x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

news tech news

All Episodes

6:40

SANS Stormcast Thursday July 31st, 2025: Firebase...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/31

Securing Firebase: Lessons Re-Learned from the Tea BreachInspried by the breach of the Tea app, Brendon Evans recorded a video to inform of Firebase security issues https://isc.sans.edu/diary/Securing%20Firebase%3A%20Lessons%20Re-Learned%20from%20the%20Tea%20Breach/32158 WebKit Vulnerability Exploited before Apple Patch A WebKit vulnerablity patched by Apple yesterday has already been exploited in Google Chrome. Google noted the exploit with its patch for the same vulnerability in

en-us

5:20

SANS Stormcast Friday, July 25th, 2025: ficheck.py;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/25

New File Integrity Tool: ficheck.pyJim created a new tool, ficheck.py, that can be used to verify file integrity. It is a drop-in replacement for an older tool, fcheck, which was written in Perl and no longer functions well on modern Linux distributions. https://isc.sans.edu/diary/New%20Tool%3A%20ficheck.py/32136 Mitel Vulnerability Mitel released a patch for a vulnerability in its MX-ONE product. The authentication bypass could provide an attacker with user or even admin

en-us

6:17

SANS Stormcast Wednesday, July 23rd, 2025: Sharepoint...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/23

Microsoft Updates SharePoint Vulnerability Guidance CVE-2025-53770 and CVE-2025-53771Microsoft released its update for SharePoint 2016, completing the updates across all currently supported versions. https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ WinZip MotW Privacy Starting with version 7.10, WinZip introduced an option to no longer include the download URL in zip files as part of the Mark of the Web

en-us

6:00

SANS Stormcast Tuesday, July 22nd, 2025: SharePoint...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/22

Microsoft Released Patches for SharePoint Vulnerability CVE-2025-53770 CVE-2025-53771 Microsoft released a patch for the currently exploited SharePoint vulnerability. It also added a second CVE number identifying the authentication bypass vulnerability. https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ How Quickly Are Systems Patched? Jan took Shodan data to check how quickly recent vulnerabilities were patched. The quick answer: Not fast

en-us

8:05

SANS Stormcast Monday July 21st, 2025: Sharepoint...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/07/21

SharePoint Servers Exploited via 0-day CVE-2025-53770Late last week, CodeWhite found a new remote code execution exploit against SharePoint. This vulnerability is now actively exploited. https://isc.sans.edu/diary/Critical+Sharepoint+0Day+Vulnerablity+Exploited+CVE202553770+ToolShell/32122/ Veeam Voicemail Phishing Attackers appear to impersonate VEEAM in recent voicemail-themed phishing attempts. https://isc.sans.edu/diary/Veeam%20Phishing%20via%20Wav%20File/32120 Passkey Phishing Attack A

en-us

7:29

SANS Stormcast Monday June 30th, 2025: Scattered...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/30

Scattered Spider UpdateThe threat actor known as Scattered Spider is in the news again, this time focusing on airlines. But the techniques used by Scattered Spider, social engineering, are still some of the most dangerous techniques used by various threat actors. https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations?e=48754805 AMI BIOS Vulnerability Exploited CVE-2024-54085 A vulnerability in the Redfish remote access software, including AMI s BIOS,

en-us

5:46

SANS Stormcast Friday, June 20th, 2025: New Employee...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/20

How Long Until the Phishing Starts? About Two WeeksAfter setting up a Google Workspace and adding a new user, it took only two weeks for the new employee to receive somewhat targeted phishing emails. https://isc.sans.edu/diary/How%20Long%20Until%20the%20Phishing%20Starts%3F%20About%20Two%20Weeks/32052 Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone numbers Scammers are placing Google ads that point to legitimate companies sites, but are injecting

en-us

6:27

SANS Stormcast Thursday, June 12th, 2025: Quasar RAT;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/12

Quasar RAT Delivered Through Bat FilesXavier is walking you through a quick reverse analysis of a script that will injection code extracted from a PNG image to implement a Quasar RAT. https://isc.sans.edu/diary/Quasar%20RAT%20Delivered%20Through%20Bat%20Files/32036 Delayed Windows 11 24H2 Rollout Microsoft slightly throttled the rollout of windows 11 24H2 due to issues stemming from the patch Tuesday fixes. https://learn.microsoft.com/en-us/windows/release-health/windows-message-center#3570 An

en-us

5:43

SANS Stormcast June, June 9th, 2025: Extracting PNG...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/09

Extracting With pngdump.pyDidier extended his pngdump.py script to make it easier to extract additional data appended to the end of the image file. https://isc.sans.edu/diary/Extracting%20With%20pngdump.py/32022 16 React Native Packages for GlueStack Backdoored Overnight 16 npm packages with over a million weekly downloads between them were compromised. The compromised packages include a remote admin tool that was seen before in similar

en-us

5:26

SANS Stormcast Thursday, June 5th, 2025: Phishing...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/05

Phishing e-mail that hides malicious links from Outlook usersJan found a phishing email that hides the malicious link from Outlook users. The email uses specific HTML comment clauses Outlook interprets to render or not render specific parts of the email s HTML code. Jan suggests that the phishing email is intented to not expose users of https://isc.sans.edu/diary/Phishing%20e-mail%20that%20hides%20malicious%20link%20from%20Outlook%20users/32010 Amazon changing default logging from blocking to

en-us

5:42

SANS Stormcast Monday, May 2nd, 2025: PNG with RAT;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/06/02

