Redtail Payload Analysis
https://isc.sans.edu/diary/Redtail%20Payload%20Analysis%20%5BGuest%20Diary%5D/33326
Checkpoint Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-8510
https://community.checkpoint.com/t5/General-Topics/Action-Required-Critical-Security-Advisory-VPN-Vulnerabilities/td-p/281995
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
Netscaler ADC Exploit
https://x.com/ethicalhack3r/status/2095480651478663393
Sonicwall SMA1000 Attack
https://hunt.io/blog/sonicwall-sma1000-uk-council-attack
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Scans for Proxmox Servers
https://isc.sans.edu/diary/Scans%20for%20Proxmox%20Servers/33324
Next Nightmare Eclipse Vulnerability
https://github.com/MSNightmare/ShieldCrash/blob/main/README.md
Google Chrome Updates
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
FortiPAM Vulnerability
https://amibeingpwned.com/blog/fortinet-pam-vuln
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

September 2026 Microsoft Patch Tuesday
https://isc.sans.edu/diary/September%202026%20Microsoft%20Patch%20Tuesday/33320
Adobe Security Bulletins
https://helpx.adobe.com/security/security-bulletin.html
Security Advisory Ivanti Neurons for ITSM
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US
Fortinet Advisory
https://www.fortiguard.com/psirt/FG-IR-26-174
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

numbat - AI agent observability
https://isc.sans.edu/diary/numbat%20-%20AI%20agent%20observability/33312
MicroTik SSH 0-Day Exploited
https://mikrotik.com/supportsec/september-2026-vulnerability/
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
Adobe Commerce - Magento - 0-Day Exploited
https://sansec.io/research/stylesmuggler-0day
N-Able 4th Hotpatch
https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF4_Release_Notes.htm
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Nightmare Eclipse Discloses Several Anti-Malware Privilege Escalation Exploits
https://github.com/MSNightmare
Plex Update
https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
Cisco Update
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY
Sangoma Switchvox Exploit
https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Sonicwall SMA1000 Exploited Vulnerability Patched
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
SSRF: The Validator Can Lie
https://xclow3n.com/post/the-validator-can-lie/
Git Hijack for AI Agents
https://www.manifold.security/blog/ai-coding-agents-git-hijack
Fronics Deploy Abuse
https://www.huntress.com/blog/faronics-deploy-abuse
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Guildma (Astaroth) malware infection from Brazilian Portuguese email
https://isc.sans.edu/diary/Guildma%20%28Astaroth%29%20malware%20infection%20from%20Brazilian%20Portuguese%20email/33300
Authentication bypass in EOL Proxmox VE 7 release
https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929
https://gist.github.com/nebusecurity/65fe90dd673d395b7926278d7eaf5849
Updated Windows Server hotpatch calendar
https://learn.microsoft.com/en-us/windows/release-health/windows-server-release-info#windows-server-hotpatch-calendar
Virtualizor BGP Hijacking
https://www.virtualizor.com/blog/security-incident-bgp-hijacking/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary
https://isc.sans.edu/diary/The%20Coding-Agent%20Trap%3A%20When%20a%20%22Free%22%20LLM%20Endpoint%20Is%20the%20Adversary/33298
PaperCut Public Exploit Available
https://github.com/rapid7/metasploit-framework/pull/21842
TerminalFix Campaign;
https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Some Malicious PE Stats
https://isc.sans.edu/diary/Some%20Malicious%20PE%20Stats/33292
PaperCut Releases Two Preliminary Patches for Exploited Vulnerability
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
DLink Vulnerabliities
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10513
Watchguard Patches
https://psirt.watchguard.com
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

A polymorphic phishing page (that occasionally breaks itself)
https://isc.sans.edu/diary/A%20polymorphic%20phishing%20page%20%28that%20occasionally%20breaks%20itself%29/33290
Chinese Implants in the Supply Chain
https://www.vulncheck.com/blog/zbt-darklantern-speakingstone?_sp=1068fa46-3d91-427e-8120-aa6d8bda2912.1787865822277
Data Became Code: We Ran Code Inside Fortune 500s Using Files They Published for AI Agents
https://medium.com/@alonhertz1/data-became-code-we-ran-code-inside-fortune-500s-using-files-they-published-for-ai-agents-0cd67ffbbffc
Papercut Security Advisory
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Who Has Admin Rights in your Entra ID Directory?
https://isc.sans.edu/diary/Who%20Has%20Admin%20Rights%20in%20your%20Entra%20ID%20Directory%3F/33284
Ubiquity Unifi Patches
https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
Log4J FilteredObjectInputStream Vulnerability
https://github.com/joanbono/log4j2-4255-exploit
https://jeffmcjunkin.com/posts/log4j2-fois-marshalledobject/
Sleepwalker Malware
https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich