Microsoft Fix Targets Attacks on Share Point Zero-Day
Summary: On Sunday, July 20, Microsoft issued an emergency update for CVE-2025-53770, an on-premises SharePoint Server flaw being actively exploited and only partially addressed by the July 8, 2025 patch; CISA called it a variant of CVE-2025-49706. Eye Security first spotted large-scale exploitation on July 18, 2025, finding dozens of servers compromised and infected with a backdoor dubbed ToolShell that CISA says provides unauthenticated remote access, while attackers also sought to steal SharePoint ASP.NET machine keys.
Key Takeaway: Eye Security warns that patching alone is not enough, because stolen ASP.NET machine keys can be used to facilitate further attacks even at a later date, and the Washington Post reports at least two U.S. federal agencies have already had servers breached.