Author Archives: SANS Internet Storm Center, InfoCON: yellow

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)→

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.

Continue reading Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 14th, 2021 https://isc.sans.edu/podcastdetail.html?id=7794, (Tue, Dec 14th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 13th, 2021 https://isc.sans.edu/podcastdetail.html?id=7792, (Mon, Dec 13th)→

Analyzing the ISC honeypots&#;x26;#;39; requests, I found out that coin miners just included Log4Shell into their arsenal.

Continue reading Log4Shell exploited to implant coin miners, (Mon, Dec 13th)→

On Thursday, December 9th, LunaSec published a blog post with details regarding a vulnerability in the log4j2 library. This vulnerability became quickly known as “log4shell”, and %%CVE:2021-44228%% was assigned to it [1]. On Friday, Bojan published a post with some technical details regarding the exploitation of this vulnerability [2]. We have also posted some of the attacks we saw via our Twitter account (@sans_isc).

Continue reading Log4j / Log4Shell Followup: What we see and how to defend (and how to access our data), (Sat, Dec 11th)→

Update New Kill Switch Confirmed:

kill switch: ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf[.]com

Sources:

https://virustotal.com/en/file/b9318a66fa7f50f2f3ecaca02a96268ad2c63db7554ea3acbde43bf517328d06/analysis/

https://www.hybrid-analysis.com/samp… Continue reading WannaCry/WannaCrypt Ransomware Summary, (Mon, May 15th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 15th 2017 https://isc.sans.edu/podcastdetail.html?id=5500, (Mon, May 15th)→

Microsoft released information what can be done to protect against WannaCry[1] which includes deploying MS17-010 if not already done (March patch release)[2], update Windows Defender (updated 12 May)[3] and if not using SMBv1 to disable it available he… Continue reading Microsoft Released Guidance for WannaCrypt , (Sat, May 13th)→

———–
Guy Bruneau IPSS Inc.
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading Has anyone Tested WannaCry Killswitch? – https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware/, (Sat, May 13th)→