Publisher
isc.sans.edu
Newest story built on isc.sans.edu reporting: Two GitHub scripts let responders rebuild OpenCode and Hermes agent sessions from disk (October 16, 2026). isc.sans.edu reporting informs the Security and Leadership desks, most often on AI Agent Security, AI Coding Agents, and AI-Assisted Vulnerability Discovery. 7 of our current stories draw on it, the earliest from August 26, 2026.
Two new Python scripts on GitHub rebuild OpenCode and Hermes AI agent activity for incident responders, according to an isc.sans.edu diary. Both accept a time range and evidence collected from the system under investigation, such as a mounted image or tarball.
Reality
Microsoft shipped a record 1,407 CVEs on October Patch Tuesday, including an exploited Windows Shell Mark of the Web bypass. The component's 2026 record argues for a standing slot in the monthly patch cycle.
Perspective Coverage
23 publishersReality
ReliaQuest reports ransomware actors are exploiting CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS GlobalProtect and Prisma Access. The Bedrock Agents credential flaw Zenity found is already fixed.
Reality
GitLab patched CVE-2026-97229, an integer overflow in its CI/CD regex compiler that lets unauthenticated users run code on self-managed servers. Separately, Let's Encrypt's 64-day production certificates start February 10, 2027, so renewal automation needs a test run first.
Reality
Phishing emails carrying fake PDF invoices are installing Action1's remote-management agent, SANS ISC handler Xavier Mertens reported. It follows a ScreenConnect campaign he documented a few days earlier that used the same fake-invoice lure.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Reality