Microsoft Fix Targets Attacks on SharePoint Zero-Day

Microsoft released an emergency update for SharePoint Server vulnerability CVE-2025-53770 after active exploitation was observed in the wild; attackers are implanting a backdoor named ToolShell to obtain unauthenticated remote access, steal SharePoint ASP.NET machine keys, and fully access SharePoint content. CISA, Microsoft, and security researchers reported breaches affecting multiple U.S. government agencies, universities, and energy companies, and recommend immediate patching where available, enabling AMSI and Microsoft Defender AV, disconnecting vulnerable servers from the Internet, and rotating machine keys and restarting IIS.