A PNG Image With an Embedded GiftXavier shows how Python code attached to a PNG image can be used to implement a command and control channel or a complete remote admin kit. https://isc.sans.edu/diary/A+PNG+Image+With+an+Embedded+Gift/31998 Cisco IOS XE WLC Arbitrary File Upload Vulnerability (CVE-2025-20188) Analysis Horizon3 analyzed a recently patched flaw in Cisco Wireless Controllers. This arbitrary file upload flaw can easily be used to execute arbitrary

en-us

6:37

SANS Stormcast Wednesday May 28th 2025: Securing...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/28

SSH authorized_keys FileOne of the most common techniques used by many bots is to add rogue keys to the authorized_keys file, implementing an SSH backdoor. Managing these files and detecting unauthorized changes is not hard and should be done if you operate Unix systems. https://isc.sans.edu/diary/Securing%20Your%20SSH%20authorized_keys%20File/31986 REMOTE COMMAND EXECUTION ON SMARTBEDDED METEOBRIDGE (CVE-2025-4008) Weatherstation software Meteobridge suffers from an easily exploitable

en-us

7:13

SANS Stormcast Tuesday, May 27th 2025: SVG...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/27

SVG Steganography Steganography is not only limited to pixel-based images but can be used to embed messages into vector-based formats like SVG. https://isc.sans.edu/diary/SVG%20Steganography/31978 Fortinet Vulnerability Details CVE-2025-32756 Horizon3.ai shows how it was able to find the vulnerability in Fortinet s products, and how to possibly exploit this issue. The vulnerability is already being exploited in the wild and was patched May

en-us

7:54

SANS Stormcast Friday, May 23rd 2025: Backup...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/23

Resilient Secure Backup Connectivity for SMB/Home UsersEstablishing resilient access to a home network via a second ISP may lead to unintended backdoors. Secure the access and make sure you have the visibility needed to detect abuse. https://isc.sans.edu/diary/Resilient%20Secure%20Backup%20Connectivity%20for%20SMB%20Home%20Users/31972 BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory An attacker with the ability to create service accounts may be able to manipulate these

en-us

7:51

SANS Stormcast Wednesday, May 21st 2025: Researchers...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/21

Researchers Scanning the InternetA newish RFC, RFC 9511, suggests researchers identify themselves by adding strings to the traffic they send, or by operating web servers on machines from which the scan originates. We do offer lists of researchers and just added three new groups today https://isc.sans.edu/diary/Researchers%20Scanning%20the%20Internet/31964 Cloudy with a change of Hijacking: Forgotten DNS Records Organizations do not always remove unused CNAME records. An attacker may take

en-us

6:41

SANS Stormcast Tuesday, May 20th 2025: AutoIT Code...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/20

RAT Dropped By Two Layers of AutoIT Code Xavier explains how AutoIT was used to install a remote admin tool (RAT) and how to analyse such a tool https://isc.sans.edu/diary/RAT%20Dropped%20By%20Two%20Layers%20of%20AutoIT%20Code/31960 RVTools compromise confirmed Robware.net, the site behind the popular tool RVTools now confirmed that it was compromised. The site is currently offline. https://www.robware.net/readMore Trojaned Version of Keepass used to install info stealer and Cobalt Strike beacon

en-us

6:30

SANS Stormcast Monday, May 18th 2025: xorsearch...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/19

xorsearch.py: Python FunctionsDidier s xorsearch tool now supports python functions to filter output https://isc.sans.edu/diary/xorsearch.py%3A%20Python%20Functions/31858 Pwn2Own Berlin 2025 Last weeks Pwn2Own contest in Berlin allowed researchers to demonstrate a number of new exploits with a large focus on privilege escalation and virtual machine escape. https://www.zerodayinitiative.com/blog/2025/5/17/pwn2own-berlin-2025-day-three-results Senior US Officials Impersonated in Malicious Messaging

en-us

4:57

SANS Stormcast Friday, May 9th: SSH Exfil Tricks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/09

No Internet Access: SSH to the RescueIf faced with restrictive outbound network access policies, a single inbound SSH connection can quickly be turned into a tunnel or a full-blown VPN https://isc.sans.edu/diary/No%20Internet%20Access%3F%20SSH%20to%20the%20Rescue!/31932 SAMSUNG magicINFO 9 Server Flaw Still exploitable The SAMSUNG magicINFO 9 Server Vulnerability we found being exploited last week is apparently still not completely patched, and current versions are vulnerable to the exploit

en-us

5:41

SANS Stormcast Thursday, May 8th: Modular Malware;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/08

Example of Modular MalwareXavier analyzes modular malware that downloads DLLs from GitHub if specific features are required. In particular, the webcam module is inspected in detail. https://isc.sans.edu/diary/Example%20of%20%22Modular%22%20Malware/31928 Sysaid XXE Vulnerabilities IT Service Management Software Sysaid patched a number of XXE vulnerabilities. Without authentication, an attacker is able to obtain confidential data and completely compromise the system. watchTowr published a

en-us

8:51

SANS Stormcast Wednesday, April 30th: SMS Attacks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/30

More Scans for SMS Gateways and APIsAttackers are not just looking for SMS Gateways like the scans we reported on last week, but they are also actively scanning for other ways to use APIs and add on tools to send messages using other people s credentials. https://isc.sans.edu/diary/More%20Scans%20for%20SMS%20Gateways%20and%20APIs/31902 AirBorne: AirPlay Vulnerabilities Researchers at Oligo revealed over 20 weaknesses they found in Apple s implementation of the AirPlay protocol. These

en-us

2,117 results

Similar Podcasts

Expres Ráno

Expres FM

PBS News Hour - Full Show

PBS News

CD Voice

China Daily

Israel Today: Ongoing War Report

Noa Levi

Jeffrey Epstein: The Coverup Chronicles

Bobby Capucci