Blame a leak for Microsoft SharePoint attacks, researcher insists

Researchers reported mass exploitation of recently disclosed SharePoint vulnerabilities (CVE-2025-49704 — unauthenticated RCE — and CVE-2025-49706 — spoofing) that bypassed initial Microsoft patches; more than 400 organizations were compromised by Chinese state-linked groups (Linen Typhoon, Violet Typhoon) and the Storm-2603 ransomware gang, and investigators suspect a leak from Pwn2Own/MAPP disclosures or independent reproduction potentially aided by large language models.