共收录 198 条相关安全情报。
← 返回所有主题ISC Stormcast For Wednesday, September 16th, 2026 https://isc.sans.edu/podcastdetail/10096, (Wed, Sep 16th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I have not done this type of diary in a while: What traffic will you see from a system on boot, before a user logs in? I just took a quick look at macOS 27 "Golden Gate" to see what traffic you should expect. Here are some of the highlights:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, September 15th, 2026 https://isc.sans.edu/podcastdetail/10094, (Tue, Sep 15th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors&#;x26;#;39; "post-AI" patch releases.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I identified an attacker using a semi-autonomous coding agent to run an offensive operation: finding poorly secured LLM resale gateways, acquiring API access through ordinary web flaws and account farming, validating the resulting inference capacity, and aggregating it behind a single gateway of their own.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, September 11th, 2026 https://isc.sans.edu/podcastdetail/10090, (Fri, Sep 11th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Aaron Ng, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, September 10th, 2026 https://isc.sans.edu/podcastdetail/10088, (Thu, Sep 10th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
About a week ago, Proxmox published an advisory revealing a vulnerability in older versions of Proxmox VE, its flagship Virtual Environment product. The vulnerability only affects version 7, which has not been supported for a couple of years now.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, September 9th, 2026 https://isc.sans.edu/podcastdetail/10086, (Wed, Sep 9th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 set in July 2026. Two vulnerabilities are listed as exploited in the wild, while none were publicly disclosed before Patch Tuesday. Notable fixes include Windows privilege escalation and critical RCEs
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, September 8th, 2026 https://isc.sans.edu/podcastdetail/10084, (Tue, Sep 8th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Mikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise. Attackers have been adding new accounts to affected devices to maintain access after a patch is installed.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
numbat - AI agent observability, (Fri, Sep 4th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, September 4th, 2026 https://isc.sans.edu/podcastdetail/10082, (Fri, Sep 4th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Frank Igbokwe, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, September 3rd, 2026 https://isc.sans.edu/podcastdetail/10080, (Thu, Sep 3rd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, September 2nd, 2026 https://isc.sans.edu/podcastdetail/10078, (Wed, Sep 2nd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Introduction
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, September 1st, 2026 https://isc.sans.edu/podcastdetail/10076, (Tue, Sep 1st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
One of my internet-exposed inference honeypots was discovered, relabeled with sought-after model names, and incorporated into infrastructure apparently used to provide "free" LLM backends. It then received a real coding-agent session &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x94; history, filesystem output, working paths, and the agent&#;x26;#;39;s local tool manifest. The honeypot did not request or cau
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, August 31st, 2026 https://isc.sans.edu/podcastdetail/10074, (Mon, Aug 31st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
YARA-X&#;x26;#;39;s 1.20.0 release brings 14 improvements and 13 bugfixes.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 32bits malware[1]. Can we go a bit further? I (vibe-)coded a Python script based on the pefile library[2] to extract some info from the PE headers. Indeed, the PE file format contains a
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, August 28th, 2026 https://isc.sans.edu/podcastdetail/10072, (Fri, Aug 28th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, August 27th, 2026 https://isc.sans.edu/podcastdetail/10070, (Thu, Aug 27th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"&#;x26;#;x3f;&#;x26;#;xc2;&#;x26;#;xa0; Who can delete or change key things, or modify them in ways that might not be obvious (accidentally or on purpose).&#;x26;#;xc2;&#;x26;#;xa0; Yes, we trust our people, but if they&#;x26;#;39;ve moved on to other roles or to other organizations, t
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, August 26th, 2026 https://isc.sans.edu/podcastdetail/10068, (Wed, Aug 26th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
It is pretty obvious that hostnames can replace IP addresses. Pretty much any software accepting an IP address will also accept a hostname as an argument. Last week, I wrote about scans for the cloud metadata service listening at 169.254.169.254. These scans attempted to exploit Server Side Request Forgery (SSRF) vulnerability. One way to prevent these types of exploits is to filter requests that
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, August 25th, 2026 https://isc.sans.edu/podcastdetail/10066, (Tue, Aug 25th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It doesn&#;x26;#;39;t use real steganography:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, August 24th, 2026 https://isc.sans.edu/podcastdetail/10064, (Mon, Aug 24th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
In every MFA rollout, there will come a time where you think you are closing in on "done", and some automation to list what&#;x26;#;39;s left would be handy. Something quicker than scrolling through the web interface through thousands of accounts ...
