SANS Stormcast: Daily Cyber Security News

This episode discusses recurring cybersecurity threats like compromised DVRs and Cisco vulnerabilities, highlighting persistent issues with IoT devices and the importance of basic security measures.

This cybersecurity podcast discusses AI credential scanning attacks, Microsoft update issues requiring BitLocker recovery keys, and other security vulnerabilities.

This episode covers Microsoft's April 2026 patch Tuesday, detailing 165 vulnerabilities including critical and exploited ones in products like Microsoft Defender and SharePoint.

This episode discusses recent cybersecurity threats including the EncystPHP webshell, CPUID compromises, OpenAI Mac certificate issues, and an Axios vulnerability.

This episode discusses two cybersecurity diaries: one about obfuscated JavaScript delivering malware via PNG files, and another analyzing the use of numbers like years in passwords based on honeypot data.

In this April 9, 2026 episode, Johannes Ulrich covers three cybersecurity stories from SANS Internet Storm Center.

In this April 8, 2026 Stormcast, Johannes Ulrich investigates web shell scanning activity originating from Microsoft cloud IPs, where parasitic attackers scan for pre-deployed backdoors.

This episode discusses the use of open redirect vulnerabilities in phishing attacks, with analysis of recent phishing emails.

Daily cybersecurity news update covering recent breaches and incidents, including Team PCP and Axios postmortem.

A daily cybersecurity news update covering a newly exploited vulnerability in the VEET developer tool.

Daily cybersecurity news covering a malicious script that removes zone identifiers, a Chrome zero-day exploit, and Apple's latest iOS update.

This episode discusses a cybersecurity diary by Xavier demonstrating how to bypass Palo Alto's next-generation firewall application control using a simple netcat tunnel to exfiltrate data in 5,000-byte chunks.

This episode discusses honeypot session durations and attacker behavior, plus a Let's Encrypt experiment.

Daily cybersecurity news covering a software supply chain attack on Telnyx's PyPi account and links to ransomware actors.

Johannes Ulrich covers four cybersecurity stories in this March 27, 2026 Stormcast.

A daily cybersecurity news update covering Apple's latest security patches and vulnerability trends.

In this March 25, 2026 Stormcast, Johannes Ulrich covers detection techniques for IP KVMs used by North Korean IT workers to avoid software-based detection on company laptops.

Daily cybersecurity news covering AI code review findings, tax season scams via fake Google ads, and updates to forensic tools.

Daily cybersecurity news covering a malware analysis using G-Socket backdoor and time stomping techniques.

A daily cybersecurity news update discussing a honeypot observation involving an Iran-related payload in a brute force attack.

Daily cybersecurity news summary discussing scans against Adminer database administration tool.

Johannes Ulrich discusses IPv4 mapped IPv6 addresses and their potential security implications.

This episode covers a proxy-based attack targeting cloud metadata services observed in honeypots.

Daily cybersecurity news covering a ClickFix campaign pushing Remcos RAT and a phishing trick using Cloudflare workers.

Daily cybersecurity news covering SSH honeypot attacks, default password issues, and Apple security updates for older iOS devices.

This episode covers the ZombieSIP vulnerability, a technique where attackers manipulate SIP file compression indicators to evade antivirus detection.

Daily cybersecurity news covering Microsoft's Patch Tuesday with 93 vulnerabilities, including critical flaws and disclosed issues.

This episode discusses two new RFCs that establish standards for encrypting TLS client hellos to enhance privacy and prevent fingerprinting.

A daily cybersecurity news update covering Yara X tool updates and increased attacks on IP cameras.

Host Johannes Ullrich covers four cybersecurity topics in the March 6, 2026 edition of SANS Stormcast.

Daily cybersecurity news covering a phishing campaign delivering XWARM malware and malicious SEO tactics.

This episode discusses brute force attacks targeting CrushFTP using default passwords and covers Android security patches addressing 140 vulnerabilities, including an actively exploited Qualcomm display driver flaw.

This episode discusses cybersecurity techniques for analyzing malicious compound documents, specifically extracting URLs from ZIP files embedded in RTF documents, and mentions related exploits and quantum-safe developments.

This episode analyzes a fake FedEx email attack, detailing the malware's stages from a 7-zip attachment to an AES-encrypted PowerShell script and Donut Loader.

This episode discusses a SANS.edu intern's experience using AI to analyze honeypot alerts and improve cybersecurity threat detection.