ISC Stormcast For Monday, November 9th, 2026 https://isc.sans.edu/podcastdetail/10170, (Mon, Nov 9th)
2026-11-09T07:23:41Z•2f223b5e3ff902c9eecf5f4c2f1ba77804b3edd0584d2fb828641f306bde9617
CVE-2000-0411CVE-2023-20198CVE-2026-123158CVE-2026-98432CGICisco IOSCowrieLinuxMultipath TCPSANS ISCSSHemail scriptsexploitation attemptshoneypotthreat intelligencevulnerability scanningweb application security
What happened
SANS Internet Storm Center entries from November 2–9, 2026 describe observed scanning and exploitation activity targeting the SSH “sshole” vulnerability (CVE-2026-123158), suspected exploitation of an older Cisco IOS vulnerability (CVE-2023-20198), legacy vulnerable email CGI scripts (CVE-2000-0411), and a newly reported Linux Multipath TCP vulnerability (CVE-2026-98432). The data is primarily honeypot and detection-focused, with active scanning reported for the SSH issue.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 2f223b5e3ff902c9eecf5f4c2f1ba77804b3edd0584d2fb828641f306bde9617
- Enrichment time
- 2026-11-09T07:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.