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, August 21st, 2026 https://isc.sans.edu/podcastdetail/10062, (Fri, Aug 21st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
One thing that folks never seem to do after "going to the CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily when things were on premise.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Building on the last diary on Using MS Graph and Powershell, let&#;x26;#;39;s look at "Risky" logins.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Microsoft Graph is a newer API that is meant to replace several others.&#;x26;#;xc2;&#;x26;#;xa0; OK, it&#;x26;#;39;s at version 2.3.9, so it&#;x26;#;39;s not all that new, but it&#;x26;#;39;s new enough that lots of folks (and commercial tools) aren&#;x26;#;39;t using it yet.&#;x26;#;xc2;&#;x26;#;xa0; &#;x26;#;xc2;&#;x26;#;xa0;It allows you to Get and Set info from/to M365, Entra Users and Entra
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, August 20th, 2026 https://isc.sans.edu/podcastdetail/10060, (Thu, Aug 20th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Cloud providers typically expose a REST API at 169.254.169.254 that allows code running on virtual machines to retrieve machine-specific data. Some of the data is more or less harmless, such as the region the machine is running in or its MAC and IP addresses. However, the service may also be used to retrieve credentials for IAM roles and service account tokens.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, August 19th, 2026 https://isc.sans.edu/podcastdetail/10058, (Wed, Aug 19th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, August 18th, 2026 https://isc.sans.edu/podcastdetail/10056, (Tue, Aug 18th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
About 20 years ago, with macOS 10.5 (Leopard), Apple introduced screen sharing. Apple did not invent a new protocol for screen sharing. Instead, it used the established VNC protocol. VNC is a pretty simple, unencrypted protocol using TCP port 5900. Historically, the protocol used a simple global password for authentication. Apple adapted the protocol for its own use, but overall, left the VNC prot
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, August 17th, 2026 https://isc.sans.edu/podcastdetail/10054, (Mon, Aug 17th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Wireshark release 4.6.8 fixes 28 vulnerabilities and 25 bugs.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, August 14th, 2026 https://isc.sans.edu/podcastdetail/10052, (Fri, Aug 14th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, August 13th, 2026 https://isc.sans.edu/podcastdetail/10050, (Thu, Aug 13th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
In the past few weeks, I have been using Gemma4 as a Large Language Model (LLM) to see how useful it can be to analyze some of the malware hashes uploaded to the DShield sensor over the past 30 days and figure out how its recommendation can be considered useful about the activity my DShield sensor is collecting and tracking. The model I use for this testing is gemma4:e4b [2] using two sites to com
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A couple of days ago, Xavier posted about Atuin to gain more insight into the command history. Atuin does a great job of better organizing what is usually handled by "bash&#;x26;#;x5f;history"&#;x26;#;xc2;&#;x26;#;xa0;and collecting meaningful additional data. Our reader David commented that this can also be done quite well with Linux&#;x26;#;39;s kernel process accounting feature, and I think he
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, August 12th, 2026 https://isc.sans.edu/podcastdetail/10048, (Wed, Aug 12th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This month we got patches for 418 vulnerabilities. Of these, 62 are critical, 1 is being exploited in the wild, and 2 were publicly disclosed as zero-days. Notable fixes include Windows privilege escalation, container tampering, and critical QUIC and DNS Server remote code execution bugs.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, August 11th, 2026 https://isc.sans.edu/podcastdetail/10046, (Tue, Aug 11th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Solana is a crypto platform known for speed. Developers like it to develop distributed applications or to implement crypto payments. To interact with the blockchain, APIs are provided for developers. These APIs will either "speak" JSON or gRPC. One implementation often used for development is "surfpool," which is used to test programs before deploying them to a Solana network.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, August 10th, 2026 https://isc.sans.edu/podcastdetail/10044, (Mon, Aug 10th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
UNIX systems (including Linux) are well-known to record a lot of activities in many different locations. But there is one domain where they definitely lack of "modern" logging: shells. Most shells provide an historization of the typed commands through a flat file in the $HOME directory (ex: $HOME/.bash_history). They suffer of multiple problems:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, August 7th, 2026 https://isc.sans.edu/podcastdetail/10042, (Fri, Aug 7th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, August 6th, 2026 https://isc.sans.edu/podcastdetail/10040, (Thu, Aug 6th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Daryl Jiminez, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
When you learn that a compromised package executed on one of your build hosts, muscle memory takes over: revoke the npm token, rotate the GitHub PAT, cycle the cloud keys. That reflex has been correct in almost every supply-chain incident I have worked. In the keyv/cacheable compromise that has been unfolding since yesterday, it is the one thing you should not do first — because revoking the sto
