SANS Internet Storm Center Reports Multiple Critical Security Vulnerabilities Under Active Exploitation

This SANS Internet Storm Center Storm Cast from October 16th, 2026 covers multiple critical security vulnerabilities currently being exploited. The episode discusses Panchan, a cryptocurrency mining worm written in Golang that spreads via SSH to Unix systems by stealing SSH keys, installing rootkits, and using Discord as a command and control channel. Zachary Norwood analyzed this worm using the fakenet-ng package for dynamic malware analysis. Cisco's Secure Email Gateway has a critical vulnerability in its advanced malware protection feature that allows attackers to write arbitrary files and execute code as root when the reputation feature is enabled, with no workaround available and active exploitation occurring. Palo Alto released an update for a remote code execution vulnerability that requires authentication but also executes code as root, particularly affecting systems with exposed management interfaces. Ivanti patched two of three chained vulnerabilities identified by Volexity, including an authentication bypass and arbitrary file write vulnerability, though a privilege escalation vulnerability remains unpatched.