What to know about a vulnerability being exploited on Microsoft SharePoint servers
The company issued an alert to customers Saturday saying it was aware of the zero-day exploit being used to conduct attacks and that it was working to patch the issue. Microsoft updated its guidance Sunday with instructions to fix the problem for SharePoint Server 2019 and SharePoint Server Subscription Edition. Engineers were still working on a fix for the older SharePoint Server 2016 software.
'Anybody who's got a hosted SharePoint server has got a problem,' said Adam Meyers, senior vice president with CrowdStrike, a cybersecurity firm. 'It's a significant vulnerability.'
Companies and government agencies around the world use SharePoint for internal document management, data organisation and collaboration.
A zero-day exploit is a cyberattack that takes advantage of a previously unknown security vulnerability. 'Zero-day' refers to the fact that the security engineers have had zero days to develop a fix for the vulnerability.
According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the exploit affecting SharePoint is 'a variant of the existing vulnerability CVE-2025-49706 and poses a risk to organizations with on-premise SharePoint servers.'
Security researchers warn that the exploit, reportedly known as 'ToolShell,' is a serious one and can allow actors to fully access SharePoint file systems, including services connected to SharePoint, such as Teams and OneDrive.
Google's Threat Intelligence Group warned that the vulnerability may allow bad actors to 'bypass future patching.'
Eye Security said in its blog post that it scanned over 8,000 SharePoint servers worldwide and discovered that at least dozens of systems were compromised. The cybersecurity company said the attacks likely began on July 18.
Microsoft said the vulnerability affects only on-site SharePoint servers used within businesses or organisations, and does not affect Microsoft's cloud-based SharePoint Online service.
But Michael Sikorski, CTO and Head of Threat Intelligence for Unit 42 at Palo Alto Networks, warns that the exploit still leaves many potentially exposed to bad actors.
'While cloud environments remain unaffected, on-prem SharePoint deployments — particularly within government, schools, health care including hospitals, and large enterprise companies — are at immediate risk.'
The vulnerability targets SharePoint server software so customers of that product will want to immediately follow Microsoft's guidance to patch their on-site systems.
Although the scope of the attack is still being assessed, CISA warned that the impact could be widespread and recommended that any servers impacted by the exploit should be disconnected from the internet until they are patched.
'We are urging organizations who are running on-prem SharePoint to take action immediately and apply all relevant patches now and as they become available, rotate all cryptographic material, and engage professional incident response. An immediate, band-aid fix would be to unplug your Microsoft SharePoint from the internet until a patch is available,' Sikorski advises.
Hashtags

Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles


Time of India
an hour ago
- Time of India
Youth hold the key to developed India by 2047: Haryana CM Nayab Singh Saini
KURUKSHETRA: Haryana chief minister Nayab Singh Saini on Thursday emphasised the crucial role of youth in realizing Prime Minister Narendra Modi's vision of a 'Developed India' by 2047. Speaking at the closing ceremony of the 'Ek Bharat Shreshtha Bharat Inter-State Youth Exchange Program-2025' in Kurukshetra, the CM expressed confidence that India's ambitious development goals could be achieved through the energy, talent, and determination of its youth. Addressing over 600 youth delegates from 23 States and Union Territories, CM Saini said the program served as a vibrant platform for cultural exchange, national integration, and mutual learning. 'Our diversity is our strength. Though your languages, food habits, and traditions may differ, your identity as Indians unites you all,' he stated, encouraging the youth to become ambassadors of national unity and share their experience in their home states. The event was also attended by Haryana Youth Affairs and sports minister Gaurav Gautam, who lauded the participation of youth in fostering cultural understanding and strengthening the national fabric. by Taboola by Taboola Sponsored Links Sponsored Links Promoted Links Promoted Links You May Like Struggling With Belly Fat? Try This at Home Home Fitness Hack Shop Now Undo Highlighting the state's commitment to youth development, CM Saini said over 1.80 lakh youth have been recruited into government services through transparent, merit-based processes in the last ten-and-a-half years. Additionally, more than 2,000 job fairs have facilitated employment for over 1.06 lakh youth in the private sector. The chief minister noted the establishment of a dedicated MSME department to boost entrepreneurship and job creation. He shared five key mantras for youth empowerment: staying healthy, pursuing education as a means of acquiring knowledge and skills, fulfilling civic responsibilities, upholding integrity, and using technology constructively. 'Nation-building is a shared duty, and youth are at the forefront of shaping our future,' he said. CM Saini also highlighted initiatives like the Haryana Skill Development Mission, which has trained over 1.14 lakh youth in traditional and modern professions, and schemes such as Saksham Yuva Yojana, Drone Didi, and IT Saksham Yuva. Reiterating Haryana's leadership in implementing the National Education Policy (NEP) 2020, he noted that all universities and colleges in the state have adopted the policy. Haryana has also established India's first Skill University — Shri Vishwakarma Skill University in Palwal. In conclusion, Saini called on the youth to embrace traditional knowledge while continuously adapting to new skills, reinforcing that an empowered, skilled youth is the backbone of a self-reliant and developed India.


