Hello and welcome to the Thursday, August 31st, 2020,

edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and

today I'm recording from Jacksonville, Florida. Well, as you may have heard, Florida was

hit by a significant hurricane today. Luckily, Jacksonville, where I live, wasn't really affected, but I figured maybe a good opportunity to sort of share some general hurricane preparedness tips. Of course, much of that can be applied to all kinds of disasters. One issue actually that someone brought up in a comment on social media was that the sort of home office small business type of setups are even more significant now with people working at home,

where your disaster recovery plan will often depends on people being able to continue to work at home.

But on the other hand, you may actually have an advantage if you have a more geographically diverse workforce

in that not everybody necessarily is affected by a disaster like this.

So if you're interested, take a look at the diary I wrote and any comments, any other tips that you may find useful.

Please share them.

And security labs did release proof of concept, exploit and details about fixing vulnerabilities in Notepad++.

Notepad++, a very popular Windows application.

The problem here is if you open a crafted file with Notepad++, well, remote code execution may have.

And before you say, okay, nobody's ever going to open a random document in Notepad Plus Plus.

The overall vulnerability here is very similar to many of the exploits that we have seen, for

example, against Microsoft Office software.

And a developer or someone else using Notepad++ quite regular may of course open a random document

they receive in an email or find on a website in this tool.

The problem here is that the vulnerabilities have not been fixed yet. Security Lab who identified these

vulnerabilities, I think has done a real good job, at least according to our timeline, and

not just notifying Notepad plus-plus maintainers, but also suggesting, for example,

fixes and even creating some private pull requests for them to

incorporate these fixes. But that apparently has not happened so far, even though

...