ISC Stormcast For Tuesday, July 28th, 2026 https://isc.sans.edu/podcastdetail/10026, (Tue, Jul 28th)
2026-07-28T07:23:39Z•0615ec4f27b951bf7d3673eea28a82269573f1c398a529055bfe7f150ff3b46e
AI securityActuatorESAFENET CDGGeoServerSQL injectionSpring BootXSScredential exposuredefault credentialsheapdumpsecret leakageweak passwordsweb scanning
What happened
SANS Internet Storm Center entries report active scanning and security risks involving exposed Spring Boot /actuator/heapdump endpoints, which can disclose application secrets, and ESAFENET CDG document management systems targeted for weak credentials and previously reported SQL injection/XSS/default-password issues. Additional entries discuss autonomous AI attackers and GeoServer-related activity, but provide insufficient detail for specific attribution or vulnerability mapping.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 0615ec4f27b951bf7d3673eea28a82269573f1c398a529055bfe7f150ff3b46e
- Enrichment time
- 2026-07-28T07:23:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.