The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active…
Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…
TWINLOOT is a modular Python implant hardened with PyArmor that uses SharePoint Online and Microsoft Teams TURN relays for command-and-control. It steals…
TWINLOOT uses SharePoint Online as a file dead-drop for tasking via the Microsoft Graph API, polling every 15 seconds for commands.
Microsoft SharePoint Weak Authentication Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based…
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows…
Microsoft released its August 2026 Patch Tuesday updates, addressing a total of 398 vulnerabilities, with 62 rated Critical. The most urgent fix…
Rapid7 Labs reported a SharePoint exploit chain combining an authentication bypass and RCE, leading to unauthenticated remote code execution.
CVE-2026-63520 is the code execution component of a SharePoint exploit chain, fixed in August 2026. Chaining with CVE-2026-55040 enables unauthenticated RCE.
SharePoint Server Subscription Edition is affected by CVE-2026-55040 and CVE-2026-63520. The July update (KB5002882) breaks the exploit chain.