[Security News] CISA Sets July 19 Deadline for SharePoint 0-Day (7.17)

CISA added Microsoft SharePoint Server flaw CVE-2026-58644 to its KEV catalog after reported exploitation, giving federal agencies until July 19 to patch.…

CISA Sets July 19 Deadline for SharePoint 0-Day (7.17)

Overview

CISA added Microsoft SharePoint Server CVE-2026-58644, a critical deserialization flaw with a CVSS score of 9.8, to KEV and gave federal agencies until July 19, 2026, to apply fixes.
ACR Stealer is using ClickFix-style social engineering to collect browser credentials, live session tokens and files from synced OneDrive and SharePoint folders.
North Korea-linked Contagious Interview activity used fake job tests and SVG steganography to hide OtterCookie-aligned malware.
Kaspersky reported a previously undocumented malware family, GoSerpent, in espionage activity against Southeast Asian government and diplomatic targets.
Armenia detained a Russian tourist named Aleksandr Ermakov on a U.S. warrant tied to REvil, while his lawyers said authorities had the wrong person.

Details

CISA Adds SharePoint CVE-2026-58644 to KEV With July 19 Patch Deadline

CISA added Microsoft SharePoint Server vulnerability CVE-2026-58644 to its Known Exploited Vulnerabilities catalog after reported active exploitation. The feeds.feedburner.com item described the issue as a critical deserialization vulnerability with a CVSS score of 9.8, placing it at the top end of severity scoring.

The immediate operational point is the deadline. Federal Civilian Executive Branch agencies must apply fixes by July 19, 2026. That short window signals that CISA treats exploitation as more than theoretical, even though the available source material does not provide attack-code details or a public proof-of-concept.

Microsoft is the relevant vendor source for patch status through the Microsoft Security Response Center update guide. CISA is the authoritative U.S. government source for KEV deadlines and required federal remediation. NIST remains the reference point for CVE metadata and severity records.

▸ SharePoint CVE-2026-58644 deep dive

A deserialization flaw matters because affected software may mishandle structured data that it later turns back into executable objects or application state. In a server product such as SharePoint Server, that class of bug can become especially serious when it is reachable across a network and does not require deep user interaction. The reported CVSS 9.8 score fits that risk profile: remote code execution(RCE) against a collaboration platform can expose document stores, identity tokens and internal workflow data.

The available evidence identifies Microsoft SharePoint Server as the impacted product family, but it does not list affected build numbers in the supplied material. That limits how precise administrators can be from this briefing alone. The responsible action is still clear: SharePoint Server owners should treat current Microsoft security updates as urgent, confirm that externally reachable systems are patched first, and review logs for unusual access around the disclosure window.

KEV inclusion changes prioritization. Many organizations already rank vulnerabilities by CVSS, asset exposure and exploit maturity. CISA's KEV catalog adds a separate signal: known exploitation. For federal agencies, that signal becomes a binding remediation timeline. For private organizations, it is a practical queueing tool because attackers often reuse publicized enterprise-server flaws against slower patching cycles.

There is no need to share payloads or exploit mechanics to understand the defensive path. Patch available systems, reduce unnecessary SharePoint exposure, verify backup and recovery paths, and watch for Microsoft or CISA updates that refine affected versions or indicators of compromise. If SharePoint supports business-critical workflows, change windows should be accelerated rather than deferred to a routine monthly maintenance cycle.

Key takeaway: CVE-2026-58644 should move ahead of ordinary patch queues because it combines critical severity, SharePoint exposure and KEV-listed exploitation. The defensible first step is patching, followed by exposure review and log analysis.

ACR Stealer Uses ClickFix Lures to Reach Microsoft 365 Files

ACR Stealer is using ClickFix-style lures to turn user action into credential theft. According to feeds.feedburner.com, the infostealer has been in circulation since 2024 and targets saved browser passwords, active session tokens, PDFs, Microsoft 365 documents and files synced from OneDrive and SharePoint.

The reported entry point is social engineering rather than a software vulnerability. Victims are persuaded to paste a command into a Windows Run dialog and execute it. Microsoft was cited as laying out two delivery chains through its Defender Experts team.

For defenders, the issue is less about a single CVE and more about identity exposure. Session tokens can let an attacker bypass the password-reset mindset, because a valid token may preserve access even when the stolen password is no longer useful.

▸ ACR Stealer deep dive

ClickFix attacks exploit a support instinct. The user believes they are completing a repair step, verification step or access step, but the instruction asks them to run attacker-controlled code. That makes the attack difficult to solve with patching alone. It sits between endpoint controls, browser hardening, identity monitoring and user-facing security training.

The Microsoft 365 angle raises the impact. OneDrive and SharePoint sync are designed to make corporate files available across devices. That same convenience gives an infostealer a broader collection surface after it reaches an endpoint. Browser data, PDFs and synced office documents can expose customer files, internal procedures, contracts and authentication material from a single workstation.

