My Next Class

Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting mail without DMARC.

Attackers Searching for SAP NetWeaver Webshells
ISC honeypots are seeing probes for ant.jsp and related paths tied to SAP NetWeaver CVE-2025-31324, a CVSS 10 unauthenticated file-upload flaw attackers still use to plant webshells even after recent patches. Watch /irj/servlet_jsp/irj/root/ and other upload endpoints for leftover shells.
https://isc.sans.edu/diary/Attackers%20Searching%20for%20SAP%20Netweaver%20Webshells/33502

N-able N-central Critical Security Incident
N-able took Hosted N-central offline after public disclosure of roughly 30+ critical vulnerabilities with no patches yet, and advises on-premises customers to take servers offline if not isolated; no exploitation observed so far, with remediation said to be on track.
https://uptime.n-able.com/
https://labs.beazley.security/advisories/BSL-A1242

Google Chrome Zero-Day Patch (CVE-2026-125350)
Chrome stable updates fix nine vulnerabilities, including CVE-2026-125350, a use-after-free in the XML parser that Google says is already exploited in the wild. Update promptly; the advisory does not confirm a sandbox escape.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

Strict Outlook DMARC Policies
Outlook is rejecting mail with 550 errors when the sending domain lacks a DMARC record, even if SPF and DKIM pass. Publish at least a DMARC record (for example p=none) alongside SPF and DKIM.
https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim

SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.