SANS Internet Storm Center Stormcast: Critical Vulnerabilities in Broadcom ECOS, OVH CLI Compromise, and Plex RCE Exploit

This SANS Internet Storm Center Stormcast from October 20, 2026 covers multiple cybersecurity developments. Quentin Kaiser presented at Hexacon in Paris about critical vulnerabilities in Broadcom's ECOS platform that allow attackers within Wi-Fi range to execute arbitrary code on access points without authentication, bypassing WPA entirely. Broadcom has not acknowledged these vulnerabilities or issued CVEs, though a silent patch was reportedly released. OVH's command line utilities were compromised for several hours on Friday with an infostealer added to multiple versions, with version 0.16.0 being the clean post-compromise release. A new Plex media server vulnerability chain allows unauthenticated remote code execution through server-side request forgery, exploiting relaxed authentication for localhost requests to retrieve admin tokens. Microsoft's October 2026 Windows update is causing instability in on-premise Exchange servers, with the Exchange team recommending a registry fix rather than uninstalling the patch. Additional topics include AI agent containment techniques, a Yara rule for detecting malicious content in AutoCAD DWG files, and general security advisories.