ISC Stormcast For Friday, May 1st, 2026 https://isc.sans.edu/podcastdetail/9914, (Fri, May 1st)
2026-05-01T13:23:52Z•d4cf9786ce3ec1b23563c8f4bd1643c302105754ee6133a8c82be554c5fb8ef4
Apple-patchBitwardenCanisterSprawlCheckmarx-KICSCiscoLibredtailPyPISANDCLOCKTeamPCPTrivyUNC6780X-Vercel-Set-Bypass-Cookiecredential-thefthoneypotnotification-servicenpm-wormreconnaissancesupply-chainxinference
What happened
SANS ISC diary entries (late Apr–May 1, 2026) cover daily Stormcast podcasts plus multiple security notes: a guest diary on Libredtail, honeypot-observed reconnaissance (including unusual HTTP requests with an X-Vercel-Set-Bypass-Cookie header), and a major TeamPCP supply-chain campaign update describing three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of a CanisterSprawl npm worm, and credential-theft activity tied to operators designated UNC6780 (SANDCLOCK) including a Cisco source-code theft linked to Trivy credentials. The feed also note
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- d4cf9786ce3ec1b23563c8f4bd1643c302105754ee6133a8c82be554c5fb8ef4
- Enrichment time
- 2026-05-01T13:23:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.