Acronis has developed a security checklist for managed service providers (MSPs) to evaluate the security of remote monitoring and management (RMM) software. The list emphasizes testing capabilities such as endpoint discovery, patch automation, privileged access control, incident containment, and tenant separation. This guidance aims to address the vulnerabilities inherent in RMM tools, which are prime targets for cyberattacks due to their extensive access across customer networks.
bleepingcomputer.com
· 2026-10-06
Symantec and Carbon Black researchers say the China-linked Warlock group, also tracked as Longlegs, has compromised a water utility, a telecom provider, a regional government body and a university by exploiting on-premises SharePoint vulnerabilities, including the ToolShell exploit chain. In one July 22 intrusion, the attacker disabled security software on roughly 40 hosts within two hours and deployed Warlock ransomware to at least 33 machines, using a signed but vulnerable driver to kill endpoint defenses.
bleepingcomputer.com
· 2026-10-02
Symantec reports that the Warlock ransomware group, also tracked as Longlegs or Storm-2603, has recently focused attacks on organizations in Spanish- and Portuguese-speaking countries. Over the past two months the group hit four high-value targets: a water utility, a telecom provider, a regional government body, and a university, gaining initial access via Microsoft SharePoint vulnerabilities including the ToolShell exploit chain.
darkreading.com
· 2026-10-01
CISA has confirmed active exploitation of four vulnerabilities: a maximum-severity JWT authentication bypass in WSO2 API Manager and related products (CVE-2026-5430), a critical Adobe Commerce flaw (CVE-2026-71362), a high-severity SharePoint code injection bug (CVE-2026-65660), and a medium-severity Mikrotik RouterOS SSH bypass (CVE-2026-67279). Federal agencies must patch or mitigate the two critical flaws by September 27. Security firm watchTowr said its honeypots captured forged-token exploitation attempts against WSO2 systems starting September 13.
bleepingcomputer.com
· 2026-09-25
A Wire survey found that 61% of security leaders say access to shared files in Microsoft 365 often stays active far longer than intended, while more than a third struggle to even identify who currently has access to sensitive shared content. The report points to routine sharing habits—like adding freelancers to SharePoint folders or inviting new members into Teams channels—as common ways access quietly persists beyond its original purpose.
bleepingcomputer.com
· 2026-09-18
Microsoft confirmed widespread service degradation across its 365 suite, affecting Outlook, OneDrive, SharePoint, Teams, Copilot and Universal Print. Users reported problems sending or receiving emails, loading files, and accessing print jobs, though Microsoft says availability has largely stabilized above 99 percent.
androidauthority.com
· 2026-09-02
Egiziago Cioffi, CEO of Microsoft partner SynSphere Italia, discovered that an Azure OpenAI email assistant he built was returning SharePoint content to a low-privilege test account that the account could not access directly in SharePoint. The assistant had passed all evaluation scores and unit tests, but comparing outputs from a high-privilege and a low-privilege account against identical queries exposed the mismatch, revealing that retrieval was happening under the indexer's permissions rather than the requester's.
venturebeat.com
· 2026-09-01
A multi-day outage tied to Microsoft's Exchange Online authentication system continues to disrupt Outlook and other Microsoft 365 services into Tuesday, even after Monday's mitigation efforts. Microsoft says the root cause was a misconfiguration preventing authentication components from deploying properly across parts of its infrastructure, affecting SharePoint, Teams, Copilot, Defender XDR, Purview, the admin center, and Universal Print alongside Outlook.
techcrunch.com
· 2026-09-01
Threat intelligence firm Defused reports that hackers are actively probing SharePoint servers by combining two vulnerabilities: an authentication bypass in JWT token validation (CVE-2026-55040) and a Business Connectivity Services flaw (CVE-2026-63520) that enables remote code execution. Proof-of-concept code for both bugs was published publicly in August by researchers at Rapid7 and VulnCheck, and Defused says it has already observed the bypass being exploited alongside admin enumeration on honeypots, though no successful code execution has been confirmed yet.
bleepingcomputer.com
· 2026-08-26
GoKawiil