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, August 5th, 2026 https://isc.sans.edu/podcastdetail/10038, (Wed, Aug 5th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven&#;x26;#;39;t noticed before. All of these URLs appear to be associated with diagnostic tools:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, August 4th, 2026 https://isc.sans.edu/podcastdetail/10036, (Tue, Aug 4th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, August 3rd, 2026 https://isc.sans.edu/podcastdetail/10034, (Mon, Aug 3rd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Introduction
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by campaigns but I spotted some phishing emails that focus on AI services like ChatGPT.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I was asked for help with a problem similar to the following.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, July 31st, 2026 https://isc.sans.edu/podcastdetail/10032, (Fri, Jul 31st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, July 30th, 2026 https://isc.sans.edu/podcastdetail/10030, (Thu, Jul 30th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Adam Cann, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I am a bit late with this summary, but this week Apple released updates to all its operating systems and Safari. The Safari update, as usual, targets macOS prior to macOS 26. macOS updates covered the two older versions (14 and 15), while other operating system patches only covered the current 26 versions.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, July 29th, 2026 https://isc.sans.edu/podcastdetail/10028, (Wed, Jul 29th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
For a long time, AutoIT[1] has been pretty common in the malware ecosystem. Threat actors still use it because it's easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote process as you'll see below.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, July 28th, 2026 https://isc.sans.edu/podcastdetail/10026, (Tue, Jul 28th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application. Non-Java readers may be familiar with a similar concept, core dumps, which are produced by binaries to expose a memory image at the time the software crashes
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, July 27th, 2026 https://isc.sans.edu/podcastdetail/10024, (Mon, Jul 27th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ESAFENET&#;x26;#;39;s CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market [1]. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, July 24th, 2026 https://isc.sans.edu/podcastdetail/10022, (Fri, Jul 24th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Two disclosures, five days apart, described the same intrusion from opposite ends —
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, July 23rd, 2026 https://isc.sans.edu/podcastdetail/10020, (Thu, Jul 23rd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This isn&#;x26;#;39;t a new attack, but something I saw "pop-up" in our logs this week:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, July 22nd, 2026 https://isc.sans.edu/podcastdetail/10018, (Wed, Jul 22nd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Not everything our honeypots detect is an attack. Sometimes it is just "odd traffic", and this is one example: Our "First Seen" list currently includes "http://detectportal.firefox.co
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, July 21st, 2026 https://isc.sans.edu/podcastdetail/10016, (Tue, Jul 21st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, July 20th, 2026 https://isc.sans.edu/podcastdetail/10014, (Mon, Jul 20th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
We have been following issues with Hikvision cameras for a long, long time. Like many similar products, Hikvision cameras have a long history of vulnerabilities and are often targeted by internet-wide scans that our honeypot network detects.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, July 17th, 2026 https://isc.sans.edu/podcastdetail/10012, (Fri, Jul 17th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, July 16th, 2026 https://isc.sans.edu/podcastdetail/10010, (Thu, Jul 16th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, July 15th, 2026 https://isc.sans.edu/podcastdetail/10008, (Wed, Jul 15th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The last update to the DShield SIEM [4] was in Sep 2025 which contained some minor tweaks. This update currently is using ELK stack version 8.19.15, contains some additional dashboards and new logs.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This patch Tuesday includes a staggering&#;x26;#;xc2;&#;x26;#;xa0;622 vulnerabilities, not including another 427 vulnerabilities in Chromium, affecting Microsoft&#;x26;#;39;s Edge browser. 62 of the vulnerabilities are rated critical. One was disclosed before today, and two have already been exploited.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, July 14th, 2026 https://isc.sans.edu/podcastdetail/10006, (Tue, Jul 14th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The setup
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, July 13th, 2026 https://isc.sans.edu/podcastdetail/10004, (Mon, Jul 13th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Wireshark release 4.6.7 fixes 12 vulnerabilities and 16 bugs.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The stack is a memory region where a program stores temporary data -&#;x26;#;xc2;&#;x26;#;xa0;like local variables and return addresses. Think of the stack as a pile of plates in your kitchen: you can only add a new plate to the top, and you can only take one away from the top too. Programs use this same "last in, first out" principle to keep track of what they&#;x26;#;39;re doing. Every time a fu
