Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)

This post was originally published on this site

 

On Monday, Apple released updates for iOS/iPadOS, macOS, watchOS, and visionOS. These updates fix nine different vulnerabilities. One of the vulnerabilities, CVE-2026-113971, applies only to iOS/iPadOS version 26. Several of the vulnerabilities apply to Bluetooth issues that may weaken the device pairing process. 

The number of vulnerabilities Apple patches remains small, but Apple has increased the cadence of its updates.

 

iOS 27.2.1 and iPadOS 27.2.1 iOS 26.7.3 and iPadOS 26.7.3 iOS 18.7.12 and iPadOS 18.7.12 macOS Golden Gate 27.2.1 macOS Tahoe 26.7.3 macOS Sequoia 15.8.3 watchOS 27.2.1 watchOS 26.6.1 visionOS 27.2.1
CVE-2026-113960: A user added to an iMessage group may be able to access messages sent before they joined.
Affects Messages
x x   x x x x   x
CVE-2026-113961: A remote attacker may be able to join an iMessage group chat and receive its messages.
Affects Messages
x x   x x x x   x
CVE-2026-113963: An app may be able to access sensitive user data.
Affects App Intents
x           x   x
CVE-2026-113964: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction.
Affects CoreUtils
x x x x x x x x x
CVE-2026-113965: A malicious Bluetooth device may be able to establish a pairing without user interaction.
Affects CoreUtils
x x x x x x x x x
CVE-2026-113968: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.
Affects AirPlay
x x x x x x x x x
CVE-2026-113969: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts.
Affects rapportd
x x x x x x x x x
CVE-2026-113970: An attacker in Bluetooth range may be able to corrupt process memory.
Affects Bluetooth
x x x x x x x x x
CVE-2026-113971: An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.
Affects MediaRemote
    x            

—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)

This post was originally published on this site

Just saw a new (to me) URL in our honeypot data today:

/irj/servlet_jsp/irj/root/ant.jsp

This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells.

The exploited vulnerability is "old": CVE-2025-31324. A perfect 10 CVSS score and the simple ability to upload files without authentication. Attackers have been using this vulnerability to upload webshells. Usually, these webshells end up in /irj/servlet_jsp/irj/root/. 

One particular attacker, 82.26.72.21, is hitting the following URLs. Not all of these URLs are SAP NetWeaver-related. Also, check the odd misspelling of "upload.aspx" at the end.

 

URL Path
/
/_layouts/15/start.aspx
/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx
/amp/upload
/ant.aspx
/ant.jsp
/ant.jsp/
/ant.php
/api/upload
/api/v1/upload
/authenticationendpoint/ant.jsp
/commandcenter/ant.jsp
/commandcenter/deployWebpackage.do
/developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1
/en-US/static/app/search/ant.php
/fileupload/toolsAny
/hosted/amp/upload
/images/ant.php
/images/pagebuilder/ant.php
/index.action
/index.php?option=com_baforms&task=uploader.upload
/index.php?option=com_gridbox&task=uploader.upload
/index.php?option=com_jce&task=plugin.display&plugin=browser
/index.php?option=com_sppagebuilder&task=media.directUpload
/irj/servlet_jsp/irj/root/ant.jsp
/m/webadmin/upload
/MagicInfo/ant.jsp
/MagicInfo/servlet/SWUpdateFileUploader
/NmConsole/ant.aspx
/NmConsole/Wug/Report/ExportReport
/Synchronization
/te/upload
/upload.apsx
/upload.aspx

 

—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)

This post was originally published on this site

Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.

Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)

This post was originally published on this site

This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.

Amazon S3 Tables now offer managed migration of Apache Hive tables to Apache Iceberg

This post was originally published on this site

Today, we’re announcing a simple, cost-effective path for data lake modernization. Amazon S3 Tables now support managed migration of your Apache Hive tables to Apache Iceberg. Migration works with Parquet tables in Amazon S3 that are registered in the AWS Glue Data Catalog and allows you to upgrade your data lake with no pipelines to build or compute to provision, while production workloads keep running.

