InfoSecBulletin Cybersecurity for mankind
Over 17k Microsoft SharePoint servers are exposed to internet attacks, with 840 vulnerable to the critical zero-day vulnerability CVE-2025-53770, according to Shadowserver Foundation.
The “ToolShell” vulnerability has a critical CVSS score of 9.8 and lets unauthorized users run arbitrary code on on-premises SharePoint servers.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft has attributed the attacks to three Chinese threat actors: Linen Typhoon (APT27), Violet Typhoon (APT31), and Storm-2603. The exploitation campaign has been active since July 7, 2025, with researchers observing a rapid escalation following the initial discovery.
Eye Security, which initially reported the attacks on July 18, has identified over 400 victim organizations across various sectors like government, healthcare, finance, and education.
Microsoft has released emergency patches for all supported SharePoint versions. Organizations must rotate machine keys, enable Anti-Malware Scan Interface (AMSI), and conduct thorough security assessments.
CISA has added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog with an emergency remediation deadline, underscoring the severity of the threat to critical infrastructure.
Multiple U.S. federal agencies, including the Department of Energy’s National Nuclear Security Administration and the Departments of Homeland Security, Health and Human Services, and Education, have been confirmed as victims. Additionally, state and local agencies nationwide have been affected.
