Linux Trojan - Xorddos with Filename eyshcjdmzg <a href="https://isc.sans.edu/diary/Linux%20Trojan%20-%20Xorddos%20with%20Filename%20eyshcjdmzg/30880">https://isc.sans.edu/diary/Linux%20Trojan%20-%20Xorddos%20with%20Filename%20eyshcjdmzg/30880</a> AWS S3 Denial of Wallet Amplification Attack <a href="https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1">https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1</a> <a href="https://blog.limbus-medtec.com/the-aws-s3-denial-of-wallet-amplification-attack-bc5a97cc041d">https://blog.limbus-medtec.com/the-aws-s3-denial-of-wallet-amplification-attack-bc5a97cc041d</a> EU iOS Safari Allows User Tracking <a href="https://www.mysk.blog/2024/04/28/safari-tracking/">https://www.mysk.blog/2024/04/28/safari-tracking/</a> BentoML Critical Deserialization Vuln CVE-2024-2912 <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-2912">https://nvd.nist.gov/vuln/detail/CVE-2024-2912</a>

Linux Trojan; Denial of Wallet Attack; EU iOS Appstore User Tracking; BentoML Vuln;

ISC StormCast for Thursday, May 2nd, 2024

Another Day, Another NAS: Attacks against Zyxel NAS326 Devices CVE-2023-4473, CVE-2023-4474 <a href="https://isc.sans.edu/diary/Another%20Day%2C%20Another%20NAS%3A%20Attacks%20against%20Zyxel%20NAS326%20devices%20CVE-2023-4473%2C%20CVE-2023-4474/30884">https://isc.sans.edu/diary/Another%20Day%2C%20Another%20NAS%3A%20Attacks%20against%20Zyxel%20NAS326%20devices%20CVE-2023-4473%2C%20CVE-2023-4474/30884</a> R-Bitrary Code Execution: Vulnearbility in R's Deserialization <a href="https://hiddenlayer.com/research/r-bitrary-code-execution/">https://hiddenlayer.com/research/r-bitrary-code-execution/</a> Coordinated Docker Hub Attacks using Malicious Repositories <a href="https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/">https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/</a> NVMe-oF/TCP Vulnerabilities <a href="https://www.cyberark.com/resources/threat-research-blog/your-nvme-had-been-syzed-fuzzing-nvme-of-tcp-driver-for-linux-with-syzkaller">https://www.cyberark.com/resources/threat-research-blog/your-nvme-had-been-syzed-fuzzing-nvme-of-tcp-driver-for-linux-with-syzkaller</a>

Zyxel NAS Attacks; R Vulnerability; Malicious Containers; NVMe-oF/TCP Vulns;

ISC StormCast for Wednesday, May 1st, 2024

DLink NAS Exploit Variation <a href="https://www.qnap.com/en/security-advisory/qsa-24-09">https://www.qnap.com/en/security-advisory/qsa-24-09</a> Muddling Meerkat DNS Abuse <a href="https://blogs.infoblox.com/threat-intelligence/a-cunning-operator-muddling-meerkat-and-chinas-great-firewall/">https://blogs.infoblox.com/threat-intelligence/a-cunning-operator-muddling-meerkat-and-chinas-great-firewall/</a> Android TV Data Leakage <a href="https://www.youtube.com/watch?v=QiyBXXO8QpA">https://www.youtube.com/watch?v=QiyBXXO8QpA</a> <a href="https://www.404media.co/android-tvs-can-expose-user-email-inboxes/">https://www.404media.co/android-tvs-can-expose-user-email-inboxes/</a> SEC522: SANSFIRE <a href="https://www.sans.org/cyber-security-courses/application-security-securing-web-apps-api-microservices/">https://www.sans.org/cyber-security-courses/application-security-securing-web-apps-api-microservices/</a> SEC522 Demo (requires free account): <a href="https://www.sans.org/ondemand/get-demo/316">https://www.sans.org/ondemand/get-demo/316</a>

DLink NAS Exploit Variation; DNS and Great Firewall of China; Android TV Data Leakage

