ISC Stormcast For Tuesday, March 10th, 2026 https://isc.sans.edu/podcastdetail/9842, (Tue, Mar 10th)
2026-03-10T07:23:47Z•674b4b98db211d130652183019eef6dd39e7af16190bde754a4766b06c896689
ECHactive exploitationbruteforcecrushftpencrypted client hellomalwarerfcscanningsoftware-releasetlsxwormyarayara-xzero-day
What happened
ISC SANS diary roundup (Mar 3–10, 2026): notes recent publications including new RFCs for Encrypted Client Hello (ECH/TLS privacy), YARA‑X 1.14.0 release (minor improvements and bug fixes), a fresh XWorm malware campaign using multi‑technology delivery, and widespread bruteforce scanning against CrushFTP instances. The CrushFTP entry calls out several serious past vulnerabilities (CVE‑2024‑4040 RCE via template injection, CVE‑2025‑31161 auth bypass, and the July 2025 zero‑day CVE‑2025‑54309 that was actively exploited). Operators should verify CrushFTP exposure, apply mitigations/patches, and监
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 674b4b98db211d130652183019eef6dd39e7af16190bde754a4766b06c896689
- Enrichment time
- 2026-03-10T07:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.