SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10142.mp3

previous

Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Tuesday, October 20th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cyber
 Defense Operations. Well, with no podcast yesterday, we do
 have a little bit catching up to do. So let's start with
 diaries. Mark on Friday wrote about containing your AI
 agents. Certainly one issue that a lot of organizations
 are struggling with is how to properly restrict what your AI
 agent is able to do. And Mark is outlining some techniques
 you can do to, for example, restrict what permissions an
 AI agent had, how to set up containers and restrictions
 around that, but also, well, how to deal, for example, with
 AI companies changing models and no longer supporting older
 models that you may have originally used and that you
 may feel comfortable with with your AI agents. I think this
 also fits a little bit into something that I've seen
 Heather Barnhart say about AI agents, in particular when it
 comes to forensics, well, treat them as an intern. And
 here, would you actually let an intern on their first day
 have root access to all of your systems? Well, probably
 not. Well, remember last week Didier wrote about how to
 identify and extract data from orphaned VBA projects that may
 be residing inside of your AutoCAD DWG files. Well,
 Didier wrote a little follow-up to that with a YARA rule
 to help you identify these files. So as a heavy AutoCAD
 user, certainly worthwhile. Take a look at that and see if
 there is anything malicious or so hidden in these supposedly
 deleted, but really just unlinked Visual Basic
 projects. And last week, Quentin Kaiser did present at
 Hexacon in Paris, not so, wrote up a detailed blog post
 about a couple of serious vulnerabilities in Broadcom's
 eCos platform. This is the embedded customizable
 operating system, basically the operating system that
 Broadcom's Wi-Fi access points are running under. And the
 problem here is that an attacker in reach, in Wi-Fi
 reach of the access point, is able to execute arbitrary code
 on the access point without having to connect to the Wi-Fi
 network. So without having to actually complete any kind of
 WPA authentication. This is not one of your sort of web
 admin vulnerabilities, but this is a fundamental Wi-Fi
 802.11 implementation vulnerability in this
 particular Broadcom platform. Now, what makes this even kind
 of worse is that Broadcom apparently isn't sort of
 acknowledging these vulnerabilities. Quentin tried
 to report it to Broadcom. There is no CVE being issued
 for it. Apparently, there was at one point sort of a silent
 patch for at least some of the vulnerabilities. Now, Quentin
 also did present a proof of concept that was able to,
 again, execute code on the access point. And then, for
 example, retrieve the encryption key for WPA. So
 then an attacker could just join the network and perform
 additional attacks. Or, well, with remote code execution on
 an access point, of course, you may also be able to do
 things like intercept traffic or just exfiltrate data that
 is being sent across the network. A large number of
 access points are vulnerable. And, of course, it's not
 always that obvious what exact chipset and such they're
 running. But apparently also many ISPs that are providing
 access points are delivering vulnerable access points to
 their clients. And if you're using the OVH cloud, you're
 likely going to also use the command line utilities that
 are published by OVH. These command line utilities were
 recently compromised. And that was about Friday for a few
 hours. An infostealer was added to these command line
 utilities. A couple different versions were compromised
 here. So if you are using the tools, again, make sure that
 you update that you're on the latest version. Version 0.16.0
 is the version that was released post-compromise. So
 stick to that and, again, also pin on hashes. That apparently
 is also how this was discovered by customers of OVH
 realizing that the hash changed of existing versions
 for these command line utilities. And also on Friday,
 we do have a blog post about a new vulnerability in Plex, the
 media server. Now, the reason it's a problem is that many
 people are exposing Plex to the Internet to be able to
 remotely access their media library. Plex is pretty good
 about authentication for these remote requests. But the chain
 of vulnerabilities here essentially allows you to
 execute arbitrary code on a Plex server without
 authentication. It starts all out with a good old server-side
 request forgery where you're able to send a remote
 request to Plex and then essentially have it proxied to
 loopback. Well, Plex is a lot more relaxed about
 authentication for requests coming from loopback. And that
 is then being used to retrieve admin tokens and, in the end,
 execute arbitrary code. So this is something you
 definitely want to patch now. It's already being exploited.
 If your server is exposed to the Internet, assume
 compromise. And the Microsoft Exchange team blog is
 reporting that after applying the October 2026 Windows
 update to on-premise Exchange, it may become unstable. They
 recommend a fix that they're showing in their blog post and
 do not recommend that you uninstall the patch. Instead,
 just update the registry setting that they are
 recommending. Well, and that's it for today. So thanks for
 listening. Thanks for liking. Thanks for recommending this
 podcast. And talk to you again tomorrow. Bye.
 Bye. Bye.