ISC StormCast for Tuesday, April 30th, 2024

Okta warns of increase in credential stuffing <a href="https://sec.okta.com/blockanonymizers">https://sec.okta.com/blockanonymizers</a> Fake payment cards used by Police in Japan <a href="https://twitter.com/vxunderground/status/1783522097425211887">https://twitter.com/vxunderground/status/1783522097425211887</a> Phishing Campaigns Targeting USPS <a href="https://www.akamai.com/blog/security-research/phishing-usps-malicious-domains-traffic-equal-to-legitimate-traffic">https://www.akamai.com/blog/security-research/phishing-usps-malicious-domains-traffic-equal-to-legitimate-traffic</a> Chrome 124 Breaks TLS Handshake <a href="https://www.reddit.com/r/sysadmin/comments/1carvpd/chrome_124_breaks_tls_handshake/">https://www.reddit.com/r/sysadmin/comments/1carvpd/chrome_124_breaks_tls_handshake/</a>

Credential Stuffing Increase; Fake Payment Cards; USPS Phishing; Chrome Post Quantum TLS Issues;

ISC StormCast for Monday, April 29th, 2024

Does it matter if iptables isn't running on my honeypot? <a href="https://isc.sans.edu/forums/diary/Does%20it%20matter%20if%20iptables%20isn't%20running%20on%20my%20honeypot%3F/30862/">https://isc.sans.edu/forums/diary/Does%20it%20matter%20if%20iptables%20isn't%20running%20on%20my%20honeypot%3F/30862/</a> Unplugging PlugX: Singholing the PlugX USB worm botnet <a href="https://blog.sekoia.io/unplugging-plugx-sinkholing-the-plugx-usb-worm-botnet/">https://blog.sekoia.io/unplugging-plugx-sinkholing-the-plugx-usb-worm-botnet/</a> pfSense Updates <a href="https://docs.netgate.com/advisories/index.html">https://docs.netgate.com/advisories/index.html</a> GitLab Updates <a href="https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/">https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/</a> Matthew Alan Vorhees: Prevention Strategies for Modern Living Off the Land Usage <a href="https://www.sans.edu/cyber-research/prevention-strategies-modern-living-off-land-usage/">https://www.sans.edu/cyber-research/prevention-strategies-modern-living-off-land-usage/</a>

Honeypot Firewalls; Unplugging PlugX; pfsense and GitLab Updates; Blocking LOLBins @sans_edu

ISC StormCast for Friday, April 26th, 2024

API Rug Pull - The NIST NVD Database and API <a href="https://isc.sans.edu/diary/API%20Rug%20Pull%20-%20The%20NIST%20NVD%20Database%20and%20API%20%28Part%204%20of%203%29/30868">https://isc.sans.edu/diary/API%20Rug%20Pull%20-%20The%20NIST%20NVD%20Database%20and%20API%20%28Part%204%20of%203%29/30868</a> Cisco Patches Vulnerabilities and Discovers Arcane Backdoor <a href="https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/">https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/</a> Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers <a href="https://citizenlab.ca/2024/04/vulnerabilities-across-keyboard-apps-reveal-keystrokes-to-network-eavesdroppers/">https://citizenlab.ca/2024/04/vulnerabilities-across-keyboard-apps-reveal-keystrokes-to-network-eavesdroppers/</a> MySQL2: Dangers of User-Defined Database Connections <a href="https://blog.slonser.info/posts/mysql2-attacker-configuration/">https://blog.slonser.info/posts/mysql2-attacker-configuration/</a> Netgear Nighthawk Vulnerabilities <a href="https://jvn.jp/en/vu/JVNVU91883072/">https://jvn.jp/en/vu/JVNVU91883072/</a>

NVD API Updates; Cisco Patches and Backdoor; Keyboard App Vulns; node-mysql2 vulns;

ISC StormCast for Thursday, April 25th, 2024

Struts2 devmode Still a Problem Ten Years Later <a href="https://isc.sans.edu/forums/diary/Struts%20%22devmode%22%3A%20Still%20a%20problem%20ten%20years%20later%3F/30866/">https://isc.sans.edu/forums/diary/Struts%20%22devmode%22%3A%20Still%20a%20problem%20ten%20years%20later%3F/30866/</a> Analyzing Forest Blizard's Custom Post-Compromise Tool for exploiting CVE-2022-38028 <a href="https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/">https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/</a> April 2024 Exchange Server Hotfix Update <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/released-april-2024-exchange-server-hotfix-updates/ba-p/4120536">https://techcommunity.microsoft.com/t5/exchange-team-blog/released-april-2024-exchange-server-hotfix-updates/ba-p/4120536</a> CVE-2024-2389: Command Injection Vulnerability in Progress Flowmon <a href="https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/">https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/</a> GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual Mining <a href="https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/">https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/</a>

struts2 devmode scans; Russian PrinterNightmare; Exchange Server Fix; Flowmon Exploit; GuptiMiner;

ISC StormCast for Wednesday, April 24th, 2024

Number of Industrial Devices Accessible From Internet Up 30 Thousand over three years <a href="https://isc.sans.edu/diary/It%20appears%20that%20the%20number%20of%20industrial%20devices%20accessible%20from%20the%20internet%20has%20risen%20by%2030%20thousand%20over%20the%20past%20three%20years/30860">https://isc.sans.edu/diary/It%20appears%20that%20the%20number%20of%20industrial%20devices%20accessible%20from%20the%20internet%20has%20risen%20by%2030%20thousand%20over%20the%20past%20three%20years/30860</a> Evil XDR: Turning an XDR into an Offensive Tool <a href="https://www.darkreading.com/application-security/evil-xdr-researcher-turns-palo-alto-software-into-perfect-malware">https://www.darkreading.com/application-security/evil-xdr-researcher-turns-palo-alto-software-into-perfect-malware</a> GitLab Comment Bug <a href="https://www.bleepingcomputer.com/news/security/gitlab-affected-by-github-style-cdn-flaw-allowing-malware-hosting/">https://www.bleepingcomputer.com/news/security/gitlab-affected-by-github-style-cdn-flaw-allowing-malware-hosting/</a> SEC522 Demo: <a href="https://www.sans.org/ondemand/get-demo/316">https://www.sans.org/ondemand/get-demo/316</a>

Exposed ICS; Evil XDR; GitLab Comment Bug;

ISC StormCast for Tuesday, April 23rd, 2024

The CVE's They are A-Changing <a href="https://isc.sans.edu/diary/The%20CVE%27s%20They%20are%20A-Changing!/30850">https://isc.sans.edu/diary/The%20CVE%27s%20They%20are%20A-Changing!/30850</a> CrushFTP 0-Day Vulnerability <a href="https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update">https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update</a> <a href="https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/">https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/</a> GitHub Comment Bug Used to Distribute Malware <a href="https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/">https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/</a> YubiKey Manager Privilege Escalation <a href="https://www.yubico.com/support/security-advisories/ysa-2024-01/">https://www.yubico.com/support/security-advisories/ysa-2024-01/</a> Palo Alto Networks GlobalProtect Update <a href="https://security.paloaltonetworks.com/CVE-2024-3400">https://security.paloaltonetworks.com/CVE-2024-3400</a>

CVE Changes; CrushFTP 0-Day; GitHub Comment Bug; YubiKey Manager Bug; PAN GlobalProtect Update

ISC StormCast for Monday, April 22nd, 2024

Delinea Secret Server Authn Authz Bypass <a href="https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3">https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3</a> Ivanti Avalanche Poc/Details <a href="https://www.tenable.com/security/research/tra-2024-10">https://www.tenable.com/security/research/tra-2024-10</a> Advanced Phishing Campaign <a href="https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit">https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit</a> Hashicorp go-getter update CVE-2024-3817 <a href="https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040">https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040</a> OfflRouter Virus <a href="https://blog.talosintelligence.com/offlrouter-virus-causes-upload-confidential-documents-to-virustotal/">https://blog.talosintelligence.com/offlrouter-virus-causes-upload-confidential-documents-to-virustotal/</a>

Delinea PoC; Ivanti Avalanche PoC; Advanced Phishing Campaign; go-getter update; OfflRouter Virus

ISC StormCast for Friday, April 19th, 2024

Malicious PDF File As Delivery Mechanism <a href="https://isc.sans.edu/diary/Malicious%20PDF%20File%20Used%20As%20Delivery%20Mechanism/30848">https://isc.sans.edu/diary/Malicious%20PDF%20File%20Used%20As%20Delivery%20Mechanism/30848</a> Updated Palo Alto Networks GlobalProtect Guidance <a href="https://security.paloaltonetworks.com/CVE-2024-3400">https://security.paloaltonetworks.com/CVE-2024-3400</a> Coordinated Social Engineering Takeovers of Open Source Projects; <a href="https://openssf.org/blog/2024/04/15/open-source-security-openssf-and-openjs-foundations-issue-alert-for-social-engineering-takeovers-of-open-source-projects/">https://openssf.org/blog/2024/04/15/open-source-security-openssf-and-openjs-foundations-issue-alert-for-social-engineering-takeovers-of-open-source-projects/</a> OpenMetaData Attacks <a href="https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/">https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/</a>

