Hello and welcome to the Friday, September 26, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Las Vegas, Nevada.

And this episode is brought you by the Sands.edu graduate certificate program in industrial control system security.

Our honeypots registered an increase in scans for files in the dot well-known directory,

and the URLs look like they're probably looking for web shells.

The dot well-known directory is, of course course well in Unix hidden with the dot at the beginning

of the name of the directory, but it is commonly used for information files like

security.

Or also to confirm the ownership of a website with the Agmi protocol if you're using the web-based

authentication for this protocol to obtain certificates.

Probably best to keep an eye on this directory.

If anybody finds an interesting web shell there, would love to take a quick look at what

this web shell does, but not necessarily expecting

anything super sophisticated or different here.

Well, and then we got more news from Cisco.

Yesterday I mentioned the already exploited SNMP vulnerability.

Wasn't really all that exciting because in order to exploit that vulnerability,

you must already have admin credentials.

But we now have two additional vulnerabilities that apparently are also already being exploited

and some say the exploitation goes about one year back.

The first vulnerability is rated as critical. It does allow for

arbitrary code execution on the ASA, that's the adaptive security blinds, as well as on FTT, the

...