SANS Stormcast Thursday, August 13th, 2026: Process Accounting; ShieldBreak; SharePoint JWT Vuln PoC; AI regulation
Summary
Johannes Ulrich discusses Linux kernel process accounting as a low-overhead logging tool, noting its utility for monitoring containers on Proxmox. He covers Microsoft Patch Tuesday, highlighting the Shield Break exploit for Windows Defender and a JWT validation flaw in SharePoint. The episode also examines new EU and California AI watermarking laws, explaining how attackers can bypass these measures. Finally, he warns of critical vulnerabilities in Adobe ColdFusion and Commerce.
Topics discussed
Introduction and sponsor info
Linux kernel process accounting with ACCT
Windows Defender privilege escalation exploits
SharePoint JWT signature vulnerability
AI content watermarking laws and removal tools
Adobe ColdFusion and Commerce patches
Outro and closing remarks
Listen ad-free on Castria