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Anyone who deals with phishing messages caught by basic security filters knows that most phishing samples tend to blend into one another, since only a small set of techniques and approaches keeps reappearing in them. That is precisely why it is worth pausing on the occasional message that does something a little out of the ordinary.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, July 10th, 2026 https://isc.sans.edu/podcastdetail/10002, (Fri, Jul 10th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000, (Thu, Jul 9th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Jason Callahan, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, July 8th, 2026 https://isc.sans.edu/podcastdetail/9998, (Wed, Jul 8th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Yesterday, I talked about NAPTR records and how they are related to RCS. But there is another "odd" record that shows up in my DNS logs. This one isn&#;x26;#;39;t new, but I don&#;x26;#;39;t think I ever covered it: NIMLOC. At least that is what Zeek calls it. But let&#;x26;#;39;s see what it is all about.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, July 7th, 2026 https://isc.sans.edu/podcastdetail/9996, (Tue, Jul 7th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Over the last year, with recent updates to iOS and Android, RCS (Rich Communication Services) has become an increasingly used protocol [1]. RCS is supposed to eventually replace SMS, and in addition to richer formatting, provides added (but optional) security. RCS messages may be end-to-end encrypted and digitally signed. Unlike SMS, which was "bolted on" to existing voice-focused phone standards.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994, (Mon, Jul 6th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This morning, an interesting phishing email hit my mailbox. It targets Metamask[1], a cryptocurrency wallet, available as a browser extension and a mobile app, that lets users store, send, and receive crypto money. It's pretty popular, so a juicy target for criminals. In February, I already mentioned a campaign against them[2].
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, July 1st, 2026 https://isc.sans.edu/podcastdetail/9990, (Wed, Jul 1st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Apple released updates for iOS/iPadOS, macOS, and Safari on Monday. There have been no updates for other Apple operating systems (visionOS, watchOS, tvOS). Usually, Apple updates all products at the same time.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, June 30th, 2026 https://isc.sans.edu/podcastdetail/9988, (Tue, Jun 30th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I&#;x26;#;39;m in the throes of target host recon for another pentest, and thought I&#;x26;#;39;d share some workflow / automation stuff.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, June 29th, 2026 https://isc.sans.edu/podcastdetail/9986, (Mon, Jun 29th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
YARA-X&#;x26;#;39;s 1.18.0 release brings 3 improvements and 2 bugfixes.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Nicole Phillips, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
In a previous diary, I talked about stack strings&#;x26;#;x5b;1&#;x26;#;x5d; with a practical example of them. Since my SEC670 class, I&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;m even more interested&#;x26;#;xc2;&#;x26;#;xa0;in malware obfuscation techniques. I had&#;x26;#;xc2;&#;x26;#;xa0;a look at process names. When you list running processes on a computer, can you trust what you see&#;x26;#;x3f;
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, June 24th, 2026 https://isc.sans.edu/podcastdetail/9984, (Wed, Jun 24th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The vulnerability
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, June 23rd, 2026 https://isc.sans.edu/podcastdetail/9982, (Tue, Jun 23rd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Webshells have been popular for a long time. We already covered this topic across multiple diaries[1][2]. I spent some time to track them[3] and slighly paid less attention to them but today I found another one. It seems to be a new player (pushed on Github two months ago).
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, June 22nd, 2026 https://isc.sans.edu/podcastdetail/9980, (Mon, Jun 22nd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I detected an interesting phishing email this morning. It targets a major Belgian bank:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, June 18th, 2026 https://isc.sans.edu/podcastdetail/9978, (Thu, Jun 18th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Adam Nason, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a guest diary submitted by Varun Murdula]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, June 17th, 2026 https://isc.sans.edu/podcastdetail/9976, (Wed, Jun 17th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Yesterday, a reader reported to us a malicious ZIP archive (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094[1]). Once unzipped, it contains a VHDX file that discloses a malicious JavaScript after being mounted (which is automatic on modern Windows OSs):
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, June 16th, 2026 https://isc.sans.edu/podcastdetail/9974, (Tue, Jun 16th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I like it when a fellow handler posts a diary entry about images with malicious content. Last one is Xavier: "The Evil MSI Background is Back!".
