THE latest SANS Internet Storm Center podcast update centres on ongoing patch activity and recent vulnerability disclosures. The host notes that patches for the long‑running PHP vulnerability are widely available from many vendors, though some devices such as QNAP have yet to publish fixes. Exposed internet-facing instances should be avoided where possible, and patching should proceed as updates arrive.
Exploit activity appears to be present in the wild, with Cloudflare reporting substantial probes and Amazon noting attempts as early as 16 October. However, there is little in the way of simple, reproducible, reliable exploits at the moment, which buys time for organisations to apply patches. The host also highlights the risks of leaking vulnerability details during responsible disclosure, which can fuel premature or inaccurate exploit development.
Other notable items this week include an update for Signal addressing a vulnerability that could allow an attacker to continue listening in after a user thinks the call is ended, by flooding the client with events. Snort 3 received a critical advisory (base CVSS 9.0) covering multiple CVEs; Cisco notes that one CVE entry actually groups several weaknesses sharing the same CWE, and AI contributed to the finding, though the advisory does not yet itemise each flaw.
Finally, Trend Micro’s Zero Day Initiative disclosed Linux kernel vulnerabilities affecting the SMB driver; two distinct flaws exist, with a default and a less likely configuration, and no patches had been released at the time, with proof‑of‑concept code included in reports. Organisations using Linux SMB shares are advised to review exposure and monitor for updates as they become available.