Storm-2603 Exploits SharePoint ToolShell Flaws and Cloudflare Tunnels
Storm-2603 installed webshells and deployed Cloudflare Tunnels after exploiting SharePoint vulnerabilities.
1
Stories per day · 30 days
4 RSS
Relatedmicrosoft4patch-tuesday4windows4cve-2026-969513zero-day3motw2storm-26032velociraptor2warlock2atlassian1cisa-kev1cloudflare1critical-infrastructure1fileless1gitlab1ibm1ransomware1sql-server1
44 stories, newest first · one card per story
Stories tagged #sharepoint
Storm-2603 disabled security tools before deploying Warlock
Researchers say the group hit a water utility, a telecom, a regional government and a university after SharePoint access.
1
Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities
Microsoft's October Patch Tuesday fixes 1,413 flaws, including exploited Windows Shell bypass CVE-2026-96951.
7
Microsoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 Updates
Microsoft's October 2026 updates fix 1,415 CVEs, including an exploited Windows Shell zero-day.
8
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft patched a record 1,413 flaws, including exploited Windows Shell bug CVE-2026-96951 now on CISA’s KEV list.
9
October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days
Microsoft's October Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell Mark-of-the-Web bypass.
10
How to secure RMM software: 8 controls MSPs should test
An Acronis-backed checklist tells MSPs to test eight RMM controls, citing N-able and SharePoint flaws.
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
Warlock ransomware operators still exploit unpatched SharePoint flaws to hit water, telecom, government, and university targets.
6
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock is exploiting SharePoint flaws to disable defenses and deploy ransomware against critical infrastructure and government targets.
5
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
4
'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
A Chinese group is deploying Warlock ransomware against critical infrastructure via unpatched SharePoint flaws.
1
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.
11
Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
China-nexus Longlegs deploys Warlock ransomware via exploited SharePoint flaws against water utility, telecom, government, and university targets across three continents.
4
CISA Warns of Microsoft SharePoint Code Injection Vulnerability Exploited in Attacks
CISA added actively exploited SharePoint code-injection flaw CVE-2026-65660 to the KEV catalog, with federal fixes due September 28.
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
Attackers are exploiting patched Microsoft SharePoint flaw CVE-2026-65660, which CISA added to KEV.
2
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA listed actively exploited SharePoint RCE and MikroTik RouterOS flaws in the KEV catalog.
5
U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited Microsoft SharePoint and MikroTik RouterOS flaws to KEV, due September 28.
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
CISA says attackers are exploiting critical WSO2 and Adobe Commerce flaws plus SharePoint and MikroTik bugs.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited SharePoint and MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog.
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canada’s Cyber Centre says SharePoint flaw CVE-2026-65660 is actively exploited for code execution.
5
Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code
CVE-2026-65660 allows authenticated low-privilege users to execute arbitrary code on vulnerable on-premises Microsoft SharePoint servers via a SafeControls bypass.
4
Microsoft SharePoint Flaw Lets Attackers Execute Code Remotely With Low Privileges
Microsoft patched CVE-2026-65660, an authenticated SharePoint Server remote code execution flaw scored 8.8.
2
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Researchers show SharePoint CVE-2026-65660 enables authenticated RCE, despite Microsoft first listing it as spoofing.
2
Secure enterprise sharing with access reviews for Microsoft 365
tenfold-sponsored article warns Microsoft 365 file sharing often outlives its purpose and pitches its identity governance platform for access reviews.
3