A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
SANS Stormcast Thursday, November 5th, 2026: Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws
November 05, 2026
5:47
1.07 MB ( 3.78 MB less)
Downloads: 0
Today's Stormcast covers honeypot scans for leftover email test scripts, HD Moore's runZero oobscan for out-of-band management interfaces, a critical apt signature-bypass flaw (CVE-2026-109518), and unpatched SonicWall GMS end-of-life vulnerabilities.
The Classics Return: Vulnerable E-Mail Scripts
Internet Storm Center honeypots are seeing probes for development email test scripts such as sendmail.php and test-mail.php. Like the classic FormMail script, these can leak environment variables and let attackers send spam through GET or POST parameters, so keep them out of production.
https://isc.sans.edu/diary/The%20Classics%20Return%3A%20Vulnerable%20E-Mail%20Scripts/33488
oobscan: Scan for Out-of-Band Management Interfaces
HD Moore's runZero oobscan hunts exposed BMC, IPMI, SNMP, and IP KVM style out-of-band management interfaces and flags known vulnerabilities on those devices rather than only listing open ports.
https://github.com/runZeroInc/oobscan#research-and-disclosures
apt Signature Bypass (CVE-2026-109518)
A critical flaw in Debian's apt package manager can skip signature verification when a package web server returns crafted error responses, letting an on-path attacker inject malicious packages over HTTP. Prefer HTTPS where your distribution allows it; Ubuntu still often uses HTTP by default. Debian and Ubuntu have published updates for CVE-2026-109518.
https://lists.debian.org/deity/2026/11/msg00005.html
https://ubuntu.com/blog/apt-vulnerability-fixes-available
https://security-tracker.debian.org/tracker/CVE-2026-109518
SonicWall GMS End of Life: Unpatched File Read and SQL Injection
SonicWall Global Management System (GMS) 9.5.2 and earlier are end of life, and SonicWall will not fix an unauthenticated file read (CVE-2026-109593) or an authenticated SQL injection (CVE-2026-109594). Migration to Network Security Manager (NSM) is the vendor path forward.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019
https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html
https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1456/
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich