SANS Stormcast Tuesday, August 12th, 2025: Erlang OTP SSH Exploits (Palo Alto Networks); Winrar Exploits; Netscaler Exploits; OpenSSH Pushing PQ Crypto;
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS ISC Handlers
4.9 • 696 Ratings
🗓️ 12 August 2025
⏱️ 7 minutes
🧾️ Download transcript
Summary
Erlang OTP SSH Exploits
A recently patched and easily exploited vulnerability in Erlang/OTP SSH is being exploited. Palo Alto collected some of the details about this exploit activity that they observed.
https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/
WinRAR Exploited
WinRAR vulnerabilities are actively being exploited by a number of threat actors. The vulnerability allows for the creation of arbitrary files as the archive is extracted.
https://thehackernews.com/2025/08/winrar-zero-day-under-active.html
Citrix Netscaler Exploit Updates
The Dutch Center for Cyber Security is updating its guidance on recent Citrix Netscaler attacks. Note that the attacks started before a patch became available, and attackers are actively hiding their tracks to make it more difficult to detect a compromise.
https://www.ncsc.nl/actueel/nieuws/2025/07/22/casus-citrix-kwetsbaarheid https://www.bleepingcomputer.com/news/security/netherlands-citrix-netscaler-flaw-cve-2025-6543-exploited-to-breach-orgs/
OpenSSH Post Quantum Encryption
Starting in version 10.1, OpenSSH will warn users if they are using quantum-unsafe algorithms
https://www.openssh.com/pq.html
Transcript
Click on a timestamp to play from that location
| 0:00.0 | Hello and welcome to the Tuesday, August 12, 2025 edition of the Sands Internet Storm Centers. |
| 0:11.9 | Stormcast, my name is Johannes Ulrich, recording today from Jacksonville, Florida. |
| 0:18.0 | And this episode is brought you by the sands.edu credit certificate program in cyber |
| 0:23.7 | defense operations. Well, ahead of patch Tuesday, I do want to take a little bit of a different |
| 0:30.4 | spin here and talk about a couple vulnerabilities that became known as being exploited the last |
| 0:36.6 | couple days. All of these vulnerabilities have patches available, |
| 0:40.4 | so these are not strictly speaking zero days, |
| 0:42.8 | but still some of these patches are relatively new. |
| 0:46.9 | The first one here is the vulnerability in the Erlang OTP variant of SSH. OTP stands for open telecom platform, and that's |
| 0:59.7 | where you often find this version of SSH. There's a number of Cisco devices that run Erlang OTP |
| 1:07.2 | SSH. So those are the kind of devices where you have to be careful and that you must patch. |
| 1:14.3 | When I talked about the patch and the vulnerability as it was released, the exploit is actually |
| 1:19.8 | relatively straightforward. |
| 1:21.6 | So no big surprise that it is being exploited in the while. |
| 1:26.4 | And Palo Alto here collected some of the evidence that they found and how it is being exploited in the wild, and Palo Alto here collected some of the evidence that they found |
| 1:29.9 | and how it is being exploited in the wild right now. So definitely something that you must patch now, |
| 1:36.9 | and if you have devices that are exposed, that are using this version of SSAH, well, please make sure that you are also checking them for |
| 1:46.0 | any existing compromise, rotate password, rotate any seats for two-factor of the Gasion. |
| 1:54.0 | Well, an other already exploited vulnerability is a vulnerability in Winnera or before version |
| 2:00.3 | 7.12. |
| 2:02.6 | This vulnerability was patched end of June, and it's one of those classic decompression |
| 2:08.4 | warn abilities where an attacker can create an archive that once it's being decompressed or extracted, |
... |
Transcript will be available on the free plan in 21 days. Upgrade to see the full transcript now.
Disclaimer: The podcast and artwork embedded on this page are from SANS ISC Handlers, and are the property of its owner and not affiliated with or endorsed by Tapesearch.
Generated transcripts are the property of SANS ISC Handlers and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.
Copyright © Tapesearch 2025.