updated its "Release Health" notes with details regarding issues users experiences with Windows Hello, Citrix, and Roblox. Microsoft also released

en-us

6:18

SANS Stormcast Tuesday, April 8th:

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/08

XORsearch: Searching With RegexesDidier explains a workaround to use his tool XORsearch to search for regular expressions instead of simple strings. https://isc.sans.edu/diary/XORsearch%3A%20Searching%20With%20Regexes/31834 MCP Security Notification: Tool Poisoning Attacks Invariant labs summarized a critical weakness in the Model Context Protocol (MCP) that allows for "Tool Poisoning Attacks." Many major providers such as Anthropic and OpenAI, workflow automation systems like Zapier, and MCP

en-us

9:23

SANS Stormcast Thursday Apr 3rd: Juniper Password...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/03

Surge in Scans for Juniper t128 Default UserLasst week, we dedtect a significant surge in ssh scans for the username t128 . This user is used by Juniper s Session Smart Routing, a product they acquired from 128 Technologies which is the reason for the somewhat unusual username. https://isc.sans.edu/diary/Surge%20in%20Scans%20for%20Juniper%20%22t128%22%20Default%20User/31824 Vulnerable Verizon API Allowed for Access to Call Logs An API Verizon offered to users of its call filtering

en-us

2,089 results

Similar Podcasts

DW Noticias

DW

JIJI English News-時事通信英語ニュース-

時事通信社

Legal AF by MeidasTouch

MeidasTouch Network

Mark Levin Podcast

Cumulus Podcast Network

朝日新聞AJW 英語ニュース（The Asahi Shimbun Asia & Japan Watch）

朝日新聞ポッドキャスト