Another SharePoint Flaw Under Active Attack

For the fourth time in roughly a month, a SharePoint vulnerability is being exploited in the wild. The latest is CVE-2026-50522, a critical remote code execution bug that Microsoft patched on July 14 as part of its Patch Tuesday releases.

The flaw stems from deserialization of untrusted data. Microsoft’s advisory describes a network-based attack scenario where an authenticated user with at least Site Owner privileges can inject and execute arbitrary code on the SharePoint Server.

Defused, a threat intelligence firm, appears to be the first to spot the exploitation. On July 17, the company reported that its honeypots had detected attempts targeting what looked like a zero-day SharePoint vulnerability. By July 20, Defused had updated its assessment, saying the likely target was CVE-2026-50522.

Things escalated quickly after that. PoC exploit code hit the public, and within a day, security firm WatchTowr confirmed active exploitation.

Attackers Are Stealing Machine Keys

WatchTowr’s analysis paints a concerning picture. Threat actors are pulling SharePoint machine keys with a single request, using them to retain long-term access to compromised systems.

“Attackers are pulling SharePoint machine keys via a single request,” WatchTowr noted, adding, “Patching is not enough; defenders should rotate credentials on any assets that may have been exposed.”

That last point is worth emphasizing. If you’ve already patched, good. But if your SharePoint server was exposed before the patch went on, assume the worst and rotate those keys and credentials.

Microsoft Hasn’t Confirmed Exploitation Yet

Microsoft has not updated its advisory for CVE-2026-50522 to confirm in-the-wild exploitation. That’s not unusual, though. The tech giant often lags behind security researchers in updating advisories after attacks are detected.

It’s a pattern we’ve seen repeatedly with SharePoint vulnerability exploited scenarios this year. The gap between public knowledge and official confirmation can leave defenders guessing about the true scope of the threat.

Three Other SharePoint Bugs Exploited Recently

CVE-2026-50522 isn’t an isolated incident. Three other SharePoint flaws have seen exploitation come to light in recent weeks:

• CVE-2026-58644
• CVE-2026-56164
• CVE-2026-45659

CISA has been warning organizations about attacks targeting SharePoint instances. The agency’s Known Exploited Vulnerabilities (KEV) catalog currently lists 13 SharePoint flaws, five of which were added this year. CVE-2026-50522 has not yet made it onto that list.

What Defenders Should Do Now

If you’re running SharePoint, the math is simple. Patch immediately if you haven’t already. But don’t stop there.

Rotate machine keys and any credentials that might have been exposed. Audit your SharePoint logs for suspicious activity, especially requests that look like they’re pulling configuration data. And keep an eye on CISA’s KEV catalog — if CVE-2026-50522 gets added, that’s a strong signal that federal agencies are being told to treat this as urgent.

The pattern here is clear. Attackers are churning through SharePoint vulnerabilities, and the window between disclosure and exploitation is shrinking. The SharePoint machine keys theft technique WatchTowr documented is particularly nasty because it gives attackers persistence that survives a simple patch.

This wave of attacks should serve as a reminder that patching is just the baseline. For critical infrastructure like SharePoint, assume breach and plan your response accordingly.

U.S. Treasury Hits First VPN Service and Cryptor Seller with Sanctions

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has taken a significant step in the fight against cybercrime by designating two individuals and a VPN service provider. The move targets those who enable ransomware actors and other cybercriminals to carry out malicious activities, including attacks against Americans.

The VPN, known as First VPN Service (1VPNS), has been accused of providing its tools to ransomware groups. Alongside the service, a 45-year-old Ukrainian national, who is reportedly the seller of a malware cryptor, has also been sanctioned. This marks a notable escalation in the U.S. government’s efforts to disrupt the infrastructure that supports ransomware operations.

What Is First VPN Service and Why Was It Sanctioned?

First VPN Service, or 1VPNS, is a virtual private network provider that OFAC claims has knowingly offered its services to cybercriminals. The Treasury’s action freezes any U.S.-based assets of the designated entities and prohibits American citizens and companies from doing business with them.

This is the first time the U.S. has sanctioned a VPN service specifically for its role in ransomware support. The designation sends a clear message: even ancillary services that facilitate cybercrime will face consequences.

The Role of the Malware Cryptor Seller

The 45-year-old Ukrainian individual, whose identity has not been fully disclosed, is accused of selling a malware cryptor—a tool that encrypts malicious code to evade detection by security software. Such tools are critical for ransomware groups to deploy their payloads successfully.

By sanctioning the seller, the Treasury aims to cut off the financial and operational lifelines of these cybercriminal networks. It’s a targeted approach that goes beyond just the attackers themselves to the broader ecosystem that supports them.

Why This Sanction Matters for Ransomware Defense

Ransomware attacks have become a top national security concern, with incidents like the Colonial Pipeline attack highlighting their impact. The Treasury’s action is part of a broader strategy to deter cybercriminals by imposing economic costs.

