Stay updated with the latest cybersecurity news! This weekly roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities
Published: 2025-07-20
CISA has identified active exploitation of SharePoint vulnerabilities, specifically CVE-2025-49706 and CVE-2025-49704, allowing unauthorized access and code execution on on-premise servers, with threat actors also deploying Warlock ransomware and using .dll payloads. Microsoft has released security updates and detection guidance, and CISA recommends applying these updates, configuring Antimalware Scan Interface, and monitoring for suspicious activities.
2. Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
Published: 2025-07-23
Hackers have been exploiting a critical Microsoft SharePoint zero-day vulnerability, CVE-2025-53770, since July 7, 2025, to gain unauthorized access and steal cryptographic keys, with attacks intensifying on July 18 and 19 across government, telecommunications, and software sectors in North America and Western Europe. The exploitation involves chaining CVE-2025-53770 with another vulnerability, CVE-2025-49706, to execute remote code and deploy malicious web shells like spinstall0.aspx, which extracts sensitive keys for persistent access.
3. CISA Orders Urgent Patching After Chinese Hackers Exploit SharePoint Flaws in Live Attacks
Published: 2025-07-22
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Microsoft SharePoint vulnerabilities, CVE-2025-49704 and CVE-2025-49706, to its Known Exploited Vulnerabilities catalog due to active exploitation by Chinese hacking groups like Linen Typhoon and Violet Typhoon, requiring Federal Civilian Executive Branch agencies to remediate by July 23, 2025. These flaws, part of a spoofing and remote code execution vulnerability chain tracked as ToolShell, have been used to breach on-premises SharePoint servers since July 7, 2025, enabling unauthorized access and deployment of web shells to steal data.
4. Suspected XSS Forum Admin Arrested in Ukraine
Published: 2025-07-22
A suspected administrator of the Russian-language cybercrime forum XSS was arrested in Ukraine on July 22, 2025. The operation involved collaboration between Ukrainian authorities, French police, and Europol.
5. Trump’s new AI Action Plan sets bold course – with cybersecurity at strategic core
Published: 2025-07-23
The White House released its new AI Action Plan to win the AI race against China and usher in “a new golden age of human flourishing.” While the document tackles everything from loosening regulations and semiconductor production to education reform and public-private sector investments, one theme cuts across all the ambitions: cybersecurity.
6. Storm-2603 spotted deploying ransomware on exploited SharePoint servers
Published: 2025-07-24
One of the groups that has been exploiting vulnerabilities in on-prem SharePoint installation has been observed deploying Warlock ransomware.
7. Joint Advisory Issued on Protecting Against Interlock Ransomware
Published: 2025-07-22
This advisory highlights known Interlock ransomware indicators of compromise and tactics, techniques, and procedures identified through recent FBI investigations.
8. Hackers Use GitHub Repositories to Host Amadey Malware and Data Stealers, Bypassing Filters
Published: 2025-07-17
Threat actors are leveraging public GitHub repositories to host malicious payloads and distribute them via Amadey as part of a campaign observed in April 2025.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for weekly updates, and consider using tools like WP Umbrella to monitor your WordPress site for vulnerabilities and automate security patches. Stay safe online!