SANS Internet Storm Center StormCast: AutoCAD VBA Scripts, Ledger Hardware Implants, Docker Hub Vulnerability, and Curl RCE Flaw

This SANS Internet Storm Center StormCast from October 15th, 2026 covers three cybersecurity issues. Didier discovered that AutoCAD files can contain Visual Basic for Application scripts similar to Office documents, and recently found files where pointers to these scripts were deleted (likely via an AutoCAD Lisp command), making them invisible but still present in the file. Ledger cryptocurrency wallets sold by authorized resellers in Asia and at European retailer MediaMarkt since early spring 2026 were found to contain hardware implants with LTE modules and SIM cards that exfiltrate seed phrases, resulting in up to 100 million dollars in stolen cryptocurrency. Docker Hub fixed a vulnerability where converting a personal account to an organization allowed the old owner to retain access to personal access tokens that were transferred to the new owner without their confirmation. The curl project released an update fixing multiple vulnerabilities including a remote code execution flaw that can be triggered when curl uploads files over HTTP/2 to a malicious server, with a proof of concept now available.