Cybercriminals Exploit Critical SharePoint Vulnerability CVE-2025-53770 for Remote Code Execution
Cybercriminals are actively exploiting a critical vulnerability in Microsoft SharePoint Server that allows remote code execution without authentication or user interaction.
The flaw, registered as CVE-2025-53770, received a CVSS score of 9.8 and impacts on-premises installations of the collaboration platform. It arises from unsafe deserialization of specially crafted data submitted to the server, enabling attackers to run arbitrary commands and fully compromise the system.
The exploitation is part of an attack chain known as ToolShell, which also involves the vulnerabilities CVE-2025-49704 and CVE-2025-49706. The issues CVE-2025-53770 and CVE-2025-53771 emerged as variants specifically designed to circumvent previously applied protections.
Affected products include SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The cloud-based SharePoint Online service offered through Microsoft 365 is not impacted.
After gaining initial access, threat actors can deploy web shells, run additional tools, and exfiltrate cryptographic keys from ASP.NET. These keys allow attackers to forge valid authentication tokens and retain access even after security updates are installed.
Administrators are advised to deploy all available patches without delay, limit internet exposure of SharePoint servers, and search for suspicious files, processes, and scheduled tasks that may indicate compromise.
Related articles
From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline
INFERA AI.SafeCode integrates seven distinct security scanners into one continuous analysis platform that automatically validates findings instead of flooding teams with unconfirmed alerts. The solution combines SAST, SCA, Secrets detection, DAST, AI-driven Pentest agents, Code Fuzzing, and API Fuzzing to deliver proof-of-exploit evidence for high-risk issues. By cross-validating results across engines, the platform reduces false positives and provides developers with actionable tasks that include reproduction steps, stack traces, and one-click AutoFix recommendations directly inside IDEs and Git workflows. Special attention is given to AI-generated code from tools such as GitHub Copilot, Cursor, and Claude, ensuring that rapid development does not introduce unvetted vulnerabilities. The system also maps full attack surfaces, tracks reachability from entry points to vulnerable sinks, and supports compliance requirements including FSTEC orders for critical information infrastructure. MLSecOps capabilities extend coverage to machine-learning pipelines, model configurations, and inference APIs. Overall, INFERA shifts AppSec from reactive alert triage to measurable risk management with clear MTTR metrics and SLA tracking.
Critical wp2shell Vulnerability Chain Exploited in WordPress for Unauthenticated Remote Code Execution and Webshell Deployment
A critical vulnerability chain dubbed wp2shell is being actively exploited against WordPress Core installations, enabling unauthenticated remote code execution and the installation of persistent webshells. The flaws affect versions 7.0.x prior to 7.0.2, 6.9.x prior to 6.9.5, and the 6.8 branch before 6.8.6, with patches now available. Attackers chain CVE-2026-63030 and CVE-2026-60137 through the WordPress REST API batch processing endpoint and an SQL injection in WP_Query via the author__not_in parameter. Observed campaigns involve mass scanning, user enumeration, attempts to read wp-config.php, and deployment of PHP webshells in wp-content/cache that return fake 404 responses. Administrators are urged to update immediately, audit logs for anomalous REST API requests, inspect for unauthorized admin accounts or plugins, and rotate credentials if wp-config.php exposure is suspected.
Telegram Bug Floods iPhones with Fake Notifications, Causing Severe Overheating and Battery Drain
A persistent bug in the Telegram messaging app has been causing iOS devices to overheat dramatically and rapidly drain their batteries by spamming hundreds of false push notifications in the background. The issue triggers constant English-language alerts reading "You have a new message" even when users have Russian language settings enabled and message previews turned off, rendering the notifications useless. Reports of the problem first emerged in May but intensified after the release of Telegram version 12.9, which appears to create an infinite loop in background processes that overworks the CPU. Affected users report battery losses of up to 11 percent within 30 minutes of idle time, with some devices becoming hot enough that Apple automatically pauses charging until temperatures drop. One journalist resorted to using a gaming controller with a built-in fan to keep an iPhone cool enough to charge. The only temporary workaround involves clearing the app cache and performing a full reinstall from the App Store, though the bug has been known to return after one or two weeks for some users.
Rent, Don't Build: Penetration Testing, Vulnerability Management, and Bug Bounty as a Service
The fifth installment in the Vulnerability Management for Beginners series explores three outsourcing models that allow organizations to avoid building their own infrastructure for vulnerability management. Pentest as a Service, VM as a Service, and bug bounty programs each offer distinct advantages in speed, coverage, and cost while shifting operational burdens to specialized providers. The article details how automated and manual penetration testing differ in depth and scope, why white-box scanning inside the network yields more accurate results than black-box perimeter tests, and how bug bounty platforms like HackerOne and Standoff Bug Bounty have scaled dramatically in Russia and globally. It also covers practical requirements such as proving asset ownership, establishing triage processes, setting realistic SLAs, and handling sensitive data risks when using external services. Benchmarks from providers, updated EPSS metrics, CISA KEV catalogs, and the latest FSTEC methodology are presented as tools for better prioritization. The piece concludes with legal and operational caveats for Russian companies adopting these models in 2025.