ISC Stormcast For Monday, November 9th, 2026 https://isc.sans.edu/podcastdetail/10170, (Mon, Nov 9th)

2026-11-09T13:23:41Z•197af5593e1962c04a461c92dc5e55219c9656ae836febced31c54d450bf568f

CVE-2000-0411CVE-2023-20198CVE-2026-123158CVE-2026-98432CGICisco IOSLinuxMultipath TCPSANS ISCSSHemail scriptsexploitation attemptshoneypotssholevulnerability scanningweb application security

Open source link →

What happened

SANS Internet Storm Center entries from November 2–9, 2026 report observed scanning and exploitation activity targeting the SSH “sshole” vulnerability (CVE-2026-123158), older Cisco IOS devices likely affected by CVE-2023-20198, legacy vulnerable email CGI scripts including CVE-2000-0411, and a newly reported Linux Multipath TCP vulnerability (CVE-2026-98432). The feed primarily documents honeypot observations and vulnerability awareness rather than confirmed compromises.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sans_isc_diary
Record identifier: 197af5593e1962c04a461c92dc5e55219c9656ae836febced31c54d450bf568f
Enrichment time: 2026-11-09T13:23:41Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records