Time of India
2 hours ago
- Time of India
Alphabet shares jump 3% as AI-driven spending fuels cloud revenue surge
Alphabet shares rose more than 3% in early trading on Thursday as the Google parent's earnings underscored a key message to investors: AI spending is climbing, but so are the returns. The tech giant has raised its 2025 capital spending forecast by $10 billion to $85 billion and signaled even higher outlay next year, stepping up efforts to meet soaring cloud demand and stay competitive in Silicon Valley's escalating AI race. Its cloud-computing unit delivered an almost 32% jump in second-quarter revenue, surpassing expectations, as investments in in-house chips and the Gemini AI model began to pay off. The results bode well for rivals Microsoft and both of which have been stepping up data center investments and operate larger cloud businesses. "Google came back fighting this quarter," said Bernstein analyst Mark Shmulik. "Investors have long been clamoring for Google to get more 'aggressive' in the AI race," he added. An early AI pioneer with its invention of the Transformer model - the foundation of most modern generative AI - Google appeared to fall behind OpenAI and Microsoft last year. But it has rebounded this year, with AI Mode reaching 100 million monthly users just two months into its wider rollout, and Gemini surpassing 450 million monthly users. Its ad business, which accounts for about three-quarters of its sales, also continues to fare well in the face of economic uncertainty wrought by tariffs and geopolitical tensions. Revenue in the business rose a better-than-expected 10.4%, a positive sign for rivals such as Meta and Snap that rely on digital ads for most of their revenue. At least 27 brokerages raised their price targets on Google stock after the results, taking the median target to $220 from $200 a month earlier. Still, some analysts warned the higher spending may draw fresh scrutiny from investors, who have largely stayed on the sidelines this year. Alphabet shares are up just 0.5% in 2025, trailing Microsoft's 20% increase and a 22% rise in Meta stock, also held back by regulatory battles that are looking to break its illegal monopoly in the search and the ad-tech markets. Alphabet's 12-month forward price-to-earnings ratio stands at 18.88, trailing Microsoft's 33.03 and Amazon's 33.31, according to data compiled by LSEG. "On paper, it has all the right tools to lead in AI - cutting-edge models and massive distribution," said Matt Britzman, senior equity analyst at Hargreaves Lansdown. "That said, until there's more confidence AI integration won't cannibalise core search revenue, and some clarity around ongoing legal battles, there's enough uncertainty to cap near-term upside."


Time of India
3 hours ago
- Time of India
'Cut all visa programs': Steve Bannon says 'Einsteins' should remain in their countries amid major tech layoffs
Steve Bannon says US should scrap all visas first and clean up the system while 'Einsteins' can remain in their countries and make those countries great. Amid major tech layoffs in teh US, the focus has again shifted to the H-1B visa programs which the Donald Trump administration is planning to change. But before any change comes into effect, US tech workers, Republican lawmakers are up in arms against big tech companies laying off American workers and then petitioning for foreign labors. After Microsoft which announced job cuts in several phases this year, now Intel has said they are planning to cut more than 25,000 jobs in a major reset. Vice president JD Vance has attacked Microsoft for laying off 9.000 workers and said he doesn't believe in the 'bulls**t story that the company can't find workers in America. Now, Trump's former aide and a staunch critic of H-1B, Steve Bannon, said all visa programs should be cut. He said 'Einsteins' can stay in their countries and contribute to making their countries great, instead of coming to the US. Or, the US can explore a program to bring 'Einsteins'. — gc22gc (@gc22gc) The situation in the Silicon Valley is a festering sore, Bannon said on his podcast, adding that the projection is that 12 million trained IT graduates can't get jobs because US is bringing foreign workers. Bannon said no one can prove that foreign workers are better educated, but tech companies want indentured servants, "people who will work 24 hours a day at half the cost because they are afraid of being sent home". by Taboola by Taboola Sponsored Links Sponsored Links Promoted Links Promoted Links You May Like Many Are Watching Tariffs - Few Are Watching What Nvidia Just Launched Seeking Alpha Read More Undo "We need to cut all the visa programs. If we are going to do it, let's do it hard-core and clean it up," Bannon said. There is always a way to get 'Einsteins', Bannon said, adding that he personally believes for world peace and prosperity, 'Einsteins' should remain in their countries and make their countries great again like they are doing in Japan. JD Vance says displacement of American workers worries him Speaking at a bipartisan event co-hosted by the Hill and Valley Forum, Vance questioned the layoffs of big tech companies and said it does not make any sense to him that they fire Americans to hire foreigners. "That displacement and that math worries me a bit. And what the president has said, he said very clearly: We want the very best and the brightest to make America their home. We want them to build great companies and so forth. But I don't want companies to fire 9,000 American workers and then to go and say, 'We can't find workers here in America.' That's a bulls**t story."