ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “isc”

12 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 7Industry 3Malware 1Research 1Tools 1Vulnerability 1
SeverityAllcritical 0high 0medium 2low 1info 11

ISC BIND security advisory (AV26-931)

Canadian Cyber Centre relays ISC advisory on vulnerabilities affecting multiple BIND 9 branches; administrators should review the matrix and apply updates.

On September 16, 2026, the Canadian Centre for Cyber Security (AV26-931) relayed ISC's advisory on vulnerabilities affecting ISC BIND 9 versions prior to or equal to 9.18.50, 9.20.27, and 9.21.25, including their -S1 variants. No specific CVE identifiers or exploitation details are provided in the bulletin. Administrators are directed to ISC's BIND 9 Software Vulnerability Matrix and encouraged to apply updates as they become available.

Canadian Centre for Cyber Security · 1h agoAdvisory

ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736)

ISC discloses fourteen vulnerabilities in BIND 9 DNS software, including a use-after-free, with fixes now available.

On September 16, 2026, Internet Systems Consortium disclosed fourteen vulnerabilities affecting BIND 9, listing CVE-2026-19033, CVE-2026-19662, CVE-2026-19666 (use-after-free), CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, and CVE-2026-81736. Details and fixes are published in the ISC knowledge base. No active exploitation is reported in the announcement.

oss-security · 5h agoVulnerabilityCVE-2026-19033CVE-2026-19662CVE-2026-19666+11 CVEs

ISC Stormcast For Friday, September 11th, 2026 https://isc.sans.edu/podcastdetail/10090, (Fri, Sep 11th)

SANS ISC released its daily Stormcast podcast for September 11, 2026; the feed provides no story details.

The SANS Internet Storm Center published its daily ISC Stormcast podcast episode for Friday, September 11, 2026. The feed contains only the standard copyright notice and links, without any story details.

SANS Internet Storm Centerupdated · 18h agofirst · 5d agoIndustry 5 sources

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center · 13d agoTools1

ISC Stormcast For Wednesday, September 9th, 2026 https://isc.sans.edu/podcastdetail/10086, (Wed, Sep 9th)

SANS Internet Storm Center publishes its daily Stormcast cybersecurity news podcast for Wednesday, September 9th, 2026.

The ISC Stormcast is the SANS Internet Storm Center's daily short-form cybersecurity news podcast. This item is the episode for Wednesday, September 9th, 2026, linking to the podcast detail page. No article content was included beyond the podcast link and Creative Commons license notice, so no specific incidents or topics are described.

SANS Internet Storm Center · 7d agoAdvisory

ISC Stormcast For Tuesday, September 8th, 2026 https://isc.sans.edu/podcastdetail/10084, (Tue, Sep 8th)

SANS Internet Storm Center's daily Stormcast podcast digest for September 8, 2026, summarizing current internet security activity.

The SANS Internet Storm Center published its daily Stormcast audio briefing for Tuesday, September 8, 2026. The available item text contains only licensing and URL metadata, with no specific vulnerabilities, incidents, or topics described.

SANS Internet Storm Center · 8d agoAdvisory

ISC Stormcast For Thursday, September 3rd, 2026 https://isc.sans.edu/podcastdetail/10080, (Thu, Sep 3rd)

SANS Internet Storm Center released its daily Stormcast audio briefing for September 3rd, 2026.

The SANS Internet Storm Center published its regular daily Stormcast podcast episode. The feed text contains no substantive threat details, only the podcast link and licensing information. No specific incidents, vulnerabilities, or advisories can be extracted from the available text.

SANS Internet Storm Center · 13d agoAdvisory

ISC Stormcast For Wednesday, September 2nd, 2026 https://isc.sans.edu/podcastdetail/10078, (Wed, Sep 2nd)

SANS Internet Storm Center's daily Stormcast briefing for September 2, 2026; the feed carries no substantive story details.

This is the RSS shell for the ISC Stormcast daily podcast episode dated Wednesday, September 2, 2026. The provided text contains only licensing boilerplate and a link, with no incident, vulnerability, or threat details to extract.

SANS Internet Storm Center · 14d agoAdvisory

ISC Stormcast For Tuesday, September 1st, 2026 https://isc.sans.edu/podcastdetail/10076, (Tue, Sep 1st)

SANS Internet Storm Center's daily Stormcast podcast for September 1, 2026 summarizes current internet threat activity; no detailed content provided.

This is the daily ISC Stormcast audio briefing from the SANS Internet Storm Center for Tuesday, September 1st, 2026. No article body was provided, so the specific stories covered in this episode cannot be extracted. Stormcast episodes typically summarize notable internet-wide security events and handler findings.

SANS Internet Storm Center · 15d agoAdvisory

MacOS 27 - First Boot, (Tue, Sep 15th)

SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.

Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.

SANS Internet Storm Center · 1d agoResearch

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm Center · 6d agoMalware in the wild1