SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
Runs 6:14. Streams from traffic.libsyn.com only when you press play.
Today's episode covers how to detect multipath TCP in your network, attacks stealing Bitcoin and Litecoin from outdated BTCPay Server installs, Barracuda patches for an authorization bypass and command injection in Email Security Gateway and other appliances, and Synology's warning about ransomware hitting outdated DSM devices. Multipath TCP: Use and Detection Multipath TCP (MPTCP), back in the news because of the Linux vulnerability CVE-2026-98432, is identified by TCP option 30 and is most commonly used by iOS devices connecting to Apple's 17.0.0.0/8 network for Siri and Apple Music.
Show notes from SANS Internet Storm Center StormCast.
Explained
The technology and terms in this story. Learn more
- AttackRansomwareMalware that encrypts an organisation's systems and demands payment, often after stealing data to leak.
- WeaknessCommand injectionGetting an application to run operating-system commands built from attacker input.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
