SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Microsoft's November Patch Tuesday, Apple's iOS and macOS updates, and SAP's Security Patch Day all arrived this week, including an already exploited Outlook spoofing bug and four SAP flaws with a perfect CVSS score of 10.

Microsoft Patch Tuesday

Microsoft is addressing 1,260 vulnerabilities this month, 68 of them critical, including 167 Chromium issues that affect Microsoft Edge. One already exploited Outlook spoofing vulnerability, CVE-2026-124194, may hide the risk of a file being opened, in a Mark of the Web style issue, though Microsoft does not rate it critical. Other notable critical issues include a Lightweight Directory Access Protocol (LDAP) remote code execution flaw in Active Directory environments (CVE-2026-119958), five critical Microsoft Queuing and Queue Manager bugs, and a Windows TCP/IP remote code execution vulnerability (CVE-2026-113859) that Microsoft rates critical despite a 7.5 Common Vulnerability Scoring System (CVSS) score.

https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+November+2027/33508

Apple Patches

Apple released updates for iOS, iPadOS, macOS, watchOS, and visionOS that fix only nine vulnerabilities, with iPadOS and macOS patches going back to version 18, watchOS one version back, and visionOS only for the current release. Most of the issues weaken the Bluetooth handshake so an attacker can pair with a phone or Mac, and there are also AirPlay rate-limiting problems; one vulnerability only affects an older iOS release and lets an attacker with physical access pair a locked device with an AirPlay receiver. A more notable iMessage issue may let someone join a group and receive its messages without being invited. Apple states that none of these bugs are being exploited.

https://isc.sans.edu/diary/Apple+Patches+Everyting+November+2026+Edition/33506/

SAP Patch Tuesday

SAP's November Security Patch Day, issued in sync with Microsoft's, includes four vulnerabilities with a perfect CVSS score of 10, three more at 9.9, and two more in the nines, including issues in SAP NetWeaver. Onapsis reported a broken access control flaw in SAP Gateway (CVE-2026-89103) tied to the proxy access control list, and a WebSocket memory-corruption bug that Onapsis has shown as a denial of service but says can also allow remote code execution (CVE-2026-76964 and CVE-2026-89126).

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html

https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/

https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting mail without DMARC.

Attackers Searching for SAP NetWeaver Webshells

ISC honeypots are seeing probes for ant.jsp and related paths tied to SAP NetWeaver CVE-2025-31324, a CVSS 10 unauthenticated file-upload flaw attackers still use to plant webshells even after recent patches. Watch /irj/servlet_jsp/irj/root/ and other upload endpoints for leftover shells.

https://isc.sans.edu/diary/Attackers%20Searching%20for%20SAP%20Netweaver%20Webshells/33502

N-able N-central Critical Security Incident

N-able took Hosted N-central offline after public disclosure of roughly 30+ critical vulnerabilities with no patches yet, and advises on-premises customers to take servers offline if not isolated; no exploitation observed so far, with remediation said to be on track.

https://uptime.n-able.com/

https://labs.beazley.security/advisories/BSL-A1242

Google Chrome Zero-Day Patch (CVE-2026-125350)

Chrome stable updates fix nine vulnerabilities, including CVE-2026-125350, a use-after-free in the XML parser that Google says is already exploited in the wild. Update promptly; the advisory does not confirm a sandbox escape.

https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

Strict Outlook DMARC Policies

Outlook is rejecting mail with 550 errors when the sending domain lacks a DMARC record, even if SPF and DKIM pass. Publish at least a DMARC record (for example p=none) alongside SPF and DKIM.

https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim

SANS Difference Makers Vote

https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

ISC honeypots seeing sshole (CVE-2026-123158) exploitation attempts; SonicWall patches seven SonicOS flaws including an already-exploited SSL VPN MFA bypass; Microsoft cloud-fixed an Entra Device Registration elevation-of-privilege bug; Apiiro found Claude Code saving secrets into .claude/settings.local.json on GitHub.

Scans for sshole Vulnerability (CVE-2026-123158)

ISC honeypots are seeing long letter-A passwords that look like sshole exploitation, with clear attempts starting November 5th after earlier long passwords that were mostly buggy brute-force scripts dumping shell commands into the password field. Honeypots only keep the first 255 characters of each password, which limits what can be measured.

https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498

SonicWall SonicOS Multiple Vulnerabilities (SNWLID-2026-0014)

On Friday SonicWall released patches for seven SonicOS vulnerabilities; one already-exploited flaw lets attackers bypass multi-factor authentication for SSL VPN logins when an alternate authentication method without MFA is also defined. Patch promptly press and CISA associate the exploited issue with CVE-2026-19868.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/

Entra Device Registration Elevation of Privilege (CVE-2026-109469)

Microsoft patched an authorization bypass in Entra Device Registration over the weekend that could let an unauthorized attacker elevate privileges. No customer action is required: it is a Microsoft-hosted cloud service, and Microsoft says there was no exploitation at the time of the fix and rates future exploitation less likely.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469

