SharePoint

CISA confirmed that ransomware gangs have begun abusing a high-severity vulnerability in Microsoft SharePoint. This remote code execution flaw has been actively exploited since early July.

This week's security vulnerabilities include WordPress Remote Code Execution, SonicWall 0-Days, AI service attacks, and a SharePoint 0-Day, leading to code execution, memory loss, stolen keys, and disabled security tools. The issues stemmed from exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery.

Microsoft has released an out-of-band security patch for SharePoint, emphasizing its critical role in system access. The patch addresses potential vulnerabilities highlighted by the importance of SharePoint in both attack and defense strategies.

The FBI has warned about Kali365, a phishing-as-a-service platform that steals Microsoft OAuth tokens at scale, allowing attackers to bypass multi-factor authentication and gain unauthorized access to corporate accounts. The kit uses AI-generated phishing lures impersonating trusted services like DocuSign and SharePoint, and employs both device code phishing and adversary-in-the-middle techniques. Kali365 operates on a tiered subscription model and was first spotted in April 2026.

Microsoft released updates addressing 169 security vulnerabilities, including a SharePoint zero-day actively exploited in the wild. The patches include fixes for 157 Important, eight Critical, three Moderate, and one Low severity flaws.