Wireshark 4.6.5 Released https://isc.sans.edu/diary/32944

ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942

SANS Stormcast Friday, May 1st, 2026: Libredtail; FreeBSD dhclient vuln; Linux Copy-Fail; @sans_edu Detecting AI Pickling https://isc.sans.edu/podcastdetail/9914

SANS Stormcast Thursday, April 30th, 2026: Odd Requests; MSFT LNK Bug Exploited; Secure Boot Fix; TLS Updates; SAP npm malware https://isc.sans.edu/podcastdetail/9912

Danger of Libredtail [Guest Diary] https://isc.sans.edu/diary/32936

Today's Odd Web Requests https://isc.sans.edu/diary/32934

SANS Stormcast Wednesday, April 29th, 2026: Odd Vercel Header Usage; GitHub Vuln Patches; MSFT RDP Notification Bug https://isc.sans.edu/podcastdetail/9910

HTTP Requests with X-Vercel-Set-Bypass-Cookie Header https://isc.sans.edu/diary/32930

SANS Stormcast Tuesday, April 28th, 2026: More TeamPCP; Citrix XenServer Unpatched Vulns; Phantom RPC; https://isc.sans.edu/podcastdetail/9908

TeamPCP's 26-day pause ended hard: Checkmarx KICS Docker images poisoned, cascading into Bitwarden C https://isc.sans.edu/diary/32926

SANS Stormcast Friday April 24rd, 2026: Apple Update; Bitwarden Compromise; ASP.NET Core Patch https://isc.sans.edu/podcastdetail/9906

Apple Patches Exploited Notification Flaw https://isc.sans.edu/diary/32922

SANS Stormcast Thursday, April 23rd, 2026: Stealing Telegram Sessions; Oracle CPU; Firefox Patches https://isc.sans.edu/podcastdetail/9904

SANS Stormcast Wednesday, April 22nd, 2026: WAV Malware; GitHub OAUTH Phishing; Perforce Settings https://isc.sans.edu/podcastdetail/9902

Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector – Lessons from a Honeypot I https://isc.sans.edu/diary/32888

A .WAV With A Payload https://isc.sans.edu/diary/32910

SANS Stormcast Tuesday, April 21st, 2026: CVE and EPSS; Windows Server 2025 OOB; QEMU Abuse; https://isc.sans.edu/podcastdetail/9900

Handling the CVE Flood With EPSS https://isc.sans.edu/diary/32914

SANS Stormcast Monday, April 20th, 2026: Lumma Stealer and Sectop RAT; Windows 0-Day Exploited; NIST NVD Update; FortiSandbox PoC https://isc.sans.edu/podcastdetail/9898

SANS Stormcast Friday, April 17th, 2026: DVRs Again; Cisco Again; Windows Defender Again; Sonatype https://isc.sans.edu/podcastdetail/9896

ISC Diary: #LummaStealer infection with #SectopRAT (#ArechClient2) https://isc.sans.edu/diary/32904

SANS Stormcast Thursday, April 16th, 2026: AI Credential Scans; Microsoft Update Issues; RDP Warnings; GitHub Action Vulns; https://isc.sans.edu/podcastdetail/9894

Compromised DVRs and Finding Them in the Wild https://isc.sans.edu/diary/32886

SANS Stormcast Wednesday, April 15th, 2026: Microsoft, Adobe, Fortinet and others Patches https://isc.sans.edu/podcastdetail/9892

Scanning for AI Models https://isc.sans.edu/diary/32896

Microsoft Patch Tuesday April 2026. https://isc.sans.edu/diary/32898

SANS Stormcast Tuesday, April 14th, 2026: EncystPHP Webshell; CPUID Compromise; OpenAI Mac Cert Issue; Axios Vulnerability https://isc.sans.edu/podcastdetail/9890

Scans for EncystPHP Webshell https://isc.sans.edu/diary/32892

SANS Stormcast Monday, April 13th, 2026: Obfuscated JavaScript; Numbers in Passwords; Adobe Patches 0-Day; ClickFix Fix Bypass https://isc.sans.edu/podcastdetail/9888

Application Control Bypass for Data Exfiltration https://isc.sans.edu/diary/32850

ISC Diary: ClickFix Attacks Still Using the Finger https://isc.sans.edu/diary/32566

XWorm Cocktail:  A Mix of PE data with PowerShell Code https://isc.sans.edu/diary/31700

Obfuscated JavaScript or Nothing https://isc.sans.edu/diary/32884

SANS Stormcast Thursday, April 9th, 2026: Honeypot Fingerprinting; Microsoft Locks Developer Accounts; ActiveMQ Vuln; https://isc.sans.edu/podcastdetail/9886

Number Usage in Passwords: Take Two https://isc.sans.edu/diary/32866

TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google https://isc.sans.edu/diary/32880

More Honeypot Fingerprinting Scans https://isc.sans.edu/diary/32878

SANS Stormcast Wednesday, April 8th, 2026: Pivoting for Webshells; WatchGuard Firebox Patch; Project Glasswing; Kubernetes Misconfigurations https://isc.sans.edu/podcastdetail/9884

A Little Bit Pivoting: What Web Shells are Attackers Looking for? https://isc.sans.edu/diary/32874

SANS Stormcast Tuesday, April 7th, 2026: Redirects in Phishing; Internet Bug Bounty Suspended; Bluehammer; Keycloak MFA Bypass https://isc.sans.edu/podcastdetail/9882

How often are redirects used in phishing in 2026? https://isc.sans.edu/diary/32870

SANS Stormcast Monday, April 6th, 2026: TeamPCP Update and Axio Post Mortem; Fortinet 0-Day https://isc.sans.edu/podcastdetail/9880

TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sport https://isc.sans.edu/diary/32864

SANS Stormcast Friday, April 3rd, 2026: Vite Exploits; OpenSSH 10.3; Claude Code Vuln https://isc.sans.edu/podcastdetail/9878

Attempts to Exploit Exposed "Vite" Installs (CVE-2025-30208) https://isc.sans.edu/diary/32860

SANS Stormcast Thursday, April 2nd, 2026: Script Removing ADS/MotW; Google Chrome 0-Day; iOS/iPadOS 18 Update; https://isc.sans.edu/podcastdetail/9876

TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud https://isc.sans.edu/diary/32856

Malicious Script That Gets Rid of ADS https://isc.sans.edu/diary/32854

SANS Stormcast Wednesday, April 1st, 2026: Application Control Bypass; Axios NPM Module Compromise; TeamPCP vs Cloud https://isc.sans.edu/podcastdetail/9874

SANS Stormcast Tuesday, March 31st, 2026: Honeypot Session Lifetime; Let’s Encrypt Tests Mass Revocation; F5 RCE Exploited https://isc.sans.edu/podcastdetail/9872