SANS Stormcast ThursdayApril 10th: Getting Past PyArmor; CenterStack RCE; Android 0-Day Patch; VMware Tanzu Patches; Odd Win11 Directory; WhatsApp File Confusion; SANS AI Guide;

Getting Past PyArmor

PyArmor is a python obfuscation tool used for malicious and non-malicious software. Xavier is taking a look at a sample to show what can be learned from these obfuscated samples with not too much work.

https://isc.sans.edu/diary/Obfuscated%20Malicious%20Python%20Scripts%20with%20PyArmor/31840

CenterStack RCE CVE-2025-30406

Gladinet s CenterStack secure file-sharing software suffers from an inadequately protected machine key vulnerability that can be used to modify ViewState data. This vulnerability may lead to remote code execution, which is already exploited.

https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf

Google Patches two zero-day vulnerabilities CVE-2024-53150 CVE-2024-53197

Google released its monthly patches for Android. Two of the patched vulnerabilities are already exploited. One of them was used by Serbian law enforcement.

https://www.malwarebytes.com/blog/news/2025/04/google-fixes-two-actively-exploited-zero-day-vulnerabilities-in-android

Broadcom VMWare Tenzu Updates

Broadcom released updates for VMWare Tenzu. Many vulnerabilities affect the backup component and allow for arbitrary command execution.

https://support.broadcom.com/web/ecx/security-advisory?

Windows 11 April Update ads inetpub directory

The April Windows 11 update appears to create a new /inetpub directory. It is unclear why, and removing it appears to have no bad effects.

https://www.bleepingcomputer.com/news/microsoft/windows-11-april-update-unexpectedly-creates-new-inetpub-folder/

WhatsApp File Type Confusion/Spoofing

WhatsApp patched a file type confusion vulnerability. A victim may be tricked into downloading n

https://www.whatsapp.com/security/advisories/2025/

SANS Critical AI Security Guidelines

https://www.sans.org/mlp/critical-ai-security-guidelines