ISC Stormcast For Monday, August 24th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Security Advisories
Official cybersecurity advisories from CISA, NCSC, SANS Internet Storm Center, FBI Cyber, and NIST. Published security notices and urgent alerts for defenders.
Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!
In every MFA rollout, there will come a time where you think you are closing in on "done", and some automation to list what&#;x26;#;39&#x
ISC Stormcast For Friday, August 21st, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays
One thing that folks never seem to do after "going to the CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily when things were on pre
Using Microsoft Graph and Powershell - Risk Detection Commands
Building on the last diary on Using MS Graph and Powershell, let&#;x26;#;39;s look at "Risky" logins. 
Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses
Microsoft Graph is a newer API that is meant to replace several others.&#;x26;#;xc2;&#;x26;#;xa0; OK, it
ISC Stormcast For Thursday, August 20th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Simple Scans for Cloud Metadata Service
Cloud providers typically expose a REST API at 169.254.169.254 that allows code running on virtual machines to retrieve machine-specific data. Some of the data
ISC Stormcast For Wednesday, August 19th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Tuesday, August 18th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Apple Patches iOS and macOS
Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller mac
Microsoft Patch Tuesday August 2026
This month we got patches for 418 vulnerabilities. Of these, 62 are critical, 1 is being exploited in the wild, and 2 were publicly disclosed as zero-days. Nota
ISC Stormcast For Tuesday, August 11th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Scans for Solana (Surfpool?) Endpoints
Solana is a crypto platform known for speed. Developers like it to develop distributed applications or to implement crypto payments. To interact with the blockc
ISC Stormcast For Monday, August 10th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Linux Shell Forensic: Let?s Dive Into Atuin!
UNIX systems (including Linux) are well-known to record a lot of activities in many different locations. But there is one domain where they definitely lack of "
ISC Stormcast For Friday, August 7th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Thursday, August 6th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
![22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary]](https://isc.sans.edu/diaryimages/images/Daryl_Jiminez_pic1.png)
22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary]
[This is a Guest Diary by Daryl Jiminez, an ISC intern as part of the SANS.edu BACS program] 
Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm
When you learn that a compromised package executed on one of your build hosts, muscle memory takes over: revoke the npm token, rotate the GitHub PAT, cycle the
Get Deeper Security Advisories Intelligence
The CyberHawk platform goes far beyond news. Scan indicators, track active campaigns, monitor infostealer feeds, and access a complete analyst toolkit — all free to join.
IOC Scanner — 3.6M+ indicators
Live IOC Feed — filterable threat data
Infostealer Intelligence — live cred logs
Live Threat Map — real-time attacks
MISP Threat Feeds — CIRCL, Feodo, more
GitHub Arsenal — security tools library
Security Blog — deep-dive research
Video Courses — training and education
SOPs — SecOps procedures
Analyst Library — references and toolkits