WHAT TO KNOW ABOUT TOOLSHELL, THE SHAREPOINT THREAT UNDER MASS EXPLOITATION

Summary from the TLDR InfoSec newsletter

A critical SharePoint vulnerability (CVE-2025-53770), dubbed "ToolShell," is being mass-exploited by Chinese government groups, affecting over 400 systems, including the US National Nuclear Security Administration. The flaw allows unauthenticated remote code execution, credential theft, and data exfiltration. Microsoft patched it on Saturday, but it is being exploited on any company that has not updated their SharePoint.