CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)

SANS ISC diary roundup (Jun 16–23, 2026): highlights include a write-up about CVE-2024-40766 where the vendor patch fixed the code flaw but administrators failed to correct vulnerable configuration(s), leaving systems exposed. Other notable items: continued prevalence of webshells (a newly observed family recently pushed to GitHub), an e-banking phishing campaign that used IPv4‑mapped IPv6 addresses, analysis of coordinated SSH brute-force activity over the prior three months, a guest piece on browser blind spots that can make protections ineffective, and a malware delivery case where a ZIP ->