A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
November 02, 2026
6:14
1.03 MB ( 4.21 MB less)
Downloads: 0
Today's episode covers how to detect multipath TCP in your network, attacks stealing Bitcoin and Litecoin from outdated BTCPay Server installs, Barracuda patches for an authorization bypass and command injection in Email Security Gateway and other appliances, and Synology's warning about ransomware hitting outdated DSM devices.
Multipath TCP: Use and Detection
Multipath TCP (MPTCP), back in the news because of the Linux vulnerability CVE-2026-98432, is identified by TCP option 30 and is most commonly used by iOS devices connecting to Apple's 17.0.0.0/8 network for Siri and Apple Music. The diary explains the MPTCP subtypes and how to spot them with Wireshark, tcpdump, Suricata and Zeek.
https://isc.sans.edu/diary/Mutipath%20TCP%3A%20Use%20and%20Detection/33482
Security Incident Affecting BTCPay Server 2.4.1 and Earlier
Attackers stole Bitcoin and Litecoin from hot wallets on BTCPay Server instances running version 2.4.1 or earlier by exploiting a vulnerability fixed in 2.4.2 (August 7, 2026). BTCPay recommends that affected operators sweep remaining funds to a new wallet, rebuild on a fresh server, and replace any exposed credentials.
https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/
Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products
Barracuda patched an authorization bypass (CVE-2026-116606, CVSS 9.3) affecting the Email Security Gateway (ESG) and a command injection (CVE-2026-111560, CVSS 8.6) affecting ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. Chained on ESG, they can give an attacker with access to the admin interface root access, so keep admin interfaces off the internet.
https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
Synology urges users to update DSM following ransomware attacks on outdated DSM versions
Synology warns that ransomware attackers are exploiting a vulnerability patched in December 2024 (Synology-SA-24:20) on devices still running outdated versions of DSM (DiskStation Manager). Update DSM now and enable automatic updates.
https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions
https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich