SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10148.mp3

previous

PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Friday, October 23rd, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Well, let's start with a quick
 summary and update on the PHP vulnerability. Not too much
 new, which is a good thing. There are plenty of patches
 available now from various vendors. There are a couple of
 notable exceptions like QNAP, for example, still hasn't
 published a patch yet for their devices. But again,
 these are the type of devices you probably shouldn't expose
 to the internet in the first place. So you have a little
 bit more time for them to actually apply any patches and
 definitely make sure that they aren't exposed to the
 internet. The same is true for a lot of the other sort of PHP
 driven web admin interface and the like. Make sure that you
 apply any patches as they become available. But also,
 yes, please don't expose them to the internet. As far as
 exploit activity goes, plenty of vibe coded exploits out
 there that may work in some circumstances, but nothing
 sort of that simple, reproducible, reliable at this
 point. So that buys everybody more time to actually apply
 patches. Now, Cloudflare went on the record stating that
 they see an awful lot of exploit activity targeting
 this vulnerability. But again, it's not clear if these are
 actually real working exploits. Amazon also stated
 that they have seen exploit attempts as soon as the 16th.
 So well before this vulnerability sort of was
 publicly under radar at all. Not really sure what to make
 of this. Again, not a lot of detail here. But yes, now the
 vulnerability was discovered quite a while ago. And one of
 the problems you have with these big open source
 projects, of course, is that responsible disclosure means
 that you have to disclose details about a vulnerability
 to dozens, maybe hundreds of different vendors. And yes,
 you know, leaks are going to happen. And that's what sort
 of kicked off the entire issue in the first place. So
 continue to patch, continue to monitor, but at this point, no
 real exploit. When you're looking at exploits, be aware,
 some of them may actually exploit the person running
 them. That's sort of just standard practice at this
 point for some exploit writers. Haven't seen anything like
 this yet, but haven't also been really looking for any
 sort of, you know, parasitic exploits like that. My plan
 right now is to go back to Infocon Green sometime
 tomorrow on Friday. Well, but let's start to look at some of
 the vulnerabilities that we may have missed this week with
 all the focus on PHP. First is an interesting vulnerability
 that got patched in Signal. The problem here was that when
 you were in a call, the other side could flood your Signal
 client with events and in doing so actually prevent it
 from hanging up. So you think you hung up, but the
 connection was still active, which of course then allowed
 an attacker to listen in on the microphone in your Signal
 device. So that's the vulnerability here. It has
 been patched and yes, Signal is certainly one of those
 things, but you probably want to apply updates more or less
 automatically. And well, that in my experience at least
 works pretty well with Signal. And then we got updates for
 Snort 3 from Cisco. Now, this is interesting for a couple of
 reasons. First of all, it's a critical vulnerability with a
 base CVSS score of 9.0. Secondly, well, Snort has to
 look at a lot of hostile traffic. So any vulnerability
 in Snort certainly could become a problem. Now, another
 issue is also that while there are four CVE numbers being
 listed here, Cisco does state that one of these CVEs is
 actually tracking multiple vulnerabilities. And what they
 did here is that they basically grouped
 vulnerabilities together if they have the same weakness.
 So the same CWE, then they just assigned them the same
 CVE number. Maybe that's a trend coming here with all of
 these AI vulnerabilities. And Cisco also states that yes, AI
 was involved in finding these vulnerabilities, but makes it
 of course less transparent what exactly was being patched
 here and what the exact severity or exploitability is
 of these vulnerabilities. They state that they may in the
 future publish a more detailed advisory that breaks out the
 individual vulnerabilities in more detail. So get it
 patched. And the advisory has a list of all the different
 products that include Snort. So it's not just if you're
 running Snort standalone, but it's also included in several
 of Cisco's appliances. And then sadly, we do have another
 vulnerability disclosure fail. This one is in some ways more
 spectacular than the PHP one in the way it failed.
 Hopefully not quite as severe. The problem is that Trend
 Micro, who is of course famous for their Zero Day Initiative
 and is collecting and then responsibly reporting
 vulnerabilities for quite a while, apparently messed up
 and did post some recently discovered Linux kernel
 vulnerabilities to a public Linux kernel mailing list. One
 in particular is CVSS 9 vulnerability in the kernel's
 SMB driver. If you're not that familiar with Linux, but the
 Linux kernel actually includes sort of its own little SMB
 file sharing module. So this is sort of the one issue here
 that may be exposed to the network that does allow for
 arbitrary code execution. There are actually two sort of
 distinct vulnerabilities. vulnerabilities. The first one
 is sort of a more default configuration. The second one
 in a less likely configuration. So if you are
 using Linux, if you're exposing SMB file shares, be
 aware of that and check if you're actually using this
 kernel module to facilitate this file sharing. Oh yeah, no
 patches available yet and proof of concept exploit code
 was included with some of these vulnerability reports.
 Well, I think that's enough for Friday. So hope you have
 made some headway in patching PHP. I'm sure there's lots of
 other stuff to patch coming next week. So talk to you
 again on Monday. Bye.