Organizations should watch for suspicious command execution through Run dialogs, PowerShell or script interpreters launched from browser sessions. Endpoint detection should also flag unusual access to browser credential stores and mass reads from synchronized folders. Since the source material points to Microsoft Defender Experts analysis, Microsoft security telemetry is likely one of the stronger places to look for detection logic.

The practical mitigation is layered. Block or warn on suspicious clipboard-to-command flows where possible, restrict script execution, enforce phishing-resistant multifactor authentication, and shorten token lifetimes for sensitive apps. Security awareness content should avoid vague warnings and show the specific behavior: a website or prompt asking a user to paste a command into Run is a high-risk event.

Key takeaway: ACR Stealer shows why identity defense cannot stop at passwords. Teams should treat suspicious command prompts and token theft as linked risks across endpoints and Microsoft 365.

Fake Coding Tests Hide OtterCookie-Aligned Malware in SVG Files

North Korea-linked threat actors tied to the Contagious Interview campaign used fake job postings and coding challenges to deliver malware, according to feeds.feedburner.com. The campaign hid malicious payloads inside SVG image files using steganography, a technique that conceals data inside another file format.

The payload was described as aligned with OtterCookie and included multiple theft functions. The available evidence points to browser credentials, crypto wallets and file collection as targeted data categories, but it does not provide a CVE or a patchable vendor flaw.

This is a hiring-chain and developer-risk story. The target does not need to be a traditional enterprise administrator. A developer, contractor or job seeker who runs an interview project can become the initial access point.

▸ Contagious Interview deep dive

Fake coding-test operations work because they fit normal developer behavior. Candidates expect to clone repositories, run package installers and execute sample projects. That workflow creates an opening for malware hidden in project assets, build steps or support files. In this case, SVG files are important because many developers treat images as harmless static resources.

Steganography inside SVG files complicates review. SVG is text-based and can contain structured content, so security checks must go beyond file extensions. A codebase that appears to be a routine interview assignment may carry hidden data that later stages decode. The supplied evidence says users who ran the project received a staged payload aligned with OtterCookie, but defensive reporting should avoid reproducing the mechanics.

The best mitigation is process discipline around untrusted code. Developers should run interview projects in disposable virtual machines or containers with no real browser profile, no production cloud credentials and no personal crypto wallets. Organizations should warn recruiting teams and engineering managers that unsolicited coding exercises can create endpoint exposure.

This campaign also expands the meaning of supply-chain risk. It is not only about poisoned public packages or compromised build systems. A one-off repository sent to a single developer can become a supply-chain foothold if that developer has access to internal source code, secrets or deployment systems.

Key takeaway: The campaign turns developer trust into an attack path. Treat unsolicited coding tests like untrusted software, especially when they ask candidates to run full projects locally.

Kaspersky Reports GoSerpent Espionage Against Southeast Asian Targets

Kaspersky reported a previously undocumented malware family called GoSerpent in activity against Southeast Asian entities, according to feeds.feedburner.com. The campaign has been observed since late 2025 and focuses on long-term access and intelligence gathering.

The reported target set includes government and diplomatic organizations. Kaspersky uncovered the activity in February 2026, according to the supplied source material, and the case fits an espionage pattern rather than a financially motivated intrusion.

No CVE, CVSS score or vendor patch is identified in the available evidence. That means the defensive priority is detection, segmentation and account review rather than a single patch action.

▸ GoSerpent deep dive

Espionage malware usually prizes persistence over speed. The goal is to remain present, collect information and move carefully enough to avoid early detection. That makes long dwell time more damaging than a single burst of data theft, especially in government and diplomatic environments where email, documents and contact networks may hold strategic value.

The name GoSerpent suggests a malware family implemented in Go, though the supplied data does not include technical internals. Go-based malware has become common because the language compiles across platforms and produces self-contained binaries. Defenders should avoid assuming that Windows-only controls are enough unless Kaspersky or another primary report narrows the affected operating systems.

Because this item lacks a named vulnerability, response teams should focus on campaign hunting. Useful steps include reviewing unusual outbound traffic, looking for unfamiliar binaries on sensitive workstations, auditing privileged accounts and checking whether diplomatic or government users received targeted lures. Network segmentation matters because espionage operators often seek quieter movement after first access.

The follow-up question is attribution and tooling overlap. If later reports connect GoSerpent to a known threat group, defenders can map the activity to existing tactics, techniques and procedures. Until then, the conservative reading is that Southeast Asian public-sector and diplomatic networks should treat the report as an intelligence-led hunting prompt, not a patch bulletin.

Key takeaway: GoSerpent is a detection-and-hunting issue rather than a patch-only item. Public-sector defenders in Southeast Asia should review long-term access signals and sensitive-account activity.