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, June 15th, 2026 https://isc.sans.edu/podcastdetail/9972, (Mon, Jun 15th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, June 12th, 2026 https://isc.sans.edu/podcastdetail/9970, (Fri, Jun 12th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, June 11th, 2026 https://isc.sans.edu/podcastdetail/9968, (Thu, Jun 11th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, June 10th, 2026 https://isc.sans.edu/podcastdetail/9966, (Wed, Jun 10th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Microsoft today released patches for 204 vulnerabilities. 38 of these vulnerabilities are considered critical, and three have been disclosed before today. Six of the vulnerabilities affect Microsoft cloud solutions and do not require any user action. In addition, Microsoft incorporated 360 different vulnerabilities affecting Chromium into its Edge browser.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, June 9th, 2026 https://isc.sans.edu/podcastdetail/9964, (Tue, Jun 9th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This diary continues the Internet Storm Center&#;x26;#;39;s tracking of the TeamPCP supply chain campaign, first documented in the SANS white paper When the Security Scanner Became the Weapon and most recently in the handler diary Activity Through 2026-05-24. Since that update, the story moved into two new places: the United States government, which formally caught up to the campaign, and the wide
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, June 8th, 2026 https://isc.sans.edu/podcastdetail/9962, (Mon, Jun 8th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A few months ago, I wrote a diary about a payload that was embedded into a JPEG picture. It was a MSI-branded background[1]. Yesterday, I spotted another one! It seems that the technic is getting more and more popular. This time, it started with a mail containing a WeTransfer link.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, June 5th, 2026 https://isc.sans.edu/podcastdetail/9960, (Fri, Jun 5th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, June 4th, 2026 https://isc.sans.edu/podcastdetail/9958, (Thu, Jun 4th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Enterprise applications often still use complex standards like SOAP for web services. The big advantage of SOAP is its tight and extensive standards, which enable interoperability across an enterprise governed by web services. The disadvantage of SOAP: First, while it is de facto usually used over HTTP, it does not leverage HTTP, leading to unnecessary complexity. Secondly, kids don&#;x26;#;39;t R
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, June 3rd, 2026 https://isc.sans.edu/podcastdetail/9956, (Wed, Jun 3rd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
For a few days, my SANS ISC mailbox is flooded with emails that delivers SVG files. An SVG ("Scalable Vector Graphic") is a web-friendly vector file format used for graphics and icons. No URL in the body, just “an imageâ€, that's the perfect way to deliver some malicious content. This isn't the first time that we see this technique used by threat actors[1].
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, June 2nd, 2026 https://isc.sans.edu/podcastdetail/9954, (Tue, Jun 2nd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, June 1st, 2026 https://isc.sans.edu/podcastdetail/9952, (Mon, Jun 1st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Introduction
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
YARA-X&#;x26;#;39;s 1.17.0 release brings 5 improvements (several performance improvements) and 1 bugfix.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, May 29th, 2026 https://isc.sans.edu/podcastdetail/9950, (Fri, May 29th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Using the data collected over the past year and using Kibana these two ES|QL query to summarize the data, this shows the list of the most uploaded threat to two DShield sensors (local and cloud) over the past year. I have sorted the activity by months that shows the evolution of files uploaded to the sensors each month. The activity peaked during the winter months (Dec 2025 - Feb 2026) and started
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, May 28th, 2026 https://isc.sans.edu/podcastdetail/9948, (Thu, May 28th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
