SANS Internet Storm Center

Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.

This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available. 

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

I believe the cybersecurity industry may be approaching AI security the wrong way.

[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program]

Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg).