ISC Stormcast For Friday, March 6th, 2026 https://isc.sans.edu/podcastdetail/9838, (Fri, Mar 6th)
2026-03-07T07:23:45Z•c5c4e53f28f0e188cb0e0711941a831efad4e912df688478927c5feceb116c42
CVECVE-2024-4040CVE-2025-31161CVE-2025-54309CrushFTPRTFSANS ISCWiresharkXWormautomated-scanningbruteforcemalwaretargeted-intrusionvulnerabilitieszip
What happened
SANS ISC diary entries for early March 2026 covering multiple items of operational security interest: a new wave of XWorm multi-technology malware deliveries observed in the wild; widespread bruteforce scanning against CrushFTP and discussion of prior critical CrushFTP vulnerabilities (CVE-2024-4040 template-injection leading to RCE, CVE-2025-31161 authentication bypass, and the actively exploited July 2025 zero-day CVE-2025-54309); release notes for Wireshark 4.6.4 (fixes three vulnerabilities and multiple bugs); a guest diary on distinguishing targeted intrusions from opportunistic automated
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- c5c4e53f28f0e188cb0e0711941a831efad4e912df688478927c5feceb116c42
- Enrichment time
- 2026-03-07T07:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.