Today’s Field Note

The China-linked Warlock crew is turning SharePoint into a doorway, hitting a water utility, a telecom, a regional government, and a university through on-prem SharePoint flaws (the ToolShell chain). If your SharePoint server is internet-facing and unpatched, you are already on the list, not waiting to be added. Meanwhile GitLab shipped fixes for a 9.9 AI Gateway RCE (patched in 19.2.4, 19.3.2, 19.4.1) affecting self-hosted gateways, and Dell dropped patches for Container Storage Modules including CVE-2026-63688, a CVSS 10.0 missing-authentication bug that hands attackers admin and root on Kubernetes nodes. Three different paths to the same outcome: someone else running code where you thought only you could.

Today’s Action

  • Patch on-prem SharePoint against the ToolShell chain now, then hunt for webshells and rotate machine keys (an existing patch does not evict an attacker who already dropped a shell).
  • If you host your own GitLab AI Gateway, upgrade to 19.2.4, 19.3.2, or 19.4.1 and audit Duo Agent Platform access while you are in there.
  • Inventory Dell CSM deployments and apply the CSM updates; CVE-2026-63688 is unauthenticated and rated 10.0, so treat it as pre-patch compromise until proven otherwise.
  • Review Warlock IOCs against your SharePoint and lateral-movement logs, with extra scrutiny if you run OT or critical infrastructure.
  • Confirm SharePoint, GitLab, and storage control planes are not reachable from the open internet without need.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch Tuesday is a date. Exploitation is a timezone.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.