SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA

Download audio Show notes Apple Podcasts Spotify

Show notes

Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting, an infostealer slipped into the OVHcloud command line tools, Exchange Server instability after the October 2026 Windows updates, how to contain AI agents, and a YARA rule for orphaned VBA projects in AutoCAD DWG files.
Small Agents, Smaller Blast Radius: Controlling What AI Can Do
Mark outlines techniques to restrict what AI agents can do, including limiting permissions, using containers, and planning for AI vendors retiring older models.
https://isc.sans.edu/diary/Small%20Agents%2C%20Smaller%20Blast%20Radius%3A%20Controlling%20What%20AI%20Can%20Do/33430
Orphaned VBA Projects Inside DWG Files: YARA Rule
Didier Stevens follows up on hidden Visual Basic for Applications projects in AutoCAD DWG files with a YARA rule to detect them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files%3A%20YARA%20Rule/33434
Broadcom eCos Wi-Fi Remote Code Execution Vulnerability
Quentin Kaiser shows that an attacker in Wi-Fi range can execute code on Broadcom eCos access points without WPA authentication and steal the WPA key. Broadcom has not issued a CVE, and many ISP-provided access points are affected.
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
OVHcloud Command Line Tools Compromised
For a few hours on Friday, compromised versions of the OVHcloud CLI shipped an infostealer. Update to version 0.16.0, released after the compromise, and pin package hashes.
https://github.com/ovh/ovhcloud-cli/issues/300
Plex2Shell Vulnerability (Exploited!)
A chain starting with server-side request forgery (SSRF) to loopback lets attackers steal admin tokens and run code on Plex Media Server without authentication (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It is already exploited; patch now and assume compromise if your server is exposed.
https://zmain.info/blog/plex2shell
Exchange Servers May Become Unstable After the October 2026 Windows Updates
Microsoft recommends a registry change rather than uninstalling the update on on-premises Exchange Server.
https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382
NGINX ngx_http_core_module Vulnerability (CVE-2026-15176)
https://my.f5.com/manage/s/article/K000162416
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

← Previous

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure

Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting, an infostealer slipped into the OVHcloud command line tools, Exchange Server instability after the October 2026 Windows updates, how to contain AI agents, and a YARA rule for orphaned VBA projects in AutoCAD DWG files. Small Agents, Smaller Blast Radius: Controlling What AI Can Do Mark outlines techniques to restrict what AI agents can do, including limiting permissions, using containers, and planning for AI vendors retiring older models. https://isc.sans.edu/diary/Small%20Agents%2C%20Smaller%20Blast%20Radius%3A%20Controlling%20What%20AI%20Can%20Do/33430 Orphaned VBA Projects Inside DWG Files: YARA Rule Didier Stevens follows up on hidden Visual Basic for Applications projects in AutoCAD DWG files with a YARA rule to detect them. https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files%3A%20YARA%20Rule/33434 Broadcom eCos Wi-Fi Remote Code Execution Vulnerability Quentin Kaiser shows that an attacker in Wi-Fi range can execute code on Broadcom eCos access points without WPA authentication and steal the WPA key. Broadcom has not issued a CVE, and many ISP-provided access points are affected. https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/ OVHcloud Command Line Tools Compromised For a few hours on Friday, compromised versions of the OVHcloud CLI shipped an infostealer. Update to version 0.16.0, released after the compromise, and pin package hashes. https://github.com/ovh/ovhcloud-cli/issues/300 Plex2Shell Vulnerability (Exploited!) A chain starting with server-side request forgery (SSRF) to loopback lets attackers steal admin tokens and run code on Plex Media Server without authentication (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It is already exploited; patch now and assume compromise if your server is exposed. https://zmain.info/blog/plex2shell Exchange Servers May Become Unstable After the October 2026 Windows Updates Microsoft recommends a registry change rather than uninstalling the update on on-premises Exchange Server. https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382 NGINX ngx_http_core_module Vulnerability (CVE-2026-15176) https://my.f5.com/manage/s/article/K000162416 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich