At a glance.
- Microsoft issues emergency patches for actively exploited SharePoint flaw.
- Alaska Airlines grounds flights during IT outage.
- Dell confirms breach of test lab platform.
Microsoft issues emergency patches for actively exploited SharePoint flaw.
Microsoft has released emergency patches for two actively exploited SharePoint zero-days (CVE-2025-53770 and CVE-2025-53771). CVE-2025-53770 allows attackers to bypass a recent patch for a critical remote code execution vulnerability dubbed "ToolShell." The flaws only apply to on-premises SharePoint Servers; SharePoint Online in Microsoft 365 is unaffected.
The Washington Post reports that hackers have exploited the flaw to compromise "U.S. federal and state agencies, universities, energy companies, and an Asian telecommunications company." Pete Renals, a senior manager at Palo Alto Networks' Unit 42, told the Post, "We have identified dozens of compromised organizations spanning both commercial and government sectors."
Researchers at SOCRadar explain, "[E]xploitation begins with deserialization of malicious input. Attackers then extract ASP.NET MachineKeys from the server, specifically the ValidationKey and DecryptionKey, and use them to craft forged __VIEWSTATE payloads. These payloads are accepted as legitimate by SharePoint, allowing attackers to maintain access and run arbitrary commands without detection."