Sans News Feed
- (Reliable)? php2shell exploitability, (Fri, Oct 23rd) October 23, 2026Yesterday everyone was running around like crazy (me included 🙂 because of the php2shell vulnerability.
- PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) October 23, 2026This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".
- ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd) October 23, 2026
- ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd) October 22, 2026
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st) October 21, 2026PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
- ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st) October 21, 2026
- ISC Stormcast For Tuesday, October 20th, 2026 https://isc.sans.edu/podcastdetail/10142, (Tue, Oct 20th) October 20, 2026
- Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th) October 18, 2026Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".
- ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140, (Fri, Oct 16th) October 16, 2026
- Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th) October 16, 2026I believe the cybersecurity industry may be approaching AI security the wrong way.