Apache Iceberg has become the open standard for large analytics datasets. It lets you manage petabyte-scale tables with features like schema evolution, hidden partitioning, and time travel queries, while keeping your data open and queryable with any Iceberg-compatible engine. Amazon S3 Tables offer fully managed storage purpose-built to keep Iceberg tables performant and cost-effective as they grow, with features like automatic maintenance, optimization, replication, and S3 Intelligent-Tiering built-in.

What is new
Previously, migrating Apache Hive tables to Apache Iceberg could take weeks of engineering work to build and manage the required infrastructure. Converting data types and building rollback capabilities added operational complexity. Now, this is available as a managed, API-driven operation.

S3 Tables handle the entire migration workflow, including data validation, compatibility checks, type conversions, file recompression, and compaction. Before copying any data, S3 Tables identify every source object in scope and generate a compatibility report. You can sync as many times as you need without stopping writes to your source table, except for a few minutes during cutover. Once you are ready, you can complete the migration, minimizing time that tables are offline.

Compared to self-managed approaches, S3 Tables managed migrations are cost-effective because you pay only for the data copied, with no charge for the Hive-to-Iceberg conversion, and source objects in S3 Intelligent-Tiering stay in their current access tier.

A first look at the migration
To migrate an AWS Glue Hive table, choose your destination table bucket in the S3 console, then choose Create table from migration.

Create a namespace and table name for your destination Iceberg table. The destination table is created using recommended default settings tuned for query performance and storage efficiency.

When you start the migration, S3 Tables validate the source table, generate a compatibility report, and begin copying data. The destination table is read-only during the migration. Once you complete migration, the destination table is promoted to read-write.

You can begin working with your data right away using a direct integration with Amazon Athena and Amazon SageMaker Unified Studio in the AWS console, or use any tool compatible with the Apache Iceberg REST API to directly query the tables. To learn more, visit the S3 Tables migration documentation.

You can also use AWS Command Line Interface (AWS CLI), AWS SDKs, or the Agent Toolkit for AWS. For example, set up migration jobs and call the start-table-migration command.

cat > /tmp/start-migration.json <<'EOF'
{
  "roleARN": "arn:aws:iam::123456789012:role/S3TablesMigrationRole",
  "destinationTable": {
    "tableBucketARN": "arn:aws:s3tables:us-east-1:123456789012:bucket/my-destination-bucket",
    "namespace": "mynamespace",
    "name": "my_destination_table",
    "encryptionConfiguration": {
      "sseAlgorithm": "aws:kms",
      "kmsKeyArn": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
    },
    "storageClassConfiguration": { "storageClass": "INTELLIGENT_TIERING" },
    "tags": { "team": "s3tables", "purpose": "migration" },
    "properties": {
      "writeFormat": "parquet",
      "icebergFormatVersion": 2,
      "compressionCodec": "zstd",
      "dictionaryEncoding": true
    },
    "schema": {
      "type": "struct",
      "schemaId": 0,
      "identifierFieldIds": [1],
      "fields": [
        { "id": 1, "name": "id",      "type": "long",   "required": true, "doc": "primary key" },
        { "id": 2, "name": "payload", "type": "string", "required": false }
      ]
    },
    "icebergSortOrder": {
      "orderId": 1,
      "fields": [ { "sourceId": 1, "transform": "identity", "direction": "asc", "nullOrder": "nulls-first" } ]
    }
  },
  "sourceType": "glueTable",
  "source": {
    "glueTable": {
      "catalogId": "123456789012",
      "databaseName": "my_glue_database",
      "tableName": "my_source_table"
    }
  },
  "dataMigration": {
    "maintenanceSettings": {
      "icebergCompaction": { "targetFileSizeMB": 512, "strategy": "binpack" },
      "icebergSnapshotManagement": { "minSnapshotsToKeep": 3, "maxSnapshotAgeHours": 168 }
    },
    "migrationPolicies": {
      "unmatchedSourceFieldsPolicy": "fail",
      "incompatibleValuesPolicy": "fail"
    }
  },
  "reviewMigrationPlan": false,
  "migrationOutput": {
    "bucket": "arn:aws:s3:::my-report-bucket",
    "prefixes": {
      "tableCompatibilityReport": "reports/table-compatibility/",
      "objectCompatibilityReport": "reports/object-compatibility/",
      "objectMigrationReport": "reports/object-migration/"
    }
  }
}
EOF