AgentTesla via PDF; GlobalProtect Updates; Open Source Takeovers; OpenMetaData Attacks

ISC StormCast for Thursday, April 18th, 2024

Palo Alto Networks GlobalProtect exploit public and widely exploited CVE-2024-3400 <a href="https://isc.sans.edu/forums/diary/Palo%20Alto%20Networks%20GlobalProtect%20exploit%20public%20and%20widely%20exploited%20CVE-2024-3400/30844/">https://isc.sans.edu/forums/diary/Palo%20Alto%20Networks%20GlobalProtect%20exploit%20public%20and%20widely%20exploited%20CVE-2024-3400/30844/</a> Putty Private Key Recovery <a href="https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html">https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html</a> Oracle Critical Patch Update <a href="https://www.oracle.com/security-alerts/cpuapr2024.html">https://www.oracle.com/security-alerts/cpuapr2024.html</a> Ivanti Avalanche MDM Patches <a href="https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US">https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US</a>

GlobalProtect Exploit Public; Putty Private Key Vuln;

ISC StormCast for Wednesday, April 17th, 2024

Quick Palo Alto Networks Global Protect Vulnerablity Update CVE-2024-3400 <a href="https://isc.sans.edu/diary/30838">https://isc.sans.edu/diary/30838</a> Delinea patches critical vulnerability in secret manager <a href="https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3">https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3</a> Lancom Windows Setup Assistant May Reset Password <a href="https://www.lancom-systems.com/service-support/general-security-information">https://www.lancom-systems.com/service-support/general-security-information</a> PHP Patches <a href="https://seclists.org/oss-sec/2024/q2/113">https://seclists.org/oss-sec/2024/q2/113</a> Duo SMS and VoiP Logs Leaked <a href="https://app.securitymsp.cisco.com/e/es?e=2785&eid=opguvrs&elq=bd1c1886a59e40c09915b029a74be94e">https://app.securitymsp.cisco.com/e/es?e=2785&eid=opguvrs&elq=bd1c1886a59e40c09915b029a74be94e</a> Lastpass Stops Deepfake Attack <a href="https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee">https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee</a>

GlobalProtect Updates; Delinea Patch; Lancom PW reset; PHP Patch; Duo leak; LastPass Deepfake

ISC StormCast for Tuesday, April 16th, 2024

Palo Alto Networks GlobalProtect 0-Day CVE-2024-3400 <a href="https://security.paloaltonetworks.com/CVE-2024-3400">https://security.paloaltonetworks.com/CVE-2024-3400</a> <a href="https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/#RespondingToCompromise">https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/#RespondingToCompromise</a>

Palo Alto Networks GlobalProtect 0-Day Vulnerability Exploited

ISC StormCast for Sunday, April 14th, 2024

BatBadBut: You can't securely execute commands on Windows <a href="https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/">https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/</a> FortiClient Linux Remote Code Execution <a href="https://www.fortiguard.com/psirt/FG-IR-23-087">https://www.fortiguard.com/psirt/FG-IR-23-087</a> Apple Threat Notifications and Protecting Against Mercenary Spyware <a href="https://support.apple.com/en-us/102174">https://support.apple.com/en-us/102174</a> New Technique to Trick Developers Detected in an Open Source Supply Chain Attack <a href="https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/">https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/</a>

BatBadBut Vulnerability; FortiClient Linux RCE; Apple Notifications; GitHub Search Tricks;

ISC StormCast for Friday, April 12th, 2024

Rust Command API code execution vulnerability CVE-2024-24576 <a href="https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html">https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html</a> Adobe Updates: Magento Adobe Commerce CVE-2024-20759 CVE-2024-20758 <a href="https://helpx.adobe.com/security/products/magento/apsb24-18.html">https://helpx.adobe.com/security/products/magento/apsb24-18.html</a> <a href="https://helpx.adobe.com/security.html">https://helpx.adobe.com/security.html</a> Fortinet FortiOS And FortiProxy Vulnerability CVE-2023-41677 <a href="https://www.fortiguard.com/psirt/FG-IR-23-493">https://www.fortiguard.com/psirt/FG-IR-23-493</a> Smoke and Screen Mirrors Signed Backdoor CVE-2024-26234 <a href="https://news.sophos.com/en-us/2024/04/09/smoke-and-screen-mirrors-a-strange-signed-backdoor/">https://news.sophos.com/en-us/2024/04/09/smoke-and-screen-mirrors-a-strange-signed-backdoor/</a>

