THE latest SANS ISC Stormcast covers a cluster of recent security concerns with practical implications for operators of AI systems, network devices and consumer services. It begins by stressing how to contain AI agents, emphasising restricted permissions, containerisation, and the challenge of model lifecycle changes that render older configurations risky. The discussion includes a forensic analogy—treat AI agents as interns with limited access—to illustrate prudent access controls.
The segment then highlights Didier’s follow‑up on identifying and extracting data from orphaned Visual Basic for Applications projects embedded in AutoCAD DWG files, supported by a new YARA rule to help detect such hidden VBA projects.
The programme moves to Broadcom’s eCos platform, noting a serious, attacker‑reachable flaw in Wi‑Fi access points that can enable remote code execution without WPA authentication. Quentin Kaiser’s write‑up points to a broad exposure across many devices and ISPs, with no public CVE issued and only a silent patch in some cases.
In another thread, OVH’s command‑line utilities were compromised for several hours, introducing an infostealer; users are advised to upgrade to version 0.16.0 and verify hashes to confirm integrity. A separate advisory concerns Plex Media Server, where a chain of weaknesses starting with server‑side request forgery could proxy requests to loopback and obtain admin tokens, enabling unauthenticated remote code execution; patching is urged as exploit activity has been observed.
Finally, Microsoft Exchange on‑premises users are warned that applying October 2026 updates may destabilise systems; the recommended response is to apply the published registry fix rather than uninstalling the patch.