decrypted · 9 july 2026 · vulnerabilities and patching

SharePoint under active attack, and the header that trusted everyone

This week's stories share a theme: what happens when the thing an organisation trusted by default turns out to be exactly what an attacker needed. An actively exploited flaw in on-premises Microsoft SharePoint has been rushed onto CISA's Known Exploited Vulnerabilities catalogue, with a ransomware crew using it to steal cryptographic keys rather than simply extort a payment. A Docker image for the open-source Gitea code-hosting platform shipped a default that turned a single HTTP header into full administrator access. And on the ransomware leak sites, several more UK organisations have appeared over the past few days, part of a pattern researchers keep tracing back to a Citrix flaw that clearly still isn't patched everywhere it needs to be.

SharePoint's other shoe drops

On 1 July, CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalogue: a deserialisation flaw in on-premises SharePoint Server that lets anyone with even basic Site Member access run code on the server. Deserialisation bugs are the software equivalent of a machine that reassembles flat-pack furniture from an unmarked box: SharePoint takes a chunk of data sent by the user and rebuilds it into a working object without checking closely enough what it actually is. Microsoft patched it in May, but exploitation only surfaced in numbers weeks later, once enough internet-facing servers had gone unpatched for someone to notice and start using it.

The group behind it, tracked as Storm-2603, has previous form: it used earlier SharePoint bugs in 2025 to deploy Warlock ransomware, and appears to be running the same playbook again. The detail that matters for defenders is what else it steals along the way: the server's ASP.NET machine keys, the cryptographic material SharePoint uses to sign and validate requests. Stolen keys let an attacker forge trusted requests long after the original hole is patched, because the fix closes the door but doesn't invalidate the copied key. NHS England's cyber security operations centre assessed further exploitation as highly likely and told trusts to check their patch status.

The Secure by Design lesson here is unglamorous but important: patching closes a vulnerability, not necessarily the access it already handed over. Any UK organisation running on-premises SharePoint that wasn't patched between May and July should treat the server as compromised rather than merely exposed, and rotate the machine keys rather than assuming the update alone put things right.

One HTTP header, admin access

Gitea supports a legitimate pattern called reverse-proxy authentication, where a front-end proxy like nginx confirms who a user is and passes their username to the application in a header, saving a second login. That only works safely if the application also checks that the header really did come from the trusted proxy and not from the internet at large. Gitea's own source code defaults to trusting only the local machine. Its official Docker image, though, shipped with that trust setting widened to a wildcard, accepting the identity header from any address at all. Researcher Ali (@rz1027), auditing how packaged builds quietly diverge from source defaults, spotted it. The practical result, confirmed once threat actors began probing it about a fortnight after disclosure: a single request with the header X-WEBAUTH-USER: admin and no password logged the sender in as an administrator.

The fix, in version 1.26.4, makes reverse-proxy authentication something an administrator must deliberately switch on, rather than something that activates itself because of a proxy list nobody reviewed. The Secure by Design lesson is that a secure default only counts if it survives packaging. A vendor can get the source code right and still ship a Docker image, an installer or a cloud template that quietly overrides it. Anyone running self-hosted developer tooling, Gitea or otherwise, should be checking what their container images actually shipped with, not just what the documentation says the defaults are.

The leak sites keep naming UK firms

Over the past week, ransomware groups have claimed several more UK victims on their leak sites: the architecture and engineering firm Max Fordham (Qilin), employee benefits specialist HIVE360 (Dragonforce) and investment firm Roundshield Partners (Incransom). These are claims made by the criminals themselves, not confirmed breaches, and should be read that way until the organisations involved say otherwise.

What's more interesting than any single claim is the pattern researchers at Arctic Wolf have been documenting behind a wave of Anubis ransomware intrusions since the start of the year: valid stolen VPN credentials and exploitation of last year's CitrixBleed 2 flaw in NetScaler devices (CVE-2025-5777), followed by attackers hiding inside legitimate remote monitoring and management tools such as ScreenConnect and MeshAgent rather than deploying custom malware that might trip an alert. None of this needs a zero-day. It needs one unpatched Citrix box, one set of credentials, and IT tooling nobody's kept an inventory of. For UK organisations, the lesson isn't a new tool to buy, it's basic hygiene: know which RMM tools are authorised to run on your estate, and treat anything else as an incident.

Sources

If any of this touches systems you run and you'd like a second opinion, get in touch.

SharePoint under active attack, and the header that trusted everyone

SharePoint's other shoe drops

One HTTP header, admin access

The leak sites keep naming UK firms

Sources

More like this