Today, I noticed scans using the username “FTP_3cx” showing up in our logs. 3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems....
Read MoreThis is just a quick diary entry to report that I saw requests on my honeypot for (code) repositories: /.git/logs/refs/remotes/origin/main /.git/objects/info /.github /.github/dependabot.yml /.github/funding.yml...
Read MoreOverview The npm package expr-eval is a JavaScript library that evaluates mathematical expressions and is used in various applications, including NLP and AI. A vulnerability in this library has been disclosed that could allow...
Read More![Binary Breadcrumbs: Correlating Malware Samples with Honeypot Logs Using PowerShell [Guest Diary], (Wed, Nov 5th)](https://b923496.smushcdn.com/923496/wp-content/uploads/2025/11/David_Hammond_pic1.png?lossy=1&strip=1&webp=1)
[This is a Guest Diary by David Hammond, an ISC intern as part of the SANS.edu BACS program] My...
Read MoreFor several years, we have offered a “new domain” list of recently registered (or, more accurately, recently discovered) domains. This list is offered via our API (https://isc.sans.edu/api). However, the size of the...
Read MoreApple released its expected set of operating system upgrades. This is a minor feature upgrade that also includes fixes for 110 different vulnerabilities. As usual for Apple, many of the vulnerabilities affect multiple operating...
Read More
XWiki describes itself as “The Advanced Open-Source Enterprise Wiki” and considers...
Read More
Sensors reporting firewall logs detected a significant increase in scans for port 8530/TCP and...
Read More
This week, I noticed some new HTTP request headers that I had not seen before: X-Request-Purpose:...
Read More
I’ve been doing Unix/Linux IR and Forensics for a long time. I logged into a Unix system for...
Read MoreOverview Email message header syntax can be exploited to bypass authentication protocols such as SPF, DKIM, and DMARC. These exploits enable attackers to deliver spoofed emails that appear to originate from trusted sources....
Read More
While reviewing malicious messages that were delivered to our handler inbox over the past few...
Read More