Rust Vulnerability; Adobe Updates; Fortinet Patches; Malicious Windows Driver

ISC StormCast for Thursday, April 11th, 2024

Microsoft Patches <a href="https://isc.sans.edu/forums/diary/April%202024%20Microsoft%20Patch%20Tuesday%20Summary/30822/">https://isc.sans.edu/forums/diary/April%202024%20Microsoft%20Patch%20Tuesday%20Summary/30822/</a> D-Link NAS Backdoor <a href="https://github.com/netsecfish/dlink">https://github.com/netsecfish/dlink</a> LG SmartTV Vulnerabilities <a href="https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/">https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/</a>

Microsoft Patches; D-Link NAS Backdoor; LG WebOS TV Vulnerabilities

ISC StormCast for Wednesday, April 10th, 2024

A Use Case for Adding Threat Hunting to Your Security Operations Team. <a href="https://isc.sans.edu/diary/30816">https://isc.sans.edu/diary/30816</a> Notepad++ Parasite Site <a href="https://notepad-plus-plus.org/news/help-to-take-down-parasite-site/">https://notepad-plus-plus.org/news/help-to-take-down-parasite-site/</a> Hugging Face Pickle File Vulnerablities <a href="https://huggingface.co/blog/hugging-face-wiz-security-blog">https://huggingface.co/blog/hugging-face-wiz-security-blog</a> Google Considers V8 Sandbox no longer experimental <a href="https://v8.dev/blog/sandbox">https://v8.dev/blog/sandbox</a>

Why Threat Hunting; Notepad++ Domain Issue; Pickle ML Vulns; V8 Sandbox

ISC StormCast for Tuesday, April 9th, 2024

Heartbleed 10th Anniversary <a href="https://heartbleed.com/">https://heartbleed.com/</a> Possible Libarchive Backdoor Vulnerability <a href="https://github.com/libarchive/libarchive/pull/1609">https://github.com/libarchive/libarchive/pull/1609</a> Magento XML Backdoor <a href="https://sansec.io/research/magento-xml-backdoor">https://sansec.io/research/magento-xml-backdoor</a> Google Public DNS's approach to fight against cache poisoning attacks <a href="https://security.googleblog.com/2024/03/google-public-dnss-approach-to-fight.html">https://security.googleblog.com/2024/03/google-public-dnss-approach-to-fight.html</a> Remote code execution (RCE)vulnerability in Brocade Fabric OS (CVE-2023-3454) <a href="https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23215">https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23215</a> SANS London April Evening Talk <a href="https://sans.zoom.us/webinar/register/WN_ZLLnQKCCQCywLGm-CM4xQg#/registration">https://sans.zoom.us/webinar/register/WN_ZLLnQKCCQCywLGm-CM4xQg#/registration</a>

Heartbleed 10th Anniversary; Magento Backdoor; Fighting DNS Spoofing; Brocade Vuln; @sans_emea evening talk

ISC StormCast for Monday, April 8th, 2024

Slicing up DoNex with Binary Ninja <a href="https://isc.sans.edu/diary/Slicing%20up%20DoNex%20with%20Binary%20Ninja/30812">https://isc.sans.edu/diary/Slicing%20up%20DoNex%20with%20Binary%20Ninja/30812</a> HTTP/2 Continuation Flood <a href="https://nowotarski.info/http2-continuation-flood-technical-details/">https://nowotarski.info/http2-continuation-flood-technical-details/</a> Dangers of CSS in HTML Email <a href="https://lutrasecurity.com/en/articles/kobold-letters/">https://lutrasecurity.com/en/articles/kobold-letters/</a> Dan Mazzella: Infostealers in Automotive Headunits <a href="https://www.sans.edu/cyber-research/exploring-infostealer-malware-techniques-automotive-head-units/">https://www.sans.edu/cyber-research/exploring-infostealer-malware-techniques-automotive-head-units/</a>

Reversing DoNex; HTTP/2 Continuation Flood; Kobold Letters; Infostealers in Automotive Headunits @sans_edu

ISC StormCast for Friday, April 5th, 2024

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

About

Episodes