Project
Threat-monitoring service of the SANS Institute that gathers data from distributed sensors and publishes daily analyst diaries and the Stormcast podcast.
Two new Python scripts on GitHub rebuild OpenCode and Hermes AI agent activity for incident responders, according to an isc.sans.edu diary. Both accept a time range and evidence collected from the system under investigation, such as a mounted image or tarball.
Reality
ReliaQuest reports ransomware actors are exploiting CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS GlobalProtect and Prisma Access. The Bedrock Agents credential flaw Zenity found is already fixed.
Reality
GitLab patched CVE-2026-97229, an integer overflow in its CI/CD regex compiler that lets unauthenticated users run code on self-managed servers. Separately, Let's Encrypt's 64-day production certificates start February 10, 2027, so renewal automation needs a test run first.
Reality
Phishing emails carrying fake PDF invoices are installing Action1's remote-management agent, SANS ISC handler Xavier Mertens reported. It follows a ScreenConnect campaign he documented a few days earlier that used the same fake-invoice lure.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
Outlaw/Dota's 2022-era SSH client produced 618 sessions on one Cowrie honeypot in late September 2026, while a new client generation produced 3. A detection rule holding only the hassh published in May would have matched none of the 618.
Reality
Microsoft's July update fixes 622 vulnerabilities, 62 of them rated critical. The two it says attackers are already using, in AD FS and SharePoint Server, sit below that line, so exploited status has to order the work.
Reality
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Reality