Podcast Detail

SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10158.mp3

previous
Podcast Logo
Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath TCP, and a returning Hugging Face malware campaign that abuses trust_remote_code to mine cryptocurrency on GPU hosts.

Deploying a Local Ghidra Server for Your Malware Analysis Lab
Xavier Mertens shows how to set up Ghidra Server, which ships free with Ghidra, so reverse engineering projects are stored and versioned outside the analysis virtual machine and survive a revert to a clean snapshot. A small Linux VM with about 4 GB of RAM is enough; keep it inside the malware lab network, since it holds every imported sample, and never expose it to the internet.
https://isc.sans.edu/diary/Deploying%20a%20Local%20Ghidra%20Server%20for%20Your%20Malware%20Analysis%20Lab/33470

Claude Discovers Zero-Click Linux Kernel Multipath TCP Remote Code Execution (CVE-2026-98432)
Anthropic's Frontier Red Team used Claude to find and exploit a race-condition use-after-free in the Linux kernel networking stack that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener, defeating kernel address space layout randomization (KASLR) along the way. Exploitation is slow: the proof of concept needed about 48 minutes to leak a kernel pointer plus five minutes to reach code execution. The fix is upstream and backported to stable kernels, but not every distribution has shipped it yet, including Ubuntu at recording time.
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude

Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining
Pluto Security tracked 31 malicious Hugging Face repositories across seven accounts posing as small Qwen2 models; loading one with trust_remote_code=True runs the repository's Python code, which installs a disguised fileless cryptocurrency miner, a watchdog and, in some builds, reverse shells. The campaign targets GPU hosts running self-hosted inference such as Xinference and GPUStack, returned within days of a takedown, and passed 32,000 downloads including linked models.
https://pluto.security/blog/hugging-face-malware-campaign-load-mine/

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Friday, October 30th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from Denver,
 Colorado. And this episode is brought to you by the SANS.edu
 Graduate Certificate Program in Penetration Testing and
 Ethical Hacking. Xavier's diary from today is
 introducing you how to install a Ghidra server. If you are
 familiar with Ghidra, if you're doing some malware analysis,
 the way it's often used is as a standalone tool on the
 system that you are analyzing your malware on. Now, one
 problem, as Xavier points out, often you're using virtual
 machines for this, that, well, depending on what you're doing
 with your malware, you may have to reset to a prior
 snapshot. And if you are running Ghidra on the same
 system, then a lot of the work that you have done tends to
 get lost. And that's where the Ghidra server comes in. So
 you're setting up your Ghidra server. You're still running
 the Ghidra tool on the virtual machine with the malware that
 you're analyzing. But by connecting it to the Ghidra
 server, you can upload samples that you may run into during
 your analysis. And it essentially keeps sort of a
 versioning log of your work, which allows you then to go
 back and see what exactly you did, regardless of whether or not
 you have reset the virtual machine that you're using for
 the actual malware analysis. Other nice part here is that
 the hardware footprint of the server is rather minimal. You
 need enough disk space for all the malware samples, 4 GB of
 RAM is what Xavier is recommending. So nothing
 extraordinary, something that should fairly neatly and
 easily run in its own virtual machine that of course you
 don't have to reset in case something goes wrong during
 the malware analysis. So interesting tool comes as part
 of Ghidra, nothing you have to download separately and it's
 of course free as the tool itself. And Anthropic earlier
 this week did release a blog post discovering and
 exploiting vulnerabilities in critical real-world software
 with Claude, highlighting a couple different
 vulnerabilities that were found with Claude and also where
 Claude did suggest ways to exploit them. Now all of them
 are kind of interesting, but one particular vulnerability
 that probably sort of got the most coverage lately was
 remote code execution in Linux. What makes this
 particular vulnerability interesting is that it doesn't
 really require any additional software to run within the
 Linux system. It's part of the operating system's TCP/IP stack
 that is vulnerable here with that it also doesn't require
 any authentication or user interaction. All an attacker
 has to do is send specific packets to the Linux systems
 and it looks like these packets will be in the SYN
 packets and that can then trigger a use after free
 vulnerability that can also be used to defeat address space
 layout randomization. However, while this sounds like a real
 bad and it is a real bad vulnerability, we are kind of
 in a similar situation as we are with the PXE bug that I
 talked about yesterday that it does require some dependencies
 that may not necessarily be all that easy to fulfill on a
 particular system. In particular, in this case, it
 does require multipath TCP. Multipath TCP is a TCP
 extension that has been around for a little while now and has
 certainly been used. I've seen it being used in iOS, for
 example, and it does allow a handover of a TCP connection
 between different IP addresses or splitting a TCP connection
 between different IP addresses often used like for very high
 speed servers in order to adequately fill the available
 bandwidth with essentially just a single TCP connection,
 which isn't all that easy if you just have one IP address
 participating. Either way, this feature has to be enabled
 in order for this use after free vulnerability to be
 triggered. It also may take quite a number of packets to
 successfully exploit the vulnerability. They're talking
 about something like 40 minutes or so of essentially
 sending packets to the vulnerable system in order to
 achieve successful exploitation. A patch has been
 released to the Linux kernel. However, not all Linux
 distributions have pushed that patch out yet. In particular,
 Ubuntu apparently has not yet patched its kernel. Ubuntu
 recently actually went to a faster paced kernel release,
 but yes, this one sort of hasn't hit the latest kernel
 version yet for Ubuntu. So watch out for it, apply the
 patch, but like I said, it's not sort of a world ending
 kind of vulnerability, just something that you should keep
 an eye on and patch and then of course reboot your system.
 And then we have more trouble for Hugging Face. Hugging Face
 was again found out by the Pluto Security blog that it
 delivered malicious models. Now, this one used a slightly
 different approach. Like some of the earlier exploits like
 this, it used the trust remote code flag. The idea is that
 sometimes you need to load a model that is not fully
 supported by Transformers and does need its own Python code
 in order to be successfully loaded. This code can be
 loaded and executed using this flag. There are supposed to be
 warnings if the flag is not set, but apparently that
 doesn't always happen, depending on what software you
 really use to load the model. And in this particular case,
 it's then being used in order to run a crypto miner. Now
 this targets in particular users that run local models.
 One of the fake models here was sort of trying to emulate
 Qwen. I mentioned this earlier this week with some other
 context, but in this case, basically, yes, what you got
 wasn't Qwen. It was just malware. And of course, the
 idea here is that people who run local models do have
 reasonable graphic cards and are as a result also able to
 effectively run crypto coin miners. Well, and that's it
 for today. Thanks for listening. Thanks for liking.
 Thanks for recommending this podcast. And I hope to talk to
 you again on Monday. Slight chance I won't make it. I'll
 be traveling back on Sunday. So thanks and talk to you
 hopefully on Monday. Bye.