Today's Stormcast covers honeypot scans for leftover email test scripts, HD Moore's runZero oobscan for out-of-band management interfaces, a critical apt signature-bypass flaw (CVE-2026-109518), and unpatched SonicWall GMS end-of-life vulnerabilities.
The Classics Return: Vulnerable E-Mail Scripts
Internet Storm Center honeypots are seeing probes for development email test scripts such as sendmail.php and test-mail.php. Like the classic FormMail script, these can leak environment variables and let attackers send spam through GET or POST parameters, so keep them out of production.
https://isc.sans.edu/diary/The%20Classics%20Return%3A%20Vulnerable%20E-Mail%20Scripts/33488
oobscan: Scan for Out-of-Band Management Interfaces
HD Moore's runZero oobscan hunts exposed BMC, IPMI, SNMP, and IP KVM style out-of-band management interfaces and flags known vulnerabilities on those devices rather than only listing open ports.
https://github.com/runZeroInc/oobscan#research-and-disclosures
apt Signature Bypass (CVE-2026-109518)
A critical flaw in Debian's apt package manager can skip signature verification when a package web server returns crafted error responses, letting an on-path attacker inject malicious packages over HTTP. Prefer HTTPS where your distribution allows it; Ubuntu still often uses HTTP by default. Debian and Ubuntu have published updates for CVE-2026-109518.
https://lists.debian.org/deity/2026/11/msg00005.html
https://ubuntu.com/blog/apt-vulnerability-fixes-available
https://security-tracker.debian.org/tracker/CVE-2026-109518
SonicWall GMS End of Life: Unpatched File Read and SQL Injection
SonicWall Global Management System (GMS) 9.5.2 and earlier are end of life, and SonicWall will not fix an unauthenticated file read (CVE-2026-109593) or an authenticated SQL injection (CVE-2026-109594). Migration to Network Security Manager (NSM) is the vendor path forward.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019
https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html
https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1456/
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Rss Apple Podcaster
Podden och tillhörande omslagsbild på den här sidan tillhör Johannes B. Ullrich. Innehållet i podden är skapat av Johannes B. Ullrich och inte av, eller tillsammans med, Poddtoppen.