ISC Stormcast For Tuesday, September 8th, 2026 https://isc.sans.edu/podcastdetail/10084, (Tue, Sep 8th)
2026-09-08T07:23:41Z•5f8d6fb94d499e51b0b6e429cd236c64a8beddcf5fa981beb0a10518bbc90ad1
AI securityAstarothBrazilian Portuguese emailGuildmaMikroTikSANS ISCSSH authentication bypassactive exploitationcoding-agent securityhoneypotmalwarenetwork devicespersistencephishingunauthorized accountsvulnerability exploitation
What happened
SANS Internet Storm Center feed containing multiple security diary entries, including a critical actively exploited MikroTik vulnerability enabling SSH authentication bypass and persistence through unauthorized account creation. Other entries cover Guildma/Astaroth malware delivered via Brazilian Portuguese email, exposed AI coding-agent infrastructure and honeypot observations, and general Stormcast updates. The MikroTik issue warrants immediate patching and investigation for compromise.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 5f8d6fb94d499e51b0b6e429cd236c64a8beddcf5fa981beb0a10518bbc90ad1
- Enrichment time
- 2026-09-08T07:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.