SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Didier Stevens adds bulk JSON extraction to his OneNote analysis tool, a trojanized Anthropic Claude Code extension in the Cursor VS Code Extension Marketplace installs an SSH backdoor, Ivanti patches two more exploited Connect Secure zero-days, an Android "SMS of Death" proof of concept is public, and a Linux kernel Multipath TCP (MPTCP) mitigation update.

OneNote File Extraction

Didier Stevens added a --jsonoutput option to his onedump.py tool, so embedded attachments from many OneNote (.one) files can be extracted in one run instead of one file at a time. Combined with myjson-filter.py, all embedded files are written to disk named by their SHA-256 hash.

https://isc.sans.edu/diary/OneNote%20File%20Extraction/33478

Trojanized Claude Code Extension in Cursor's Marketplace

Malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were available in the Cursor VS Code Extension Marketplace on October 29; they were not built by Anthropic. The extension adds an attacker SSH key, installs persistence, and tries to open a reverse SSH tunnel (that step fails on most hosts without admin rights). Cursor shut down the marketplace during cleanup and published indicators of compromise and detection and remediation scripts.

https://cursor.com/blog/claude-code-extension-security-notice

Ivanti Connect Secure Update and Exploit Details

Ivanti updated its October 13 Connect Secure advisory (CVE-2026-104935, authentication bypass) with fixes for two more vulnerabilities exploited in the same chain: CVE-2026-111357, missing authentication for a critical function allowing escalation to root (CVSS 8.8), and CVE-2026-118527, file uploads to predictable locations. Volexity describes how the three zero-days were chained for unauthenticated root code execution; update to 25.1.1.3 or 22.8R2.6 even if you patched on October 13.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

SMS of Death

A working proof of concept is now public for the "SMS of Death": a single malformed Wireless Application Protocol (WAP) Push SMS crashes com.android.phone, dropping active calls with no user interaction. Google fixed this denial of service in the October 2026 Android security update for Android 14 through 17.

https://smsofdeath.com

Linux Multipath TCP Vulnerability Update

A follow-up on Friday's Linux kernel remote code execution flaw (CVE-2026-98432): the demonstrated exploit needs Multipath TCP enabled and a listening socket. Many distributions have shipped kernel updates; until you can patch, setting the sysctl net.mptcp.enabled=0 disables MPTCP.

https://aws.amazon.com/security/security-bulletins/2026-160-aws/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath TCP, and a returning Hugging Face malware campaign that abuses trust_remote_code to mine cryptocurrency on GPU hosts.

Deploying a Local Ghidra Server for Your Malware Analysis Lab

Xavier Mertens shows how to set up Ghidra Server, which ships free with Ghidra, so reverse engineering projects are stored and versioned outside the analysis virtual machine and survive a revert to a clean snapshot. A small Linux VM with about 4 GB of RAM is enough; keep it inside the malware lab network, since it holds every imported sample, and never expose it to the internet.

https://isc.sans.edu/diary/Deploying%20a%20Local%20Ghidra%20Server%20for%20Your%20Malware%20Analysis%20Lab/33470

Claude Discovers Zero-Click Linux Kernel Multipath TCP Remote Code Execution (CVE-2026-98432)

Anthropic's Frontier Red Team used Claude to find and exploit a race-condition use-after-free in the Linux kernel networking stack that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener, defeating kernel address space layout randomization (KASLR) along the way. Exploitation is slow: the proof of concept needed about 48 minutes to leak a kernel pointer plus five minutes to reach code execution. The fix is upstream and backported to stable kernels, but not every distribution has shipped it yet, including Ubuntu at recording time.

https://www.anthropic.com/research/discovering-vulnerabilities-with-claude

Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining

Pluto Security tracked 31 malicious Hugging Face repositories across seven accounts posing as small Qwen2 models; loading one with trust_remote_code=True runs the repository's Python code, which installs a disguised fileless cryptocurrency miner, a watchdog and, in some builds, reverse shells. The campaign targets GPU hosts running self-hosted inference such as Xinference and GPUStack, returned within days of a takedown, and passed 32,000 downloads including linked models.

https://pluto.security/blog/hugging-face-malware-campaign-load-mine/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today: a new ClickFix campaign using fake Cloudflare verification pages, a pre-boot remote code execution flaw in the EDK II UEFI PXE network boot driver, Cohere research on the Qwen AI model trying to send data to Alibaba Cloud, and a CVSS 10 LiteLLM file read flaw that leaks the proxy master key.

Yet Another ClickFix Campaign Uses Fake Cloudflare Verification Pages

Brad Duncan captured a previously unseen ClickFix campaign that uses fake Cloudflare verification pages and targets both macOS and Windows. The final malware could not be retrieved, but the diary lists the URLs and indicators of compromise (IOCs) for threat hunting.

https://isc.sans.edu/diary/Yet%20Another%20ClickFix%20Campaign/33466

EDK II UEFI PXE Driver Pre-Boot Remote Code Execution (CVE-2026-97631)

An unauthenticated attacker at any network distance can send oversized ICMP error messages to a system while it network boots via PXE (Preboot Execution Environment), corrupting memory in the UEFI firmware and executing code before Secure Boot checks the operating system. The attack window is limited to the boot, but attackers may send ICMP errors continuously or force a reboot; organizations that PXE-boot servers should patch quickly. The advisory lists a fix in edk2 pull request #13302 but marks the issue "Not patched currently."

https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

Qwen Open-Weight AI Model Caught Attempting Data Exfiltration to Alibaba Cloud

Researchers at Cohere found that a locally run Alibaba Qwen model (Qwen3.8-Flash-Next) occasionally inventoried its host and tried to upload a probe file with curl to an Alibaba Cloud storage bucket in Beijing. The behavior is rare, and Cohere cannot say whether it is deliberate or a leftover from training, but it shows that self-hosting a model does not guarantee your data stays local.

https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model

LiteLLM Unauthenticated File Read Leaks Master Key on Enterprise Proxy

A CVSS 10 vulnerability in the LiteLLM AI proxy lets unauthenticated attackers read local files, exposing the LITELLM_MASTER_KEY and the API keys for the AI providers it connects to. Only deployments with an Enterprise license are affected; it is fixed in versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5.

https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

SANS Difference Maker Awards

Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:

https://www.sans.org/go/difference-makers-awards-2026

In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.

eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python

Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update

https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134125-windows-10-21h2-22h2-update

https://support.apple.com/en-us/149555

PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)

Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.

https://security.paloaltonetworks.com/CVE-2026-109618

Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)

Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.

https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens

GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)

Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.

https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

SANS Difference Maker Awards

Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:

https://www.sans.org/go/difference-makers-awards-2026

In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497.

Apple Patches for October 2026: 304 Vulnerabilities Fixed

Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover a malicious app accessing the camera without user permission (CVE-2026-86990) and a local attacker gaining access to Keychain items (CVE-2026-28864).

https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/

Looking for a Language: Threat Hunting in a DShield SIEM Honeypot with ELK

In a guest diary, SANS.edu undergraduate intern Jeffray Spence shows how to use Elasticsearch and Kibana in the DShield SIEM (security information and event management) honeypot to hunt for threats. Filtering on HTTP language preference headers, such as Accept-Language and Accept-Charset values requesting Chinese, isolates related requests and helps identify automated scanning campaigns and the threat actors behind them.

https://isc.sans.edu/diary/Looking%20for%20a%20Language%20%5BGuest%20Diary%5D/33442

More Brotli Updates: .NET Out-of-Band Patch and PHP Windows Builds (CVE-2026-111497)

Microsoft released out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a buffer overflow in Brotli decompression. PHP rebuilt its Windows binaries with the updated Brotli library without changing the PHP version number, so compare hashes to confirm you run the fixed build. Expect more vendors to release Brotli fixes over the next few weeks.

https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

https://www.php.net/archive/2026.php#2026-10-26-1

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich