#SharePoint
All CosmicBytez Labs articles tagged #SharePoint, across news, security advisories, how-to guides, and projects.
- News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
China-nexus group Longlegs is still abusing SharePoint ToolShell flaws and a BYOVD EDR killer to deploy Warlock ransomware on critical infrastructure.
- News
'Warlock' Ransomware Hits Critical Infrastructure in Portuguese- and Spanish-Speaking Countries
A China-nexus threat actor is exploiting Microsoft SharePoint flaws, including ToolShell, to deploy Warlock ransomware against critical infrastructure.
- News
Warlock Ransomware Breaches Water Utility, Telecom via SharePoint Flaws
New forensic detail reveals a 9-day Warlock ransomware intrusion chain that hit a water utility, telecom operator, government body, and university.
- News
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
China-nexus actor Longlegs (Storm-2603) hit a water utility, telecom, government body, and university in Iberia and Latin America via SharePoint flaws.
- News
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA added CVE-2026-65660 (SharePoint RCE, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS, CVSS 6.9) to its KEV catalog citing active exploitation.
- News
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
CVE-2026-65660 was labeled a low-impact spoofing bug, but full technical details show it enables authenticated remote code execution.
- Newsletter
Weekly Digest — Issue #36
Arista's VeloCloud takes a CVSS 10.0 under active attack, a Microsoft 'spoofing' bug turns out to be real RCE, and China loots government data.
- News
Hackers Target Microsoft SharePoint RCE Chain With PoC Exploit
Attackers are probing a two-bug SharePoint chain — a JWT auth bypass plus a BCS flaw — after public PoCs made unauthenticated RCE reachable.
- News
Swiss Government SharePoint Breach Compromised 200 Accounts
Switzerland's Federal IT Office confirms hackers exploited Microsoft SharePoint vulnerabilities to breach federal servers and compromise approximately 200...
- Security
CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a critical deserialization of untrusted data vulnerability allowing unauthenticated attackers to execute arbitrary code over...
- News
Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request shouldn't be able to do this much. This week delivered pre-authenticated WordPress RCE, dual SonicWall zero-days exploited since June, a...
- News
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA has added a high-severity Microsoft SharePoint Server remote code execution vulnerability to its Known Exploited Vulnerabilities catalog following...
- News
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across
Microsoft has released updates fixing CVE-2026-45659, a CVSS 8.8 remote code execution vulnerability in SharePoint Server that requires no specialized.
- Newsletter
May 26 Digest: SharePoint RCE, Megalodon CI/CD Blitz
Microsoft patches a CVSS 8.8 SharePoint RCE; the Megalodon campaign poisons 5,561 GitHub repos in six hours; 7-Eleven's ShinyHunters breach hits 185,000; and a.
- News
Patch Tuesday, April 2026 Edition
Microsoft released patches for 167 security vulnerabilities in April 2026, including an actively exploited SharePoint Server zero-day and the publicly...
- News
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Spoofing Attacks
More than 1,300 internet-facing Microsoft SharePoint servers remain unpatched against a spoofing vulnerability exploited as a zero-day, with active...
- News
Microsoft Drops Its Second-Largest Monthly Patch Batch on Record
Microsoft's April 2026 Patch Tuesday addressed 169 CVEs — the second-largest monthly update in company history — including one actively exploited...
- News
Microsoft Issues Patches for SharePoint Zero-Day and 168
Microsoft's April 2026 Patch Tuesday addresses a record 169 security vulnerabilities including a SharePoint zero-day actively exploited in the wild, 8...