My Next Class

Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting, an infostealer slipped into the OVHcloud command line tools, Exchange Server instability after the October 2026 Windows updates, how to contain AI agents, and a YARA rule for orphaned VBA projects in AutoCAD DWG files.

Small Agents, Smaller Blast Radius: Controlling What AI Can Do
Mark outlines techniques to restrict what AI agents can do, including limiting permissions, using containers, and planning for AI vendors retiring older models.
https://isc.sans.edu/diary/Small%20Agents%2C%20Smaller%20Blast%20Radius%3A%20Controlling%20What%20AI%20Can%20Do/33430

Orphaned VBA Projects Inside DWG Files: YARA Rule
Didier Stevens follows up on hidden Visual Basic for Applications projects in AutoCAD DWG files with a YARA rule to detect them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files%3A%20YARA%20Rule/33434

Broadcom eCos Wi-Fi Remote Code Execution Vulnerability
Quentin Kaiser shows that an attacker in Wi-Fi range can execute code on Broadcom eCos access points without WPA authentication and steal the WPA key. Broadcom has not issued a CVE, and many ISP-provided access points are affected.
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/

OVHcloud Command Line Tools Compromised
For a few hours on Friday, compromised versions of the OVHcloud CLI shipped an infostealer. Update to version 0.16.0, released after the compromise, and pin package hashes.
https://github.com/ovh/ovhcloud-cli/issues/300

Plex2Shell Vulnerability (Exploited!)
A chain starting with server-side request forgery (SSRF) to loopback lets attackers steal admin tokens and run code on Plex Media Server without authentication (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It is already exploited; patch now and assume compromise if your server is exposed.
https://zmain.info/blog/plex2shell

Exchange Servers May Become Unstable After the October 2026 Windows Updates
Microsoft recommends a registry change rather than uninstalling the update on on-premises Exchange Server.
https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382

NGINX ngx_http_core_module Vulnerability (CVE-2026-15176)
https://my.f5.com/manage/s/article/K000162416

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.