PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-49704] ToolShell - Chuỗi lỗ hổng SharePoint nghiêm trọng đang bị khai thác trong thực tế

blog.viettelcybersecurity.com | research | CVE-2025-49704 | #active-exploitation | #threat-intelligence | #sharepoint | #cve-2025-53770 | #toolshell | #iocs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel Threat Intelligence analyzes the actively exploited ToolShell chain of four SharePoint CVEs, with detection guidance for unpatched servers and post-exploitation tracing advice.
CVE
CVE-2025-49704
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
[CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation
Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.
Critical · vulnerability · hackerone.com
What is CVE-2025-53770? A Critical Microsoft SharePoint Vulnerability and How to Respond
CVE-2025-53770 is a critical Microsoft SharePoint vulnerability now under active exploitation. Learn how to respond, assess exposure, and improve visibility with proactive security strategies.
vulnerability · wiz.io
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know
Wiz breaks down the exploited SharePoint ToolShell chain: CVE-2025-53770 (CVSS 9.8 RCE) and CVE-2025-53771 (spoofing) bypass July patches, hit on-prem servers only and demand emergency mitigation.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · hunt.io
Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
An exposed open directory revealed a solo operator's full Log4Shell chain against a Graylog host holding Trembita logs, with the access log that proves execution.
Back