⚡ Weekly Recap: Share Point 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More

Summary: Microsoft released fixes for two SharePoint Server flaws, CVE-2025-53770 and CVE-2025-53771, that have been actively exploited in the wild to breach dozens of organizations worldwide; both are assessed as patch bypasses for CVE-2025-49704 and CVE-2025-49706, an exploit chain dubbed ToolShell that enables remote code execution on on-premises SharePoint servers. The source also lists other high-risk vulnerabilities this week, including CVE-2025-23266 and CVE-2025-23267 in NVIDIA Container Toolkit, CVE-2025-6558 in Google Chrome, and CVE-2025-54309 in CrushFTP, and notes that it is not known who is behind the SharePoint mass-exploitation activity.
Why it matters: Dozens of organizations were breached through on-premises SharePoint servers using a chain built on bypassing patches Microsoft had already shipped, so the exposure was not a missing fix but a fix that did not hold.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2024-13972 CVE-2025-20337 CVE-2025-23266 CVE-2025-23267 CVE-2025-2500 CVE-2025-27209 CVE-2025-27210 CVE-2025-27212 CVE-2025-2884 CVE-2025-3052 CVE-2025-30751 CVE-2025-31019 CVE-2025-33043 CVE-2025-37103 CVE-2025-40776 CVE-2025-40777 CVE-2025-41236 CVE-2025-4657 CVE-2025-48384 CVE-2025-4919 CVE-2025-49704 CVE-2025-49706 CVE-2025-50067 CVE-2025-5333 CVE-2025-53506 CVE-2025-53770 CVE-2025-53771 CVE-2025-53833 CVE-2025-53906 CVE-2025-54309 CVE-2025-6023 CVE-2025-6197 CVE-2025-6230 CVE-2025-6231 CVE-2025-6232 CVE-2025-6558 CVE-2025-6965 CVE-2025-7433 CVE-2025-7472
Related: Tool Shell: Details of CVEs affecting Share Point servers Cyber Risks ·
IR Trends Q3 2025: Tool Shell attacks dominate, highlighting criticality of segmentation and rapid response Cyber Risks ·
Microsoft Fix Targets Attacks on Share Point Zero-Day Cyber Risks ·