Podcast Detail

SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10160.mp3

previous
Podcast Logo
OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Didier Stevens adds bulk JSON extraction to his OneNote analysis tool, a trojanized Anthropic Claude Code extension in the Cursor VS Code Extension Marketplace installs an SSH backdoor, Ivanti patches two more exploited Connect Secure zero-days, an Android "SMS of Death" proof of concept is public, and a Linux kernel Multipath TCP (MPTCP) mitigation update.

OneNote File Extraction
Didier Stevens added a --jsonoutput option to his onedump.py tool, so embedded attachments from many OneNote (.one) files can be extracted in one run instead of one file at a time. Combined with myjson-filter.py, all embedded files are written to disk named by their SHA-256 hash.
https://isc.sans.edu/diary/OneNote%20File%20Extraction/33478

Trojanized Claude Code Extension in Cursor's Marketplace
Malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were available in the Cursor VS Code Extension Marketplace on October 29; they were not built by Anthropic. The extension adds an attacker SSH key, installs persistence, and tries to open a reverse SSH tunnel (that step fails on most hosts without admin rights). Cursor shut down the marketplace during cleanup and published indicators of compromise and detection and remediation scripts.
https://cursor.com/blog/claude-code-extension-security-notice

Ivanti Connect Secure Update and Exploit Details
Ivanti updated its October 13 Connect Secure advisory (CVE-2026-104935, authentication bypass) with fixes for two more vulnerabilities exploited in the same chain: CVE-2026-111357, missing authentication for a critical function allowing escalation to root (CVSS 8.8), and CVE-2026-118527, file uploads to predictable locations. Volexity describes how the three zero-days were chained for unauthenticated root code execution; update to 25.1.1.3 or 22.8R2.6 even if you patched on October 13.
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

SMS of Death
A working proof of concept is now public for the "SMS of Death": a single malformed Wireless Application Protocol (WAP) Push SMS crashes com.android.phone, dropping active calls with no user interaction. Google fixed this denial of service in the October 2026 Android security update for Android 14 through 17.
https://smsofdeath.com

Linux Multipath TCP Vulnerability Update
A follow-up on Friday's Linux kernel remote code execution flaw (CVE-2026-98432): the demonstrated exploit needs Multipath TCP enabled and a listening socket. Many distributions have shipped kernel updates; until you can patch, setting the sysctl net.mptcp.enabled=0 disables MPTCP.
https://aws.amazon.com/security/security-bulletins/2026-160-aws/

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Monday, November 2nd, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Leadership. OneNote is one of those tools
 that you probably can't escape if you have to work in an
 enterprise environment. And Didier had all along a neat tool
 that allowed you to extract attachments from OneNote file.
 The problem with the tool was it was one file at a time,
 which of course gets tedious after a while. So now Didier has
 added a new feature to his OneNote extraction tool. And
 this feature will save all of the attachments into a JSON
 formatted file. It can even be applied to multiple files at
 the same time and makes your data extraction with that
 quite a bit more efficient. So if you have to do that, well,
 definitely take a look at this updated tool by Didier. On
 Friday, well, one event kind of looked very scary
 initially, and that was a malicious Anthropic Claude Code
 extension being uploaded to the Cursor Visual Studio Code
 extension marketplace. Cursor, of course, being quite popular
 among developers. And this is the obvious extension
 to use if you want to integrate with Claude. The
 initial concern was that maybe Anthropic was compromised.
 Apparently, that's not what happened here. The Visual
 Studio extension marketplace for Cursor was actually shut
 down as a response to help with the cleanup. Yes, the
 extension was downloaded while it was available. For any
 developers who did run this extension, it will set up an
 SSH tunnel in order to allow the attacker to further
 compromise the system. So you definitely want to make sure
 that you're not running this malicious extension. And there
 is in the cursor.com blog quite a bit of help in
 identifying whether or not you're running the malicious
 version or whether you were affected by the SSH tunnel
 that this malicious extension set up. And on Friday, Ivanti
 did release an interesting update to Connect Secure.
 Interesting because they actually didn't release a new
 advisory for this, but updated an existing advisory that they
 released on October 13. On October 13, they released this
 advisory patching one vulnerability. This was an
 authentication bypass vulnerability. Now, turns out
 there were two more vulnerabilities and these
 additional vulnerabilities. The second one is also a
 missing authentication for a critical function in Ivanti
 Connect Secure. Pretty much the same CVSS score as the
 first vulnerability. And then also a use of predictable file
 names in Ivanti Connect Secure, which actually sort of
 completes the exploit chain here. Now, we also got a blog
 post from Volexity detailing how these three
 vulnerabilities together were used in the wild for
 exploitation. And that's why they, I guess, held back a
 little bit on releasing the vulnerabilities, but they were
 already exploited in the wild. And yes, now you finally have
 to patch for hopefully all the vulnerabilities. And Android
 users be aware there is now a working proof of concept for
 the SMS of death. That's a vulnerability that was patched
 around mid-October. And due to this vulnerability, a single
 malformed WAP push SMS message can crash com.android.phone
 on Android, which will drop active calls without any
 interaction from the victim. So make sure that you update
 Android. But again, it's just a denial of service
 vulnerability. And then just a quick update regarding the
 multi-path TCP vulnerability that was patched last week and
 that I mentioned on Friday. Turns out that Linux,
 typically in modern versions, has multi-path TCP enabled in
 the kernel. So to be vulnerable, as long as the
 setting is enabled, you just have to have any TCP socket
 listening. Doesn't really matter what's listening in
 order to be exploitable. Kernel updates have been
 released by many distributions already. If yours hasn't
 released one yet, then disabling multi-path TCP in
 the kernel will prevent exploitation. And yes, it's
 essentially just a sysctl setting. So double check for
 your distribution how to best implement that if you don't
 want to wait for a patch. Well, and this is it for
 today. So thanks again for listening. Thanks for liking.
 Thanks for recommending this podcast. And talk to you again
 tomorrow. Bye.