SANS Stormcast Thursday, July 24th, 2025: Reversing SharePoint Exploit; NPM "is" Compromise; (#)
SANS Internet Storm Center's Daily Network Security News Podcast · Johannes B. Ullrich
July 24, 20256m 53s
Audio is streamed directly from the publisher (traffic.libsyn.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
SANS Stormcast Thursday, July 24th, 2025: Reversing SharePoint Exploit; NPM "is" Compromise; Reversing SharePoint "Toolshell" Exploits CVE-2025-53770 and CVE-2025-53771 A quick walk-through showing how to decode the payload of recent SharePoint exploits https://isc.sans.edu/diary/Analyzing%20Sharepoint%20Exploits%20%28CVE-2025-53770%2C%20CVE-2025-53771%29/32138 Compromised JavaScript NPM "is" Package The popular npm package "is" was compromised by malware. Luckily, the malicious code was found quickly, and it was reversed after about five hours. https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack Microsoft Quick Machine Recovery Microsoft added a new quick machine recovery feature to Windows 11. If the system is stuck in a reboot loop, it will boot to a rescue partition and attempt to find fixes from Microsoft. https://learn.microsoft.com/en-gb/windows/configuration/quick-machine-recovery/?tabs=intune keywords: sharepoint; reversing; payload; npm; microsoft; windows 11