Gov Alerts / ISAC

A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

Introduction

ISC Stormcast For Friday, September 25th, 2026 https://isc.sans.edu/podcastdetail/10110, (Fri, Sep 25th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

Overview ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an at…

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution.…

Multiple Vulnerabilities in IBM Concert Software Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in IBM Concert Software, the most severe of which could allow for remote code execut…

VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability

Overview Door access controllers used on Norwegian Cruise Line (NCL) ships contain an improper authentication vulnerability that p…

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitat…

One URL, Three Different Tricks, (Thu, Sep 24th)

Yesterday, we received a phishing email with an interesting link. At first sight, it looks like garbage, but every piece of it has…

ISC Stormcast For Thursday, September 24th, 2026 https://isc.sans.edu/podcastdetail/10108, (Thu, Sep 24th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

VU#273940: Enterprise Access Management EAM does not rotate RSA keys

Overview Imprivata Enterprise Access Management (EAM), an authentication and single sign-on platform for enterprise and clinical e…

VU#754548: Cinnamon's kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

Overview Cinnamon's Kotaemon (all versions up to v0.12.0) multi‑user chat interface does not verify conversation ownership when lo…

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution…

CISA Whitepaper Charts Path to Establishing and Maturing CVE Program Quality

A Vulnerability in F5 BIG-IP Access Policy Manager Could Allow for Remote Code Execution

A vulnerability has been discovered in F5 BIG-IP Access Policy Manager (APM) that could allow for remote code execution. BIG-IP AP…

ISC Stormcast For Wednesday, September 23rd, 2026 https://isc.sans.edu/podcastdetail/10106, (Wed, Sep 23rd)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Macfinger ClickFix campaign, (Tue, Sep 22nd)

Introduction

VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as…

The Truth about GET and HTTP Standards, (Tue, Sep 22nd)

On Friday, Xavier talked about the newly introduced HTTP Query method. This new method was introduced to allow "GET" requests that…

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploita…

ISC Stormcast For Tuesday, September 22nd, 2026 https://isc.sans.edu/podcastdetail/10104, (Tue, Sep 22nd)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitatio…

TerminalFix: PNG Steganography, (Mon, Sep 21st)

Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage i…

ISC Stormcast For Monday, September 21st, 2026 https://isc.sans.edu/podcastdetail/10102, (Mon, Sep 21st)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitat…

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitatio…

CISA Hosts Cyber Storm X, Nationwide Cybersecurity Exercise to Strengthen Resilience

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: "QUERY". The HTTP protocol faced already by changes (HTT…

ISC Stormcast For Friday, September 18th, 2026 https://isc.sans.edu/podcastdetail/10100, (Fri, Sep 18th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Multiple Vulnerabilities in Oracle Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Oracle products, the most severe of which could allow for arbitrary code executio…

LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)

At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The messag…