Debian apt flaw can bypass package signature verification

The SANS Internet Storm Center’s Stormcast for 5 November 2026 reports on several notable items observed in recent telemetry and community discussions. Johannes Ullrich highlights a resurfaced issue with old web scripts such as FormMail-like helpers and development-only sendmail.php or test-mail.php pages. These scripts can leak environment variables and server configuration and, in some versions, can be abused to send email to addresses supplied via GET or POST parameters.

The episode emphasises that such scripts should never be deployed in production and stresses the broader challenge of managing code releases and production pipelines to prevent vulnerable tooling from reaching live environments.

The podcast also reviews a new out-of-band (OOB) scanning tool, OOB scan by HD Moore in collaboration with runZero. The tool focuses on exposed management interfaces such as baseboard management controllers (BMCs), IPMI, SNMP, and similar out-of-band controls. Ullrich notes the utility’s ability to identify vulnerable devices and provide detailed findings, citing a personal test that discovered an SNMP-enabled printer on a home network. The discussion frames this as a more targeted vulnerability assessment than a generic port scan.

Additionally, the episode covers a critical apt vulnerability in Debian-based systems, triggered by error-message handling from the web server when serving apt packages. An attacker can cause apt to skip signature verification on packages, enabling malicious package installation even without endpoint compromise, particularly where HTTP is used instead of HTTPS.

The podcast likewise reports two unfixed flaws in SonicWall’s GMS appliance—unauthenticated file read and authenticated SQL injection—stating there will be no fixes due to the product being out of support and end-of-life, with guidance to consider replacement options.