Hello and welcome to the Wednesday, July 23rd, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu bachelor's degree program in Applied Cybersecurity.

SharePoint is still at the top of everybody's mind, and the tool shell vulnerability is still

being exploited. Microsoft has now also released an update for SharePoint 2016.

Yesterday, we only had the update for 2019 and for the subscription edition.

Another thing to point out here, there are actually two files that need to download and apply

for 2019 and 2016. The first one is the security update for SharePoint itself. And then there is a second one, the language

pack. When you install the security update for Microsoft SharePoint, you will have to reboot

your system, and then you'll apply the language pack. The language pack update does not

require another reboot,

but you can't apply them at the same time,

tried it to save some time,

and, well, they're actually then failing,

so make sure you apply one after the other.

There's another thing that I think has been a little bit overlooked

in all of this,

and that's step four here in Microsoft's response timeline that they published

as part of this update.

The early exploits that were used against SharePoint that took advantage of this war on a billy,

they all had in common that they stole the system machine keys.

And well, that's actually a common thing to do if you're exploiting a dot net application.

...