SANS Stormcast: Daily Cyber Security News

_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary]https://isc.sans.edu/diary/_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_%20%5BGuest%20Diary%5D/33130 Apple Discontinuing Support for Encrypted Mac OS Extended disks in macOS 28https://support.apple.com/en-us/125615 Google Chrome Updatehttps://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html Microsoft Patches Rogue Pla...

My Stack Simulator https://isc.sans.edu/diary/My%20Stack%20Simulator/33138 RootAsRolehttps://github.com/LeChatP/RootAsRole Hoymiles Inverter Vulnerabilityhttps://www.ccc.de/system/uploads/382/original/hoymiles_dtu_vuln.pdf Git Hash Chain Malleabilityhttps://arxiv.org/abs/2607.02820 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich

More Odd DNS Records: NIMLOChttps://isc.sans.edu/diary/More%20Odd%20DNS%20Records%3A%20NIMLOC/33128 From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting Russian Aerospace Organizations https://www.seqrite.com/blog/from-invoice-to-anydesk-uncovering-a-phishing-campaign-targeting-russian-aerospace-organizations/ Tenda firmware (multiple versions) contains hidden authentication backdoorh...

RCS and DNS: The NAPTR Recordhttps://isc.sans.edu/diary/RCS%20and%20DNS%3A%20The%20NAPTR%20Record/33124 OpenSSH 10.4 releasedhttps://seclists.org/oss-sec/2026/q3/62 Beyond Trust Advisory CVE-2026-40138 CVE-2026-40139https://www.beyondtrust.com/trust-center/security-advisories/bt26-03 PolinRider: North Korea-Linked Supply Chain Campaignhttps://socket.dev/blog/polinrider-north-korea-linked-supply-ch...

Apple Updated Patch Policyhttps://www.reuters.com/business/apple-says-it-is-releasing-updates-early-response-ai-cybersecurity-concerns-2026-06-29/ T3MP3ST multi-agent offensive-security frameworkhttps://github.com/elder-plinius/T3MP3ST Seven FatFs bugs, one very large blast radiushttps://www.runzero.com/blog/fatfs-bugs/ OpenWRT Releases v25.12.5https://github.com/openwrt/openwrt/releases My Upcomi...

Why Ask Credentials If There Are Secret Codes?https://isc.sans.edu/diary/Why%20Ask%20Credentials%20If%20There%20Are%20Secret%20Codes%3F/33118 Adobe Patches and Updated Patch Release Policyhttps://helpx.adobe.com/security/Home.htmlhttps://blog.adobe.com/security/protecting-customers-faster-how-adobe-is-responding-to-ai-accelerated-vulnerability-discovery Google Chrome Update (link had issues loadin...

June 2026 Apple Updateshttps://isc.sans.edu/diary/June%202026%20Apple%20Updates/33114 SimpleHelp Exploit used to reply TaskWeaverhttps://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/ DNS Tricks to Load Malware into Cloned Repositoryhttps://0din.ai/blog/clone-this-repo-and-i-own-your-machine My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich

Adding some Automation to the favicon.ico method of Host Reconhttps://isc.sans.edu/diary/Adding%20some%20Automation%20to%20the%20favicon.ico%20method%20of%20Host%20Recon/33110 Russian Intelligence Services Continue to Target Commercial Messaging Applicationshttps://www.ic3.gov/PSA/2026/PSA260626 Google Gemini CLI Vulnerability CVE-2026-12537https://github.com/advisories/GHSA-jj69-4grx-fqj5 IPv6 Fr...

What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrimehttps://isc.sans.edu/diary/What%20do%20Ports%20Hear%20When%20Nobody%27s%20Listening%3F%20An%20Assessment%20of%20Automated%20Cybercrime%20%5BGuest%20Diary%5D/33104 Linux Process Name Masqueradinghttps://isc.sans.edu/diary/Linux+Process+Name+Masquerading/33102 Amazon Q VS Code Extension Vulnerabilityhttps://www.wiz.io/b...

CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration.https://isc.sans.edu/diary/CVE-2024-40766%3A%20The%20Patch%20Fixed%20the%20Bug.%20Nobody%20Fixed%20the%20Configuration./33094 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.chttps://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c PixelSmash Critical FF...

Webshells Remain Popularhttps://isc.sans.edu/diary/Webshells%20Remain%20Popular/33096 Safer pull_request_target defaults for GitHub Actions checkouthttps://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ Private Access Control Tokenshttps://cloudflare.net/news/news-details/2026/Cloudflare-Collaborates-With-Leading-Browsers-to-Develop-a-Privacy-First...

eBanking Phishing Delivered Through IPv4-Mapped IPv6 Addresshttps://isc.sans.edu/diary/eBanking%20Phishing%20Delivered%20Through%20IPv4-Mapped%20IPv6%20Address/33090 NGINX ngx_http_v3_module vulnerability CVE-2026-42530https://my.f5.com/manage/s/article/K000161616 Squidbleed (CVE-2026-47729)https://blog.calif.io/p/squidbleed-cve-2026-47729 AMD will reinstate memory encryption on Ryzen 9000 CPUs th...

The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary]https://isc.sans.edu/diary/The%20browser%20blind%20spot%3A%20Why%20your%20security%20tool%20may%20not%20be%20blocking%20what%20you%20think%20it%20is%20%5BGuest%20Diary%5D/33084 Android 17 Security Patcheshttps://source.android.com/docs/security/bulletin/android-17 Oracle Critical Security Patch Upd...

From a VHDX File to a Remcos RAThttps://isc.sans.edu/diary/From%20a%20VHDX%20File%20to%20a%20Remcos%20RAT/33080 A backdoor in a LinkedIn job offerhttps://roman.pt/posts/linkedin-backdoor/ A 27-Year-Old Authentication Bypass in OpenBSD's PPP Stackhttps://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html Copilot M365 Data Leakagehttps://www.varonis.com/blog/searchleak My Upcoming Class...

Evil MSI Background: BASE64 Statistical Analysishttps://isc.sans.edu/diary/Evil%20MSI%20Background%3A%20BASE64%20Statistical%20Analysis/33072 Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerabilityhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ TSME/SME not activating on Ryzen 7 9700Xhttps://github.com/AMDESE/AMDSEV/issues/292 Deep...

Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like Malwarehttps://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/ A Fake Bug...

More Bitlocker Issues: GreatXMLhttps://git.churchofmalware.org/Nightmare_Eclipse/GreatXML Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523)https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US Oracle Security Alert Advisory - CVE-2026-35273https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlhttps://www.bleepingcompu...

How has use of framing protection security headers changed in the past 3 years?https://isc.sans.edu/diary/How%20has%20use%20of%20framing%20protection%20security%20headers%20changed%20in%20the%20past%203%20years%3F/33068 Preparing for npm v12: install scripts and non-registry sources become opt-inhttps://github.com/orgs/community/discussions/198547 Adobe Patcheshttps://helpx.adobe.com/security.html...

Microsoft June 2026 Patch Tuesdayhttps://isc.sans.edu/diary/Microsoft%20June%202026%20Patch%20Tuesday/33064 Miasma Software Supply Chain Attack Toolkit Source Publishedhttps://safedep.io/inside-the-miasma-supply-chain-attack-toolkit/ Fortinet FortiSandbox Vulnerabilityhttps://fortiguard.fortinet.com/psirt/FG-IR-26-141 My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich

Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attackhttps://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)https://blog.checkpoint.com/security/check-point-releases-impor...

The Evil MSI Background is Back!https://isc.sans.edu/diary/The%20Evil%20MSI%20Background%20is%20Back!/33054 The Smart TV in Your LivingRoom Is a Node in the AIScraping Economyhttps://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/ Brute force attack on Dashlane user accountshttps://support.dashlane.com/hc/en-us/articles/36038764990866-Security-...

Microsoft's Coreutils for Windowshttps://isc.sans.edu/diary/Microsoft%27s%20Coreutils%20for%20Windows/33048 Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability CVE-2026-20230https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW Firmware Update for Acer Connect W6x Router https://community.acer.com/en/kb/articles/19672 OA...

Continuing Scans for swagger.jsonhttps://isc.sans.edu/diary/Continuing+Scans+for+swaggerjson/33044/#comments Fake call detection on Androidhttps://blog.google/security/android-fake-call-detection/ Anthropic's coordinated vulnerability disclosure dashboardhttps://red.anthropic.com/2026/cvd/ My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich

New Wave Of Phishing Emails with SVG Fileshttps://isc.sans.edu/diary/New%20Wave%20Of%20Phishing%20Emails%20with%20SVG%20Files/33040 Android 2026-06-01 security patch level vulnerability detailshttps://source.android.com/docs/security/bulletin/2026/2026-06-01 Poly Voice Possible Remote Control of Certain Poly Devices CVE-2026-0826https://support.hp.com/us-en/document/ish_15052661-15052687-16/hpsbpy...

Unidentified RAT pushes NetSupport RAThttps://isc.sans.edu/diary/Unidentified%20RAT%20pushes%20NetSupport%20RAT/33034 CVE-2026-41089: Windows Netlogon Vulnerability Exploitedhttps://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-may-2026-patches-118-vulnerabilities-16-critical-102 RedHat npm Packages Affectedhttps://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealin...