Microsoft on Sunday issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. To be clear, this is applicable to those with SharePoint on premise. In an advisory, Microsoft said this:
We are working on security updates for supported versions of SharePoint 2019 and SharePoint 2016. Please check this blog for updates.
To mitigate potential attacks customers should:
- Rotate SharePoint Server ASP.NET machine keys
- Use supported versions of on-premises SharePoint Server
- Apply the latest security updates, including the July 2025 Security Update
- Ensure the Antimalware Scan Interface (AMSI) is turned on and configured correctly, with an appropriate antivirus solution such as Defender Antivirus
- Deploy Microsoft Defender for Endpoint protection, or equivalent threat solutions
The Washington Post is reporting that the U.S. government and partners in Canada and Australia are investigating this situation.
Andrew Obadiaru, CISO, Cobalt, an offensive security company, had this to say:
“Zero-day vulnerabilities in widely deployed platforms like SharePoint are a goldmine for attackers because they provide immediate, scalable access to high-value environments. The challenge isn’t just patching—it’s that attackers typically implant persistence mechanisms within hours, ensuring long-term footholds. Defense strategies need to assume breach and validate controls through proactive testing, including red teaming and continuous pentesting, to uncover weaknesses before adversaries do. In today’s threat landscape, reactive security alone is a losing game.”
If you’re a SharePoint on premise user, drop what you are doing and patch your SharePoint instance to make sure that you don’t get pwned or you have not already been pwned seeing as this is an actively exploited exploit. Because this is a today problem to say the least.
UPDATE: Adrian Culley, Senior Sales Engineer, SafeBreach had this to say:
“This CVE represents a critical security incident: it was exploited as a zero-day vulnerability in active attacks against production systems before any patches were available—the most severe type of threat organizations face. The absence of a single remediation patch further complicates the situation. Microsoft has taken the unusual step of advising organizations to assume compromise and conduct thorough investigations to verify their security posture—language that underscores the severity of this vulnerability.
SharePoint Server 2016 environments face particular challenges, as no immediate technical remediation is available. Organizations must rely on breach and attack simulation exercises alongside their existing security controls to assess exposure. Proactive defense requires targeted hardening measures and resilience improvements to prevent falling victim to this sophisticated attack vector.”
Dior Starts To Send Data Breach Notifications To US Customers
Posted in Commentary with tags Hacked on July 21, 2025 by itnerdA couple of months ago, I posted a story on fashion house Dior getting pwned in a cyberattack. Today Dior is sending data breach notifications to U.S. customers informing them that a May cybersecurity incident compromised their personal information:
Based on the findings of the investigation, the following information has been exposed:
The company clarifies that no payment details, such as bank account or payment card information, were contained in the compromised database, so this information remains safe.
Law enforcement was notified accordingly, while third-party cybersecurity experts were engaged to help contain the incident.
Erich Kron, Security Awareness Advocate at KnowBe4:
“While we often focus on credit card details in situations like this, the elephant in the room is the fact that so much personal information about the clients was lost. It would be no shock to find out that many of these customers are those of high net worth, and probably value their privacy. This breach exposes phone numbers, addresses, possibly passport and tax ID information, as well as other things that the customers of the luxury brand would probably not like made public. In other words, this could be a bit of a mess for Dior. Cybercriminals can use the information that was leaked to target individuals in future attempts of thievery and deception.”
“Those impacted by this breach should be especially careful moving forward and may want to consider locking their credit or taking other similar steps to fight against potential identity theft. For organizations that handle sensitive information such as this, it’s absolutely critical that their employees are trained to spot and report attempted social engineering attacks and that data privacy controls are in place within the organization to secure this information. This means a robust Human Risk Management (HRM) program that is bolstered by other technical controls as well.”
Chris Hauk, Consumer Privacy Champion at Pixel Privacy:
“U.S. customers of House of Dior should immediately take advantage of the free 24-month credit monitoring and identity theft protection package offered by the company. They also need to stay alert for any phishing emails, texts, or phone scams using the purloined information in an attempt to get more info.”
“Meanwhile, customers of Louis Vuitton should be proactive in protecting their accounts and personal information, even though the company has not yet officially announced that they were affected by a similar data breach.”
About that Louis Vuitton thing… It appears that they got pwned as well. I’ll be looking into that and posting about that when I get more details.
Leave a comment »