Armenia Detains Aleksandr Ermakov in Contested REvil Extradition Case

Armenia has detained Russian tourist Aleksandr Ermakov since June 28 on a U.S. extradition request tied to a REvil ransomware suspect of the same name, according to feeds.feedburner.com. His lawyers and family say authorities have detained the wrong person.

The available evidence identifies a legal dispute, not a newly confirmed intrusion. REvil is the ransomware group connection cited in the warrant context, but the supplied material does not establish guilt, technical evidence or court findings.

For a security briefing, the important distinction is factual. The detention is confirmed by the source material; the identity challenge is also part of the record; the underlying allegation remains subject to legal process.

▸ REvil extradition case deep dive

Cybercrime extradition cases often depend on identity evidence, infrastructure records, payment trails and device forensics. When a suspect name is common enough to create ambiguity, the evidentiary burden becomes more visible. This case is therefore relevant to security readers because ransomware enforcement increasingly crosses borders and relies on cooperation among states.

The REvil reference carries weight because the group has been tied to major ransomware activity in prior years. Still, responsible coverage must separate a ransomware brand from proof against an individual. The supplied evidence includes a family account about the airport detention and a claim that authorities relied on a photo, but it does not include court documents or U.S. charging details.

That gap matters. Security teams should not treat the case as operational threat intelligence about a live campaign. It is better understood as a law-enforcement and attribution story. The outcome may affect future extradition practice, especially if courts scrutinize how identity matches are made in cybercrime cases.

The next items to watch are formal court filings, extradition rulings and any U.S. statement that clarifies the alleged conduct. Until then, the case belongs in the policy and enforcement lane of the security news cycle, not in a vulnerability-response queue.

Key takeaway: The Ermakov case is significant because it tests cross-border cybercrime enforcement and identity claims. It should not be treated as proof of a new REvil operation.

Morning Breaking Updates

feeds.feedburner.com: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until Friday
feeds.feedburner.com: OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests - Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until th
feeds.feedburner.com: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT - Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The mal
feeds.feedburner.com: New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens - A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan que
feeds.feedburner.com: GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft - Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which shared technical details of

▸ More — additional context and sources

E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants

Reported by feeds.feedburner.com. The European Commission on Thursday ordered Google to give rival AI assistants the same reach into Android that Gemini already has: the cam…

New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage

Reported by feeds.feedburner.com. Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks targ…

At a glance

Fact	Publisher	Source
SharePoint Server flaw CVE-2026-58644 carries a CVSS score of 9.8.	feeds.feedburner.com	thehackernews.com
CISA added the SharePoint flaw to KEV and set a July 19 patch deadline for FCEB agencies.	feeds.feedburner.com	thehackernews.com
ACR Stealer targets browser passwords, session tokens and synced Microsoft 365 files.	feeds.feedburner.com	thehackernews.com
Contagious Interview actors hid OtterCookie-aligned malware in SVG files used in coding tests.	feeds.feedburner.com	thehackernews.com
Kaspersky found GoSerpent activity targeting Southeast Asian government and diplomatic entities.	feeds.feedburner.com	thehackernews.com
Armenia detained Aleksandr Ermakov on a U.S. extradition request tied to REvil.	feeds.feedburner.com	thehackernews.com

FAQ

Q1. What is CVE-2026-58644?

A. CVE-2026-58644 is a Microsoft SharePoint Server deserialization vulnerability reported with a CVSS score of 9.8. feeds.feedburner.com said CISA added it to KEV after exploitation was observed, making it the day's highest-priority patch item.

Q2. Who needs to act first on the SharePoint issue?

A. Federal Civilian Executive Branch agencies have the clearest deadline: July 19, 2026, under CISA's KEV process. Private organizations running SharePoint Server should also prioritize Microsoft updates, especially for internet-facing or high-value collaboration systems.

Q3. Why is ACR Stealer different from a normal phishing case?

A. ACR Stealer is not only collecting passwords. feeds.feedburner.com reported theft of live session tokens and synced Microsoft 365 files, which can preserve access even after a password reset if token exposure is not handled.

Q4. How should developers treat fake coding tests after the OtterCookie report?

A. Developers should run unfamiliar interview projects in disposable environments with no real credentials, browser profile or wallet data. The feeds.feedburner.com report said the Contagious Interview campaign used SVG steganography, so file type alone is not a safety signal.

Q5. What should security teams watch next?

A. Watch for Microsoft and CISA updates on affected SharePoint versions, Kaspersky follow-up indicators for GoSerpent, and court records in the Ermakov case. Those sources would clarify patch scope, detection guidance and legal attribution.

Sources

Last updated: 2026-07-17T23:15:58.358Z

Mini-Step

이 블로그 검색