SANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE

Today's episode covers hidden Visual Basic for Applications (VBA) macros left behind in AutoCAD drawings, Ledger hardware crypto wallets found with LTE implants that steal seed phrases, a Docker Hub account conversion flaw that exposed personal access tokens, and a curl update fixing a remote code execution bug in HTTP/2 uploads.
Orphaned VBA Projects Inside DWG Files
Didier Stevens found AutoCAD DWG files whose VBA projects are no longer referenced but still present inside the file, likely left behind by an AutoLISP delete command, and shows a new way to extract them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files/33420
Ledger Crypto Wallet Supply Chain Attack: Hardware Implants
Ledger wallets sold through authorized resellers, first in Asia and recently by MediaMarkt in Europe, were found with LTE modules and SIM cards that exfiltrate the seed phrase. Reports put losses at up to $100 million.
https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/
Docker Hub Account Migration Bug (CVE-2026-105445)
Converting a personal Docker Hub account to an organization moved the old user's personal access tokens to a target user without confirmation, letting an attacker authenticate as that user. Docker fixed the issue and notified affected users.
https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/
curl Patches HTTP/2 Upload Remote Code Execution Flaw
A new curl release fixes several vulnerabilities, including remote code execution triggered when uploading a file over HTTP/2 to a malicious server. A proof of concept is available.
https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich