SANS Stormcast Wednesday, August 5th, 2026: Diagnostic Tool Hunt; Device Code Phishing; XCSSET; NuGet API Keys
Summary
This episode covers OS command injection risks in CGI scripts and Shellshock vulnerabilities, recommending execv for mitigation. It discusses Greatness phishing kit updates, specifically device code phishing that bypasses MFA. The host also details XSCSet malware targeting Apple developers via Xcode projects. Finally, Microsoft’s reduction of NuGet API key lifetimes to 30 days is addressed as a supply chain security measure.
Topics discussed
Introduction and sponsor mention
Honeypot scans for CGI scripts and OS command injection
Greatness phishing kit adds device code phishing
XSCSet malware targeting Apple Xcode developers
Microsoft reduces NuGet API key lifetime to 30 days
Closing remarks and sign off
Listen ad-free on Castria