SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

User Agent Strings Curiosities

https://isc.sans.edu/diary/User%20Agent%20Strings%20Curiosities/33394

FortiMail Improper limitation of a pathname to a restricted directory CVE-2026-104286

https://fortiguard.fortinet.com/psirt/FG-IR-26-175

Critical GitLab Vulnerability CVE-2026-90970

https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/

Updates to Full Disk Access in macOS

https://developer.apple.com/news/?id=p6zjojqw

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

ScreenConnect Client (Ab)used by Attackers

https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/#comments

Attackers abuse ChatGPT to deliver RAT via ClickFix

https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?_sp=51406044-aa1d-4278-a4e7-adb5b8ef84b2.1790890760100

Spoofing iCloud From Address

https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/

Sender spoofing in Proton Mail via display-name homograph

https://alonsovidales.github.io/protonmail-sender-spoofing/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability CVE-2026-76504

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

WatchGuard AP Command Injection in Internal Management API Allows Command Execution

https://psirt.watchguard.com/CVE-2026-86102/

A Realistic Code Execution Exploit Chain in OpenBao and Vault

https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/

Building a post-quantum certificate authority with Merkle Tree Certificates

https://blog.cloudflare.com/pq-ca-with-mtcs/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Scans for Wordfence Protected Websites

https://isc.sans.edu/diary/Scans%20for%20Wordfence%20Protected%20Websites/33382

MikroTik RouterOS Vulnerability (CVE-2026-84411)

https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06

Poper Blocker: The Adblocker That Spies on You

https://amibeingpwned.com/blog/poper-blocker-the-adblocker-that-spies-on-you

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950)

https://isc.sans.edu/diary/Apple%20Emergency%20Patch%20for%20iOS%2026%2C%20macOS26%2C%20macOS15%20%28CVE-2026-86950%29/33376

https://support.apple.com/en-us/100100

Proof of concept for macOS CoreServices Priv. Escalation (CVE-2026-43786)

https://github.com/Malwation/CVE-2026-43786

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/

File Notification Attacks https://inoti.fyi/pubs/file-notification-attacks.pdf

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich