The name was coined by Dinh Ho Anh, a researcher from Khoa of Viettel Cyber Security, who developed the exploit. The researcher said he picked the name because it exploited ToolPane.aspx, a component for assembling the side panel view in the SharePoint user interface.

Multiple hacking groups—including state actors from China—have targeted a vulnerability in older, on-premises versions of the file-sharing tool after a flawed attempt to patch it.

A critical zero-day vulnerability, CVE-2025-53770, is actively exploited in Microsoft SharePoint, impacting 75 company servers, including major corporations and US government agencies. This flaw allows unauthenticated remote code execution.

Researchers first uncovered a sweeping cyber espionage operation targeting Microsoft server software affecting at least 100 organisations.

More details emerged on the ToolShell zero-day attacks targeting SharePoint servers, but confusion remains over the vulnerabilities.

The 130 CVEs (Common Vulnerabilities and Exposures) disclosed in Microsoft’s monthly release of security fixes includes a remote code execution flaw that ‘definitely’ should be prioritized for patching,

Microsoft’s real definition of critical seems to be what they define as Important: “A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or ...