本文由SANS ISC发布，重点讨论了Akira勒索软件攻击链的早期重建方法。作者指出，大多数关于Akira的分析文章仅关注勒索信或加密流程，而此时关键的取证工作已经结束。防御者真正关心的问题在于攻击者如何进入网络、何时获得域管理员权限，以及在加密二进制文件触发之前执行了哪些操作。这些答案存在于影响发生前几天的日志中，特别是两个通常被孤立分析的日志源：边界防火墙的日志和Windows事件通道的日志。通过将这两个日志源关联起来，安全团队可以重建Akira的完整攻击链，从而更早地发现入侵迹象，并采取相应的防御措施。本文提供了概念性框架，但未公开具体的技术细节、IoCs或攻击步骤。
💡 影响/原因: 本文提出了一种通过整合防火墙和端点日志来早期发现Akira勒索软件入侵的方法，帮助防御者在加密发生前识别攻击活动，从而降低损失。
🎯 建议动作: 建议安全团队将边界防火墙日志与Windows事件日志进行关联分析，建立基线并监控异常的网络连接和身份验证行为，以在Akira攻击的早期阶段检测到横向移动和权限提升。
ISC Stormcast For Wednesday, May 27th, 2026 https://isc.sans.edu/podcastdetail/9946, (Wed, May 27th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, May 26th, 2026 https://isc.sans.edu/podcastdetail/9944, (Tue, May 26th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Introduction
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Microsoft Access files (Microsoft Office&#;x26;#;39;s Database) can contain VBA code.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&#;x26;#;39;s own internal codebase, it trojanized an officially Microsoft-published Python SDK, and it appears to have open-sourced its own framework on GitHub.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&#;x26;#;39;s own internal codebase, it trojanized an officially Microsoft-published Python SDK, and it appears to have open-sourced its own framework on GitHub.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This week, I'm attending the SEC670[1] training (“Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Controlâ€). From my point of view, this training fits perfectly with FOR610 or FOR710 (malware analysis) because it addresses malware from the opposite: Instead of performing reverse engineering, you write malicious code! Always interesting to have another point of view.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I found a Node.js stealer that looked pretty well obfuscated. The file was not running out-of-the-box because it was uploaded on VT as “extracted-decoded.js†(and reformated). The SHA256 is 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9[1]. It did not run properly in a sandbox so only a static analysis was performed.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, May 22nd, 2026 https://isc.sans.edu/podcastdetail/9942, (Fri, May 22nd)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Recently, Rob wrote about a tool, Proxifier, that can intercept requests from specific processes. Proxifier is available for Windows, macOS, and Android. But I have not seen a generic Linux option yet. The advantage of a tool like Proxifier is the ability to target specific software. For debugging, reverse engineering, and similar tasks, selecting a specific process is quite useful, as it creates
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, May 21st, 2026 https://isc.sans.edu/podcastdetail/9940, (Thu, May 21st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, May 20th, 2026 https://isc.sans.edu/podcastdetail/9938, (Wed, May 20th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, May 19th, 2026 https://isc.sans.edu/podcastdetail/9936, (Tue, May 19th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Since the last update, the TeamPCP supply chain campaign produced its loudest stretch since the March Trivy disclosure: an officially confirmed Checkmarx Jenkins plugin compromise and a new self-spreading Mini Shai-Hulud worm across npm and PyPI.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[Guest Diary] New Malware Libraries means New Signatures, (Fri, May 15th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, May 15th, 2026 https://isc.sans.edu/podcastdetail/9934, (Fri, May 15th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Besides serving as a place where Microsoft Outlook places suspected spam, the Outlook Junk folder has one additional function that can be quite helpful when it comes to identifying malicious messages. Any e-mail placed in this folder is stripped of all formatting, and destinations of all links included in the message become visible to the user, as you can see in the following images which show the
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, May 14th, 2026 https://isc.sans.edu/podcastdetail/9932, (Thu, May 14th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
&#;x26;#;x5b;This is a Guest Diary by Joshua Nikolson, an ISC Intern and part of the SANS.edu Bachelor&#;x26;#;39;s degree in Applied Cybersecurity (BACS) program.]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, May 13th, 2026 https://isc.sans.edu/podcastdetail/9930, (Wed, May 13th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
.. if “unproxyable†is a word that is ..
