erroneo.us
Search all guides⌘K

Digest · Saturday

Security digest: July 19, 2025

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: ToolShell. Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition, and anyone still running end-of-life SharePoint 2013 or older.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-53770, CVE-2025-53771

ToolShell: SharePoint On-Prem Unauthenticated RCE Chain

Fixes shipped in July 2025, but ToolShell stole ASP.NET machine keys that survive patching, so any on-prem SharePoint that was internet-facing then needs proof that keys were rotated and no backdoor remains.

Must act: Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition, and anyone still running end-of-life SharePoint 2013 or older.

Can relax: SharePoint Online (Microsoft 365) customers, who were not affected, and on-prem farms that patched, rotated machine keys and ran a hunt in 2025.

  1. Confirm every SharePoint server is on the July 2025 comprehensive update or later (check the farm build in Central Administration)
  2. Enable AMSI integration in Full Mode and run antivirus/EDR on all SharePoint servers
  3. Rotate ASP.NET machine keys with Set-SPMachineKey or the Machine Key Rotation Job, then run iisreset.exe on every server

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.