Podcast Detail

SANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10132.mp3

previous
Podcast Logo
TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

In today's episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through the EC2 instance metadata service (IMDS), and ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass.

Why TLP Should Not Replace Your Internal Information Classification
The Traffic Light Protocol from FIRST defines who threat intelligence may be shared with, from TLP:CLEAR to TLP:RED, but not how to protect it in transit. Organizations still need their own classification and safeguards, such as encryption, instead of sending TLP:AMBER data in plain email.
https://isc.sans.edu/forums/diary/Why%20TLP%20should%20not%20replace%20your%20internal%20information%20classification/33414/

AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents. A prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service, made possible by IMDSv1 and overly broad permissions. Restrict the URLs your AI agents can reach and always use IMDSv2.
https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model

Palo Alto GlobalProtect VPN Vulnerability Exploited by Ransomware (CVE-2026-0257)
ReliaQuest reports ransomware actors exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access to open unauthorized VPN sessions. Patch VPN gateways, and keep VPN clients updated too.
https://x.com/ReliaQuestTR/status/2108647641240465707
https://security.paloaltonetworks.com/CVE-2026-0257

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Monday October 12th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Amsterdam, Netherlands. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Jan this weekend wrote about the
 Traffic Light Protocol and how it is often in his experience
 overused by organization to replace some internal
 classification schemes. So first of all, the Traffic
 Light Protocol was developed by FIRST and its intent is to
 specify who particular threat intelligence usually is
 supposed to be shared with. And it goes all the way from
 clear, which is basically public information, to red,
 which is information that may not be shared at all. What the
 Traffic Light Protocol does not specify is how this
 information should be shared. So for example, if you're
 looking at the AMBER range where you have certain
 organizations that you may share this particular
 information with, it doesn't specify should you encrypt it
 or what safeguards you should enable in order to prevent
 this information from being shared with anybody but the
 designated recipient. And I've often seen actually
 information like this being shared in plain emails, which
 in many cases may not necessarily be what you're
 supposed to be doing to safeguard this data. So keep
 that in mind when you're using the Traffic Light Protocol.
 It's really just about who you share the information with,
 not how you actually ensure that the information is
 safeguarded. And I think I mentioned a couple times
 before that one of the vulnerabilities that you may
 expose yourself with AI agents is server-side request
 forgery. AI agents often have the ability to reach out to
 other websites in order to retrieve information and well,
 that's the typical pattern that can be used for server
 -side request forgery. Researchers from Zenity Labs
 did now identify just this vulnerability in Amazon's AI
 Bedrock agents. Now Amazon has fixed this vulnerability now,
 but the basic issue here is the very classic server-side
 request forgery issue where a script running inside a
 virtual machine inside Amazon's EC2 is able to reach
 out the metadata service. And as a result, it's possible to
 retrieve credentials. And that's exactly what happened
 here, where a user would be able to trick the agent into
 receiving and revealing credentials that were stored
 in the metadata service. And then the attacker could use
 these credentials. There were a couple of issues here with
 this that enabled this vulnerability. One was the use
 of version one of the IMDS, the instance metadata service,
 not version two. And secondly, also the privileges were quite
 wide open to allow access that the agent probably didn't even
 need. So again, this has been fixed by Amazon at this point,
 but it is a bad pattern that I've seen over and over. And
 if you're developing agents or anything like this, please be
 aware that you must restrict what URLs they have access to.
 And yes, the IMDS version one, version two issue is a common
 problem. Also make sure you always use version two of the
 instance metadata service, because that one is more
 hardened against these type of server-side request forgery
 vulnerabilities. And this last week, we had a number of
 NetScaler vulnerabilities. So first of all, a reminder, make
 sure that you're up to date. It's really easy to miss one
 of these vulnerabilities. I had to double check a couple
 times today to make sure that I have them all covered. But
 also these vulnerabilities are exploited or these type of
 vulnerabilities. ReliaQuest now is reporting that they're
 seeing ransomware being deployed via Palo Alto
 vulnerability. So this is PAN-OS, GlobalProtect and
 Prisma Access. All of these VPN, SSL VPN and similar
 vulnerabilities are heavily being targeted in particular
 by ransomware actors, because that's usually the part that
 you must expose to the world. So that makes it really
 difficult to set up any additional mitigating controls
 for these type of vulnerabilities. So double
 check, make sure your VPN endpoints are properly
 patched. Also, don't forget to update the clients ever so
 often. There are, and I don't always mention them in the
 podcast, but there are sort of ongoing issues with privilege
 escalation vulnerabilities in these clients. So definitely,
 this is a big target these days. So make sure that you're
 up to date. Well, and that's it for today. So thanks again
 for listening. Thanks for liking. Thanks for
 recommending and subscribing to this podcast. And talk to
 you again tomorrow. Bye. Bye.