IN the 15 October 2026 edition of the SANS Internet Storm Center’s Stormcast, the host reports on several distinct security concerns discussed in previous updates. First, Visual Basic for Applications (VBA) scripts embedded in AutoCAD files are again in focus. Didier has extended a tool to extract VBA scripts from AutoCAD files’ OLE documents, but he has encountered cases where no pointer to the embedded script remains.
He suggests an AutoLISP-based technique may have been used to delete the reference, leaving the script present but inaccessible. The episode highlights how such scripts can pose the same devastating risks as Office-based macros if triggered within AutoCAD documents.
The broadcast also covers reports of Ledger cryptocurrency wallets being distributed with hardware implants. The implants reportedly include an LTE module and SIM card to exfiltrate seed phrases, enabling theft of cryptocurrency. Wallets sold initially in Asia and more recently through a European retailer, MediaMarkt, are cited. It remains unclear whether affected devices came from authorised Ledger manufacturers or third-party sources. Given the severity, the recommendation is to cease using potentially implanted Ledger wallets and consider moving funds offline.
Additionally, Docker Hub fixed a vulnerability related to account conversions from personal accounts to organisations. When converting, old owners could retain access to personal tokens and potentially add them to another user’s account without confirmation. Docker Hub has addressed the issue and reviewed prior conversions for abuse.
The curl project released fixes for multiple vulnerabilities, including remote code execution triggered by uploading a file over HTTP/2 to a malicious server; a detailed blog by Daniel Stenberg and a proof-of-concept exist. Users relying on curl to upload to untrusted servers are urged to patch.