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
微软于2026年5月12日发布了本月的安全更新（Patch Tuesday），共修复了137个安全漏洞，涉及Windows、Office、Exchange Server、.NET Framework、Visual Studio等多个核心产品。其中包含多个严重等级漏洞，可能导致远程代码执行、权限提升或拒绝服务。此外，本次更新还一并修复了影响Microsoft Edge浏览器的137个Chromium相关漏洞（通常为内存安全等问题）。这些漏洞中有部分被标记为“重要”或“严重”，但根据公开信息，尚未有证据表明任何漏洞已在野外被利用。系统管理员应优先安排补丁部署，尤其是面向互联网的系统。由于补丁数量庞大，建议使用自动化工具进行管理，并关注后续可能出现的利用尝试。此次更新延续了微软近年来每月修复大量漏洞的趋势，再次凸显了及时修补的重要性。
💡 影响/原因: 本次更新修复了137个安全漏洞及137个Edge相关漏洞，数量庞大，其中可能存在高风险漏洞。及时部署补丁是防御攻击的关键。
🎯 建议动作: 立即评估受影响系统范围，优先安装关键漏洞补丁；使用WSUS或类似工具批量部署；关注后续安全公告；对Edge浏览器进行更新。
ISC Stormcast For Tuesday, May 12th, 2026 https://isc.sans.edu/podcastdetail/9928, (Tue, May 12th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Apple today released its typical feature update across it&#;x26;#;39;s operating systems (iOS, iPadOS, macOS, tvOS, watchOS, vision OS). With this update, Apple patched 84 different vulnerabilities. Updates are available for the "26" series of operating systems, as well as for the previous "18" version of iOS/iPadOS, and two versions back for macOS (version 14 and 15).
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A few months ago, I implemented Cloudflare&#;x26;#;39;s Turnstile CAPTCHA on some pages. The reason for implementing these CAPTCHAs is obvious: Bots make up a large percentage of traffic and affect site performance.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, May 11th, 2026 https://isc.sans.edu/podcastdetail/9926, (Mon, May 11th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
YARA-X&#;x26;#;39;s 1.16.0 release brings 4 improvements and 4 bugfixes.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Less than two weeks after the public disclosure of the Copy Fail vulnerability (CVE-2026-31431), another local privilege escalation (LPE) vulnerability in the Linux kernel has been revealed. Referred to as "Dirty Frag," this vulnerability was discovered and reported by Hyunwoo Kim (@v4bel) [1]. In this diary, I will provide a brief background on Dirty Frag, and discuss its relationship to Copy Fai
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, May 8th, 2026 https://isc.sans.edu/podcastdetail/9924, (Fri, May 8th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, May 7th, 2026 https://isc.sans.edu/podcastdetail/9922, (Thu, May 7th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by Eric Roldan, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, May 6th, 2026 https://isc.sans.edu/podcastdetail/9920, (Wed, May 6th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Yup, that is for real.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
I just got an email from SSL.com last night, they are rotating &#;x26;#;xc2;&#;x26;#;xa0;out their root certificate today (May 5,2026). &#;x26;#;xc2;&#;x26;#;xa0;This is normal, business as usual stuff for a CA, but certificates get used for all kinds of things, and sometimes they aren&#;x26;#;39;t used like they should be, so sometimes hiccups happen.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, May 5th, 2026 https://isc.sans.edu/podcastdetail/9918, (Tue, May 5th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Summary
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This week, I will release a few updates to our DShield honeypot. The update should happen automatically if you have "automatic updates" enabled on your system. There will be two major changes:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Monday, May 4th, 2026 https://isc.sans.edu/podcastdetail/9916, (Mon, May 4th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Wireshark release 4.6.5 fixes 43 vulnerabilities (38 CVEs) and 35 bugs.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Introduction
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Friday, May 1st, 2026 https://isc.sans.edu/podcastdetail/9914, (Fri, May 1st)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Thursday, April 30th, 2026 https://isc.sans.edu/podcastdetail/9912, (Thu, Apr 30th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
[This is a Guest Diary by James Roberts, an ISC intern as part of the SANS.edu BACS program]
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Today, two different "new" requests hit our honeypots. Both appear to be recon requests and not associated with specific vulnerabilities. But as always, please let me know if you have additional information
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Wednesday, April 29th, 2026 https://isc.sans.edu/podcastdetail/9910, (Wed, Apr 29th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This weekend, we saw a few requests to our honeypot that included an "X-Vercel-Set-Bypass-Cookie" header. A sample request:
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
ISC Stormcast For Tuesday, April 28th, 2026 https://isc.sans.edu/podcastdetail/9908, (Tue, Apr 28th)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
This update succeeds&#;x26;#;xc2;&#;x26;#;xa0;TeamPCP Supply Chain Campaign Update 007, published April 8, 2026, which left the campaign in credential-monetization mode following the Cisco source code theft via Trivy-linked credentials, Google GTIG&#;x26;#;39;s formal designation of the operators as UNC6780 (with their credential stealer named SANDCLOCK), and the lapsed CISA KEV remediation deadli
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估