SANS ISC Stormcast listed for October 30, 2026
The diary entry is only a link to the October 30 podcast and a license notice, with no incident details.
8
Organization
SANS Internet Storm Center
- Mentions · 7d11
- Mentions · 30d39
- All mentions67
- First seenSep 1, 2026
- Last mentioned22h ago
Timeline
67 articles · newest firstFake Cloudflare checks push ClickFix commands to Windows and Mac users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.
56
SANS diary explains a local Ghidra Server for malware labs
A shared Ghidra repository keeps analysis projects outside disposable VMs and supports versioning and multiple clients.
28
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
58
SANS ISC lists Stormcast for October 29 without episode details
The feed entry only links to podcast detail page 10156 and includes no findings or incidents.
8
Unnamed ClickFix campaign uses fake Cloudflare checks on Windows and macOS
The researcher could not retrieve either payload: Windows returned 403 and the macOS malware domain did not resolve.
46
SANS ISC Stormcast listed for October 28, 2026
The listing only links to podcast episode 10154 and includes no topics or findings.
12
SANS ISC Stormcast posted for October 27, 2026
The feed entry only links the episode and includes no vulnerability or incident details.
8
SANS diary uses Kibana to hunt odd HTTP charsets in honeypot logs
A DShield honeypot logged about 960,000 events in three weeks, and Accept-Charset GBK stood out on SonicWall login probes.
28
SANS ISC Stormcast for October 26, 2026
The feed entry only links podcast episode 10150 and gives no topics or transcript.
12
YARA-X 1.22.0 adds built-in 64-bit integer read functions
The release ships 11 improvements and 9 bugfixes, including int64, int64be, uint64, and uint64be.
22
SANS finds published php2shell exploits unreliable outside lab setups
Working demos need an 8 MB memory limit, one prefork worker and on-box library offsets, and commands are capped at 14 bytes.
58
SANS ISC Stormcast posted for October 23, 2026
The feed entry only links Friday's Stormcast episode and includes no incident details.
12
SANS ISC posts Stormcast for October 22, 2026
The listing only links the October 22 episode and includes no incident or vulnerability details.
8
Actively exploited PHP bugs allow full server takeover
Fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; Cloudflare says it already saw exploit traffic.
93
Critical PHP flaws draw early exploits ahead of today's patch
SANS says every PHP release from 5 onward is affected, only PHP 8 will be patched, and Cloudflare reports exploits.
86
SANS ISC Stormcast for October 21, 2026
The feed entry is only a podcast link and license notice, with no episode topics or findings.
8
SANS ISC Stormcast for October 20, 2026
The feed entry only links the October 20 Stormcast episode and gives no topics or findings.
12
ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140, (Fri, Oct 16th)
SANS posted its October 16, 2026 Stormcast link without any incident details in the feed.
5
ISC Stormcast For Thursday, October 15th, 2026 https://isc.sans.edu/podcastdetail/10138, (Thu, Oct 15th)
SANS posted its October 15, 2026 Stormcast link with no incident or vulnerability details.
4
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
SANS analyzes Panchan, a Golang cryptomining worm that still spreads by stealing SSH keys.
46
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
SANS finds AutoCAD DWG files with orphaned VBA projects that AutoCAD cannot execute.
38
ISC Stormcast For Wednesday, October 14th, 2026 https://isc.sans.edu/podcastdetail/10136, (Wed, Oct 14th)
SANS posted its October 14, 2026 Stormcast link without any episode details.
2
Microsoft Patches More Than 1,400 Security Flaws
Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.
80
ISC Stormcast For Tuesday, October 13th, 2026 https://isc.sans.edu/podcastdetail/10134, (Tue, Oct 13th)
SANS ISC posted its daily Stormcast for October 13, 2026, with no incident details.
12
ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132, (Mon, Oct 12th)
SANS ISC published its October 12, 2026 Stormcast with no incident details in the listing.
12
Why TLP should not replace your internal information classification, (Sat, Oct 10th)
SANS warns organizations not to replace internal data classification with Traffic Light Protocol sharing labels.
32
ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)
SANS posted its October 9, 2026 Stormcast, but the feed contains no incident details.
4
ISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th)
SANS ISC published its October 8, 2026 Stormcast; the feed text lists no specific incidents.
12
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
Attackers are scanning Atlassian products for CVE-2026-21589, a traversal bug that can read web files.
72
ISC Stormcast For Wednesday, October 7th, 2026 https://isc.sans.edu/podcastdetail/10126, (Wed, Oct 7th)
SANS ISC posted its October 7, 2026 Stormcast with no incident details in the feed.
10
ISC Stormcast For Tuesday, October 6th, 2026 https://isc.sans.edu/podcastdetail/10124, (Tue, Oct 6th)
SANS posted its October 6, 2026 Stormcast with no incident details in the feed.
12
More RMM Tools In the Wild, (Tue, Oct 6th)
Attackers phish victims with a fake PDF that installs Action1’s signed RMM agent for persistence.
54
ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th)
SANS Internet Storm Center listed its October 5, 2026 Stormcast without any episode summary.
12
TTY Logs and the Data it Captures, (Sun, Oct 4th)
SANS diary correlates DShield honeypot TTY logs, finding one crontab pattern used by over 3,130 IPs.
32
User Agent Strings Curiosities, (Sun, Oct 4th)
SANS diary reviews odd honeypot user-agent strings, from masscan variants to Shellshock and NTRIP probes.
24
YARA-X 1.21.0 Release, (Sat, Oct 3rd)
YARA-X 1.21.0 adds five improvements and four bugfixes, including stdin support for --scan-list.
22
ISC Stormcast For Friday, October 2nd, 2026 https://isc.sans.edu/podcastdetail/10120, (Fri, Oct 2nd)
SANS ISC posted its October 2, 2026 Stormcast link, with no incident details in the feed.
12
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
Attackers phish victims into running a signed ScreenConnect client that calls an attacker instance.
50
ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st)
SANS posted its October 1, 2026 Stormcast with no incident details in the feed.
8
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-698291%9.8Unauthenticated Heap Buffer Overflow RCE in Microsoft Windows Shell
- CVE-2026-697301%9.8Use-After-Free RCE in Windows DNS Server
- Untrusted search path in Microsoft .NET Framework
Appears with
- SANSvendor · 9
- SANS Internet Storm Centervendor · 7
- ISC Stormcastproduct · 7
- Microsoftvendor · 3
- Windowsproduct · 3
- Cowrieproduct · 2
- DShieldproduct · 2
- Cloudflareorganization · 2
- YARA-Xproduct · 2
- Stormcastproduct · 2
- PHPvendor · 2
- Elasticvendor · 1
- CISAorganization · 1
- Action1organization · 1
- Wordfencevendor · 1
- Panchanmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.