Sanctions like these don’t just punish individuals—they also disrupt the trust that underpins cybercriminal services. When a VPN or cryptor provider is blacklisted, other criminals may think twice before relying on similar services.

For businesses and individuals, this development underscores the importance of robust cybersecurity measures. While sanctions help, they are just one piece of the puzzle in defending against ever-evolving threats.

How Sanctions Work Against Cybercriminals

OFAC sanctions are a powerful tool. They block assets and prohibit transactions, effectively isolating the designated parties from the U.S. financial system. This can cripple their ability to operate internationally.

The process involves rigorous investigation and evidence gathering, often in coordination with international partners. In this case, the Treasury likely worked with intelligence agencies to trace the VPN’s and cryptor seller’s connections to ransomware groups.

It’s a legal and diplomatic approach that complements technical defenses. While not a silver bullet, it adds another layer of pressure on cybercriminals.

What This Means for the Future of Ransomware Enforcement

The sanctioning of First VPN Service and the cryptor seller signals a shift in how the U.S. tackles ransomware. Instead of merely pursuing the attackers, authorities are now targeting the enabling infrastructure.

This could lead to more actions against VPN providers, hosting services, and other tools that cybercriminals rely on. It’s a proactive stance that may deter future attacks by making it harder for criminals to operate anonymously.

For those in the cybersecurity industry, this is a welcome development. It shows that the government is willing to use all available tools to combat a threat that costs billions annually.

Practical Steps to Protect Against Ransomware

While sanctions are crucial, individuals and organizations must also take their own precautions. Here are some key measures:

• Regularly back up data and store it offline to mitigate the impact of an attack.
• Keep software and systems updated to patch vulnerabilities that ransomware exploits.
• Train employees to recognize phishing attempts, a common entry point for ransomware.
• Use strong, unique passwords and enable multi-factor authentication.
• Implement network segmentation to limit the spread of an infection.

By combining these practices with government enforcement actions, we can create a more resilient defense against ransomware.

For more on related topics, check out our guide on ransomware prevention strategies and VPN security best practices.

What the Researcher Found

A security researcher going by cereblab decided to poke at xAI‘s coding assistant, Grok Build. Version 0.2.93, to be precise. The claim? The tool wasn’t just sending the files it needed for a task. It was bundling up the entire Git repository — full commit history, branches, everything — and shipping it off to a Google Cloud Storage bucket operated by xAI.

That’s a big deal. Think about what’s in a Git repo: not just the current code, but every revision ever made. Secrets that were committed and “fixed” later. Internal comments. Half-baked experiments. The whole archaeology of a project.

How the Test Worked

Cereblab captured one of these uploads in transit. Then they did something clever — they cloned the git bundle straight out of the intercepted request. Inside, they found a file the agent had been explicitly told, in plain terms, not to touch. The instruction was right there in the prompt. Grok Build ignored it and pulled the file into the upload anyway.

So this isn’t a hypothetical. It’s a demonstrated behavior, with receipts.

The Privacy Math

For a solo dev on a public repo, maybe this is annoying but not catastrophic. But for a team working on proprietary software? An unreleased product? A client’s codebase? That’s a different story. Every commit — including the ones that contain accidentally committed API keys or internal architecture discussions — gets mirrored to xAI’s cloud. Even if the tool only reads a few files, it’s exfiltrating the entire project history.

Why This Matters for Developers

This raises a practical question: what exactly are you consenting to when you run an AI coding agent? Most developers assume the tool sends the files relevant to the task at hand. That’s the implicit promise of a “context-aware” assistant. Grok Build’s behavior breaks that assumption.

It also highlights a broader issue with AI development tools. The convenience of letting an agent roam your repository comes with a hidden cost. You’re not just sharing the code — you’re sharing the entire timeline of that code, including the messy parts you thought were buried.

What You Can Do Right Now

• Check your tool’s settings. Look for any option to limit data sharing or disable telemetry.
• Use a separate, sanitized repo. If you’re testing an AI coding agent, give it a copy of the project with sensitive files stripped out.
• Monitor network traffic. Tools like mitmproxy or Wireshark can reveal what’s actually being transmitted.
• Read the privacy policy. It’s tedious, but it’s the only way to know what the vendor claims they do with your data.

Bigger Questions About AI Coding Agents

Grok Build isn’t the only AI coding tool on the market. AI coding assistants from major companies all have some form of data collection. The difference here is the scale. Uploading an entire repository is a different category than sending a few code snippets for autocomplete.

There’s also the question of retention. How long does xAI keep these uploads? Who has access? Can they be deleted on request? None of this is clear from the outside.

Developers are increasingly trusting these tools with their most valuable intellectual property. That trust needs to be earned with transparency, not assumed.

The Takeaway

The Grok Build issue is a reminder that AI tools are still young, and their behaviors can surprise you — not always in a good way. Before you let any agent loose on your codebase, think about what it’s taking with it.

And if you’re using Grok Build, maybe wait for an update that fixes this. Or at least, don’t point it at anything you wouldn’t want posted on a public forum.