aws s3tables start-table-migration 
  --cli-input-json file:///tmp/start-migration.json

To catch up the destination table with changes in the source, call sync-table-migration as many times as you need before you complete the migration. Each sync copies only what changed.

If you’re using coding agents like Kiro, the migrating-hive-tables-to-s3-tables skill in the Agent Toolkit for AWS provides step-by-step migration guidance with safety guardrails for agents. The skill can:

  • Analyze existing IAM policies and recommend equivalent destination policies
  • Validate the migration plan before getting started
  • Execute the Start → Sync → Complete API calls
  • Monitor job progress and guide validation and cutover

To learn more, visit the GitHub README page for the skill.

Now available
Amazon S3 Tables managed migration is available today in US East (N. Virginia, Ohio), US West (Oregon), Asia Pacific (Mumbai, Singapore, Sydney, Tokyo), and Europe (Frankfurt, Ireland, Stockholm) Regions. At launch, the capability supports AWS Glue-registered Hive tables stored in Parquet format within the same AWS account and AWS Region. If you want to call APIs, search documentation, find regional availability, or troubleshoot about this new feature, try using the AWS MCP Server and plugins with your preferred AI tool.

Try it in the Amazon S3 console today and send feedback to AWS re:Post for Amazon S3 or through your usual AWS Support contacts.

— Channy

The Classics Return: Vulnerable E-Mail Scripts, (Wed, Nov 4th)

This post was originally published on this site

One of the early web application vulnerabilities I remember was CVE-2000-0411 [CVE]. This was a simple vulnerability in a CGI-bin script used to send e-mail. The vulnerability was pretty straightforward: Adding additional parameters to the URL leaked environment variables. Other vulnerabilities allowed setting the "To" address and were heavily abused by spammers. And if parameters were passed directly to the sendmail binary, similar vulnerabilities could allow arbitrary code execution.

OneNote File Extraction, (Sun, Nov 1st)

This post was originally published on this site

Recently, I had to extract embedded files from a set of OneNote files (extension .one).

My onedump.py tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to my onedump.py tool: producing JSON data. Several of my tools already have such a feature: they produce JSON data with the content of their analysis results.

onedump's option –jsonoutput produces JSON output with the content of each embedded file found inside the OneNote file. And it can do this for many .one files in one go:

onedump.py –jsonoutput *.one

To write these files to disk you can use my myjson-filter.py tool, like this:

onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir

This will write all the embedded files to disk, their name will be the sha256 hash of their content plus extension .vir (hashvir).

 

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

YARA-X 1.22.1 Release, (Sat, Oct 31st)

This post was originally published on this site

YARA-X's 1.22.1 is a bugfix version, it brings 2 bugfixes.

Notice that there was also a release of YARA: 4.6.0, and that this release does not include the YARA-X improvement that adds built-in functions to read 64-bit integers: int64, int64be, uint64, and uint64be.

This shows that YARA-X has replaced YARA.

 

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

YARA-X 1.22.1 Release, (Sun, Oct 25th)

This post was originally published on this site

YARA-X's 1.22.1 is a bugfix version, it brings 2 bugfixes.

Notice that there was also a release of YARA: 4.6.0, and that this release does not include the YARA-X improvement that adds built-in functions to read 64-bit integers: int64, int64be, uint64, and uint64be.

This shows that YARA-X has replaced YARA.

 

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.