(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it's convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all…
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Introduction On Wednesday, 2026-10-28, I ran across a ClickFix campaign I haven't seen before. Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page. It targets both macOS and Windows. I don't yet have a name for this specific activity, but this diary shares some screenshots and…
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update. Noteworthy Issue: CVE-2026-86950: This is an already exploited vulnerability in CoreGraphics, and was patched originally a month ago. This month's update…
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program] Around Here, we start our day with coffee, but our day does not begin until we have our data...So much data. Where to even begin? When approaching a massive dataset, such as those from a DShield SIEM Honeypot, the first step…
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
YARA-X's 1.22.0 release brings 11 improvements and 9 bugfixes. One improvement adds built-in functions to read 64-bit integers: int64, int64be, uint64, and uint64be. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0…
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability. However, after looking closely at some published PoC's - and there is an unbelievable amount of AI generated - erm, slop - it looks like building a universal, reliable, one click exploit is quite difficult (unless…