Claude Code Leaking Secrets on GitHub

Apiiro reports that Anthropic's Claude Code can store credentials in .claude/settings.local.json when you tell it not to ask again about an API or command, and that on the order of a thousand-plus of those credential files have shown up on GitHub. ISC web honeypots also saw new requests for the .claude directory this weekend; rotate exposed secrets and watch for Anthropic updates.

https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again

https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html

SANS Difference Makers Vote

https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today: RootEvidence Cisco IOS vulnerability scans with HTTP opt-out headers; a critical OpenSSH password bypass on musl (sshole / CVE-2026-123158); a U.S. government factsheet on hardening industrial refrigeration OT; and an actively exploited Zyxel GS1900 out-of-bounds write (CVE-2026-107441).

RootEvidence Cisco IOS Scans / Opt-Out Headers

ISC honeypots saw Cisco IOS vulnerability scans from exposure-management firm RootEvidence. Unlike typical Internet-wide scanners, their HTTP requests include Opt-Out-Email and Opt-Out-Url headers so administrators can request exclusion.

https://isc.sans.edu/diary/Vulnerability%20Scans%20for%20Older%20Cisco%20IOS%20Vulnerability%20%20%20Opt-Out%20Headers/33492

https://www.rootevidence.com/scanners/

OpenSSH musl Password Bypass (sshole / CVE-2026-123158)

A critical password-authentication bypass affects OpenSSH on musl libc systems (Alpine Linux, OpenWrt, and similar) when sshd allows password logins without libpam. Passwords longer than 256 characters can authenticate accounts that have no password set (shadow field "*"). Details and walkthrough at sshhole.com; fixed in OpenSSH 10.6p2.

https://sshhole.com/

https://nvd.nist.gov/vuln/detail/CVE-2026-123158

https://www.openssh.org/txt/release-10.6p2

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

Guidance to Secure Refrigeration / Cold-Chain Systems

U.S. government agencies published a joint factsheet urging owners of industrial refrigeration and cold-chain monitoring systems to harden them after grocery-store and military-base fridge attacks that spoiled large amounts of food. Advice is largely standard OT hygiene (reduce Internet exposure, isolate OT, credential security, patching) and applies beyond refrigeration.

https://www.cisa.gov/sites/default/files/2026-11/joint-factsheet-usg-partners-urge-hardening-industrial-refrigeration-cold-chain-monitoring-systems-508c.pdf

Zyxel GS1900 Out-of-Bounds Write Exploited (CVE-2026-107441)

Zyxel released firmware updates for GS1900 series switches fixing an out-of-bounds write that is being exploited in the wild. Binarly found a Python exploit in a malware repository; attacks steal configuration data including hashed passwords. The advisory says the attacker needs network access. Patch to 2.90 Patch 3 builds.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

https://www.binarly.io/advisories/brly-2026-057

https://nvd.nist.gov/vuln/detail/CVE-2026-107441

SANS Difference Makers Vote

https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

Today's Stormcast covers honeypot scans for leftover email test scripts, HD Moore's runZero oobscan for out-of-band management interfaces, a critical apt signature-bypass flaw (CVE-2026-109518), and unpatched SonicWall GMS end-of-life vulnerabilities.

The Classics Return: Vulnerable E-Mail Scripts

Internet Storm Center honeypots are seeing probes for development email test scripts such as sendmail.php and test-mail.php. Like the classic FormMail script, these can leak environment variables and let attackers send spam through GET or POST parameters, so keep them out of production.

https://isc.sans.edu/diary/The%20Classics%20Return%3A%20Vulnerable%20E-Mail%20Scripts/33488

oobscan: Scan for Out-of-Band Management Interfaces

HD Moore's runZero oobscan hunts exposed BMC, IPMI, SNMP, and IP KVM style out-of-band management interfaces and flags known vulnerabilities on those devices rather than only listing open ports.

https://github.com/runZeroInc/oobscan#research-and-disclosures

apt Signature Bypass (CVE-2026-109518)

A critical flaw in Debian's apt package manager can skip signature verification when a package web server returns crafted error responses, letting an on-path attacker inject malicious packages over HTTP. Prefer HTTPS where your distribution allows it; Ubuntu still often uses HTTP by default. Debian and Ubuntu have published updates for CVE-2026-109518.

https://lists.debian.org/deity/2026/11/msg00005.html

https://ubuntu.com/blog/apt-vulnerability-fixes-available

https://security-tracker.debian.org/tracker/CVE-2026-109518

SonicWall GMS End of Life: Unpatched File Read and SQL Injection

SonicWall Global Management System (GMS) 9.5.2 and earlier are end of life, and SonicWall will not fix an unauthenticated file read (CVE-2026-109593) or an authenticated SQL injection (CVE-2026-109594). Migration to Network Security Manager (NSM) is the vendor path forward.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html

https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1456/

SANS Difference Makers Vote

https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich