A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
SANS Stormcast Tuesday, November 10th, 2026: SAP NetWeaver Webshells (CVE-2025-31324); N-able N-central Offline; Chrome XML 0-Day (CVE-2026-125350); Outlook DMARC Required
November 09, 2026
5:33
0.9 MB ( 3.76 MB less)
Downloads: 0
Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting mail without DMARC.
Attackers Searching for SAP NetWeaver Webshells
ISC honeypots are seeing probes for ant.jsp and related paths tied to SAP NetWeaver CVE-2025-31324, a CVSS 10 unauthenticated file-upload flaw attackers still use to plant webshells even after recent patches. Watch /irj/servlet_jsp/irj/root/ and other upload endpoints for leftover shells.
https://isc.sans.edu/diary/Attackers%20Searching%20for%20SAP%20Netweaver%20Webshells/33502
N-able N-central Critical Security Incident
N-able took Hosted N-central offline after public disclosure of roughly 30+ critical vulnerabilities with no patches yet, and advises on-premises customers to take servers offline if not isolated; no exploitation observed so far, with remediation said to be on track.
https://uptime.n-able.com/
https://labs.beazley.security/advisories/BSL-A1242
Google Chrome Zero-Day Patch (CVE-2026-125350)
Chrome stable updates fix nine vulnerabilities, including CVE-2026-125350, a use-after-free in the XML parser that Google says is already exploited in the wild. Update promptly; the advisory does not confirm a sandbox escape.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Strict Outlook DMARC Policies
Outlook is rejecting mail with 550 errors when the sending domain lacks a DMARC record, even if SPF and DKIM pass. Publish at least a DMARC record (for example p=none) alongside SPF and DKIM.
https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim
SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich