Stormcast covers crypto attacks and flaws in network security tools

On 3 November 2026, the SANS Internet Storm Center's Stormcast discusses several security topics touched on in recent weeks. Host Johannes Ullrich explains how to detect multipath TCP usage on a network by looking for TCP option 30; he notes that iOS devices (notably connections to Siri and possibly Apple Music) commonly use this feature. He points out that outbound multipath TCP to Apple’s IPv4 17.0.0[.]0/8 space is typically safe to allow, while the concern would be inbound use. He also mentions that while multipath TCP is enabled on Linux, it is not widely used except on some high‑performance servers or load balancers.

The episode also highlights ongoing crypto-asset security concerns. Ullrich references the Binance incident as a high‑profile event, but stresses that many smaller crypto heists continue due to insecure keys, malware, or outdated software. In particular, BTCPay (Bitcoin Pay) recently published a blog post detailing attacks against older software versions, specifically 2.4.1 and earlier; 2.4.2 was released in August, underscoring the need to keep crypto tooling up to date.

Additionally, Ullrich covers two Barracuda email security gateway vulnerabilities—an authentication bypass and a command‑injection flaw—where exploitation requires admin access to the appliance. The affected products are vulnerable to both issues; other Barracuda products face only the arbitrary code execution vulnerability. He urges not exposing admin interfaces publicly.

Synology users are reminded that active exploitation of outdated DSM versions has been observed; Synology notes the fixes were released in December 2024, but many devices lag behind updates.