{"id":7212,"date":"2025-07-28T18:54:21","date_gmt":"2025-07-28T22:54:21","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=7212"},"modified":"2025-07-28T18:54:21","modified_gmt":"2025-07-28T22:54:21","slug":"leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/","title":{"rendered":"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch"},"content":{"rendered":"<p data-start=\"92\" data-end=\"485\">Just a week after <a href=\"https:\/\/www.microsoft.com\/en-ph\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Microsoft<\/a> acknowledged that it failed to fully close two critical SharePoint bugs with its July software updates, researchers revealed how attackers might have gained an early advantage. By digging into exploit timelines and insider accounts, researchers now believe a leak or perhaps AI-assisted reverse engineering enabled malicious actors to deploy the zero\u2011day attack before Microsoft\u2019s patch rollout.<\/p>\n<p data-start=\"487\" data-end=\"917\">It started in May, at the security competition Pwn2Own in Berlin. On May\u202f15, Vietnamese researcher Dinh Ho Anh Khoa demonstrated a working exploit targeting <a href=\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\">SharePoint<\/a> by chaining an authentication bypass with an insecure deserialization bug. Following that demonstration, Microsoft received a detailed white paper and triggered its standard 90\u2011day patch process. That schedule placed the planned Patch\u00a0Tuesday update in mid\u2011July.<\/p>\n<p data-start=\"919\" data-end=\"1352\">However, early access to vulnerability details via Microsoft\u2019s MAPP program occurs about 14 days before release. On June\u202f24, select security vendors signed confidentiality agreements to review the flaws. Less than two weeks later, on July\u202f7, attackers began exploiting the vulnerability chain. Microsoft publicly issued fixes for CVE\u20112025\u201149704 and CVE\u20112025\u201149706 on July\u202f8\u2014but cybercriminal groups quickly found ways to bypass them.<\/p>\n<p data-start=\"1354\" data-end=\"1727\">Trend Micro\u2019s Dustin Childs indicates that the initial patch was too narrow and trivial to bypass. He notes that \u201ca leak happened somewhere\u201d between private disclosure and the patch, giving adversaries enough information to craft working exploits. ZDI and its partners confirmed that attackers could immediately circumvent the initial authentication mitigation, which they found insufficient.<\/p>\n<p data-start=\"1729\" data-end=\"2108\">Further complicating the picture, <a href=\"https:\/\/hostingdiscussion.com\/news\/cybersecurity-transformed-over-five-years-as-home-networks-and-ai-shape-risk-landscape\/\">Tenable<\/a> researcher Satnam Narang suggests attackers may have reverse\u2011engineered the vulnerability themselves. They could have used advanced AI tools\u2014such as Google Gemini or OpenAI\u2019s frontier models\u2014to help map exploit logic as security researchers had. Regardless of method, the zero\u2011day was live in the wild before Microsoft\u2019s fix even landed.<\/p>\n<p data-start=\"2110\" data-end=\"2472\">By mid\u2011July, Microsoft warned that its earlier fixes were incomplete and released critical updates for all affected <a href=\"https:\/\/hostingdiscussion.com\/news\/sharepoint-servers-under-siege-as-zero-day-exploit-bypasses-mfa-protections\/\">SharePoint versions<\/a>. Unfortunately, more than 400 organizations\u2014including government, education, and enterprise entities\u2014suffered compromises. Microsoft now acknowledges state\u2011sponsored groups and ransomware gangs exploited those vulnerabilities.<\/p>\n<p data-start=\"2474\" data-end=\"2859\">This incident raises deeper questions about vulnerability disclosure. If trusted disclosure programs leaked the information\u2014or if AI rebuilt exploits from shared details\u2014Microsoft and vendors may need to rethink how they distribute early access and validate patches before public release. The challenge of protecting pre\u2011patch windows just got more urgent\u2014and more complex.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Just a week after Microsoft acknowledged that it failed to fully close two critical SharePoint bugs with its July software updates, researchers revealed how attackers might have gained an early advantage. By digging into exploit timelines and insider accounts, researchers now believe a leak or perhaps AI-assisted reverse engineering enabled malicious actors to deploy the [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[4090,80,4089,140,4087,4088],"class_list":["post-7212","post","type-post","status-publish","format-standard","hentry","category-featured","tag-aiassisted-hacking","tag-cybersecurity","tag-mapp-leak-risk","tag-microsoft","tag-sharepoint-vulnerability","tag-zeroday-exploit"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero\u2011day-reached-cybercriminals-before-microsofts-patch\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Just a week after Microsoft acknowledged that it failed to fully close two critical SharePoint bugs with its July software updates, researchers revealed how attackers might have gained an early advantage. By digging into exploit timelines and insider accounts, researchers now believe a leak or perhaps AI-assisted reverse engineering enabled malicious actors to deploy the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero\u2011day-reached-cybercriminals-before-microsofts-patch\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-28T22:54:21+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/\",\"name\":\"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2025-07-28T22:54:21+00:00\",\"dateModified\":\"2025-07-28T22:54:21+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero\u2011day-reached-cybercriminals-before-microsofts-patch\/","og_locale":"en_US","og_type":"article","og_title":"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch - Web Hosting News","og_description":"Just a week after Microsoft acknowledged that it failed to fully close two critical SharePoint bugs with its July software updates, researchers revealed how attackers might have gained an early advantage. By digging into exploit timelines and insider accounts, researchers now believe a leak or perhaps AI-assisted reverse engineering enabled malicious actors to deploy the [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero\u2011day-reached-cybercriminals-before-microsofts-patch\/","og_site_name":"Web Hosting News","article_published_time":"2025-07-28T22:54:21+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/","url":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/","name":"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2025-07-28T22:54:21+00:00","dateModified":"2025-07-28T22:54:21+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/leak-or-llm-how-sharepoint-zero%e2%80%91day-reached-cybercriminals-before-microsofts-patch\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Leak or LLM? How SharePoint zero\u2011day reached cybercriminals before Microsoft\u2019s patch"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":460,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=7212"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7212\/revisions"}],"predecessor-version":[{"id":7213,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7212\/revisions\/7213"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=7212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=7212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=7212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}