Author: HackWatchit

Key findings : A critical zero-day vulnerability (CVE-2025-53770 ) in SharePoint on-prem is actively being exploited in the wild. Dubbed “ToolShell,” the campaign enables unauthorized access to on-prem SharePoint servers, posing a serious risk to corporate environments Check Point Research identified the first signs of the exploitation on July 7th. Since then, we’ve confirmed dozens of compromise attempts across government, telecommunications, and software sectors in North America and Western Europe. Alarmingly, we see that the attackers also leverage known Ivanti Endpoint vulnerabilities throughout the campaign. A critical zero-day SharePoint remote code execution (RCE) vulnerability, tracked as CVE-2025-53770 and nicknamed “ToolShell,” is…

U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog Pierluigi Paganini July 21, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft SharePoint flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft SharePoint flaw, tracked as CVE-2025-53770 (“ToolShell”) (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. This week, Microsoft released emergency SharePoint updates for two zero-day flaws, tracked as CVE-2025-53770 and CVE-2025-53771, exploited since July 18 in attacks dubbed “ToolShell.” Both vulnerabilities only impact on-premises SharePoint Servers, threat actors could chain them for unauthenticated, remote code…

Deep learning has revolutionized machine learning. But designing the right neural network — layers, neurons, activation functions, optimizers — can feel like an endless experiment. Wouldn’t it be nice if someone did the heavy lifting for you? That’s exactly what AutoML for deep learning aims to solve. In this article, I’ll introduce you to two powerful yet approachable tools for automating deep learning: AutoKeras and Keras Tuner. We will deep dive into these libraries and do some hands-on model building. Why automate deep learning? Deep learning model design and hyperparameter tuning are resource-intensive. It’s easy to: Overfit by using too…

The U.K.’s National Cyber Security Centre (NCSC) has formally attributed a cyber campaign using the malware ‘Authentic Antics’ to Russia’s military intelligence agency, the GRU. The attribution comes alongside U.K. sanctions targeting multiple GRU units and 18 Russian individuals involved in coordinated hybrid operations against Western nations.  The NCSC identified APT28, also known as Fancy Bear, Unit 26165, Forest Blizzard, and Blue Delta, as the hacker group behind the campaign, which has targeted Western logistics and technology sectors using the malware. The Authentic Antics malware was uncovered following a 2023 cyber incident investigated jointly by Microsoft and the NCSC-assured incident…

Immigration authorities in Chicago arrested a Mexican illegal immigrant accused of decapitating a missing Illinois woman and storing her body in a storage container filled with bleach. Jose Luis Mendoza-Gonzalez, 52, of Waukegan, Illinois, was arrested in April and charged with concealing a corpse, abusing a corpse and obstruction of justice, according to the Department of Homeland Security (DHS). Immediately after his first court appearance, Lake County Judge Randie Bruno released Mendoza-Gonzalez from custody. Read the rest of the story at FOX News.

Hackers are exploiting a significant Microsoft vulnerability chain that allows them gain control of on-premises SharePoint servers, steal cryptographic keys, and access Windows applications like Outlook, Teams, and OneDrive. It also gives them persistence in the systems even after reboots and updates. The post Hackers Exploiting Microsoft Flaw to Attack Governments, Businesses appeared first on Security Boulevard.

The Quiet Tsunami Is Already Here It used to be that “blockchain” was a buzzword. It’s slowly becoming a part of your daily life, even if you don’t realize it. Blockchain is becoming less and less noticeable in apps, banks, games, and even your government’s payment systems, just like people use GPS or Wi-Fi without knowing how they function. There won’t be any hype in 2025. It will be about how useful it is. You could slip behind if you don’t pay attention. But it’s easier than you think if you start today. Some teams, like the ones working on…

Over 1,000 CrushFTP instances currently exposed online are vulnerable to hijack attacks that exploit a critical security bug, providing admin access to the web interface. The security vulnerability (CVE-2025-54309) is due to mishandled AS2 validation and impacts all CrushFTP versions below 10.8.5 and 11.3.4_23. The vendor tagged the flaw as actively exploited in the wild on July 19th, noting that attacks may have begun earlier, although it has yet to find evidence to confirm this. “July 18th, 9AM CST there is a 0-day exploit seen in the wild. Possibly it has been going on for longer, but we saw it then. Hackers apparently reverse engineered our…

Unknown attackers have exploited a vulnerability (CVE-2025‑54309) in the CrushFTP enterprise file-transfer server solution to gain administrative access to vulnerable deployments. It’s currently unclear what the attackers are using this access for, but data theft looks most likely. According to the Shadowserver Foundation, there are currently around 1,040 exposed and unpatched CrushFTP instances vulnerable to CVE-2025-54309, predominantly located in the US, Europe, and Canada. How many have been compromised since the attacks began is difficult to know for sure. Organizations that use CrushFTP and haven’t upgraded their instance(s) lately should check whether they have been breached. About CVE-2025‑54309 On Friday…