Podcast Detail

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10140.mp3

previous
Podcast Logo
Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity.

Panchan's Mining Island [Guest Diary]
SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis.
https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5BGuest%20Diary%5D/33426

Cisco Secure Email Gateway 0-Day (CVE-2026-76519)
With the reputation feature enabled, the advanced malware protection feature lets attackers write arbitrary files and execute code as root. The flaw is already exploited and there is no workaround, so patch and review Cisco's indicators of compromise.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

Palo Alto Networks 0-Day (CVE-2026-0322)
An already exploited, authenticated remote code execution vulnerability that runs code as root. Exploitation requires an exposed management interface.
https://security.paloaltonetworks.com/CVE-2026-0322

Ivanti Connect Secure 0-Day (CVE-2026-104935)
Volexity found three chained vulnerabilities: an authentication bypass, an arbitrary file write leading to remote code execution, and a privilege escalation. Ivanti patched the first two under one CVE; the privilege escalation appears unpatched.
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

No Podcast on Monday, Oct. 19th.

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Friday October 16th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Amsterdam, Netherlands. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Incident Response. In Diaries today we have yet another
 diary from one of our undergraduate interns, Zachary
 Norwood. And Zachary is writing about Panchan's Mining
 Island. Panchan's worm is a crypto miner worm. It's
 spreading via SSH to Unix systems and then, well, it
 gains a foothold by first of all stealing SSH keys in order
 to gain access to possibly other systems, but also
 installing a rootkit in order to gain persistence on the
 system. This worm is a little bit different than like from
 your average Mirai worm and similar worm that of course
 are still very commonly infecting insecure Linux
 systems, in particular via bad SSH passwords. It is written
 in Golang, so that's a little bit unusual. And also does
 implement some peer-to-peer command control channel where
 this particular specimen that Zachary looked at was using
 Discord as one of its command and control channels. Now, one
 way that Zachary used to analyze this worm and figure
 out what the worm was actually doing and what it was after
 was the use of the FakeNet-NG package. FakeNet-NG allows you
 to essentially simulate a network environment for
 malware and then just use simple dynamic analysis, which
 tends to be sort of the quickest way to get an
 overview of what commodity malware like this worm is
 doing on your system. And that's also how Zachary then
 discovered, for example, the Discord connection. And then
 be aware if you are using the Cisco Secure Email Gateway,
 apparently the advanced malware protection feature of
 this gateway, if you have the reputation feature enabled,
 does it allow hackers to write arbitrary files? Yes, malware
 on the system. And then use these files to execute code as
 root. So it looks like a couple of things went wrong
 here in this particular case, but we have now a little bit
 of history with similar vulnerabilities with the
 secure email gateway. First of all, there's probably some
 kind of directory traversal vulnerability, allowing saving
 of files outside of the intended directory. Secondly,
 yes, to make things more interesting, of course, all
 code is executed as root, in particular for devices that
 have a fairly large attack cross-section like this secure
 email gateway. This vulnerability is already being
 exploited. A patch has been made available, and there is
 no real workaround for this vulnerability. So patch
 quickly and also review Cisco's guidance as to
 detecting indicators of compromise in case your system
 was unlucky enough to be part of that early wave of targets.
 Not to be left behind. Palo Alto also released an update
 for an already attacked vulnerability. And this one is
 also a remote code execution vulnerability. But unlike
 Cisco, at least this one requires authentication.
 However, just like Cisco code is also being executed as
 root. Now in order to exploit this vulnerability, you must
 expose your management interface, something that you
 should certainly avoid and probably know by now if you
 have listened to this podcast a couple times. Either way,
 apply the update. Again, this vulnerability is also already
 being attacked. And well, good things usually come in threes.
 So we also got a zero-day vulnerability that was patched
 by Ivanti a couple days ago. Must have missed it. Sometimes
 hard to keep those zero-days apart. Volexity actually has a
 real good write up about what exactly happened here. And I
 will include a link to Volexity as well as to the
 Ivanti advisory. Volexity identified three different
 vulnerabilities here that are chained to full system
 compromise. The first one is an authentication bypass
 vulnerability followed by an arbitrary file write, speak
 remote code execution vulnerability and then finally
 a privilege escalation of vulnerability. Now Ivanti
 decided to patch the first two vulnerabilities only gave them
 one CVE number. So basically combined both vulnerabilities
 into one. The privilege escalation vulnerability as of
 right now appears to be not yet patched. Also sorry for
 that busy Friday with three different products with
 currently exploited vulnerabilities that you need
 to attend to. Hope you're not running all three to give you
 a little bit more time patching and to avoid
 bothering you with more zero-day vulnerabilities. Also because
 of my travel schedule I will not publish a podcast on
 Monday. So thanks for listening and talk to you
 again on Tuesday. Bye.