Today’s federal deadline for a SharePoint bug anchors a digest about attackers reaching for privileges that are supposed to require nothing less than domain admin or a signed certificate authority. A public proof-of-concept turned a SharePoint deserialization flaw into active exploitation within hours and now has a same-day patch deadline for US federal agencies, a newly published exploit called Certighost lets any ordinary domain user mint a certificate that lets them pose as a Domain Controller, the Golden Chickens malware-as-a-service crew came back with four new modular implants built for stealing Chrome sessions, and healthcare billing vendor Craneware confirmed attackers exfiltrated data touching thousands of US hospitals and pharmacies. Here’s what changed since yesterday’s digest.
Vulnerability watch: SharePoint RCE CVE-2026-50522 hits its CISA patch deadline today after attackers stole machine keys that survive patching
CISA’s Known Exploited Vulnerabilities deadline for CVE-2026-50522 — a CVSS 9.8 deserialization flaw in on-premises Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) — falls today, July 25, requiring US federal civilian agencies to have applied Microsoft’s fix. A public proof-of-concept landed July 20, and according to watchTowr’s honeypot network, real-world exploitation attempts using that PoC succeeded within hours. The attack lets an intruder pull a SharePoint server’s IIS machine keys in a single request, then forge authentication tokens that keep working even after the server is patched — meaning organizations that were compromised before patching need to rotate machine keys separately, not just install the update. This is the third distinct SharePoint flaw exploited in a single month-long wave of attacks against the platform. The Hacker News · Security Affairs · Cybersecurity Dive
Patching this one is necessary but not sufficient — the whole point of the attack is a forged token that outlives the patch. If you run on-prem SharePoint, treat today’s deadline as the floor: confirm the update is installed, then rotate the server’s machine keys and review authentication logs for the window before you patched, since a stolen key from before the fix keeps a door open that the patch itself doesn’t close.
Vulnerability watch: Certighost exploit lets any domain user impersonate a Domain Controller through Active Directory Certificate Services
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, codenamed Certighost, that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and then authenticate as that machine — no administrator rights or user interaction required, just network access and any domain account. The flaw, patched by Microsoft as CVE-2026-54121 (CVSS 8.8) in July’s security update, exists because the certificate authority followed a requester-supplied hostname over SMB and LDAP without first verifying it actually belonged to a real Domain Controller. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can be used to pull the krbtgt secret via DCSync — a path to full domain takeover. The researchers reported the bug to Microsoft in May, and as of publication no primary source had reported exploitation in the wild, but the full proof-of-concept is now public. The Hacker News · Cybersecurity News
A vulnerability that turns “any domain account” into “Domain Controller” collapses the entire privilege model AD CS is supposed to enforce, and a public PoC means the clock to exploitation is now measured in days, not months. If your AD CS deployment issues certificates based on requester-supplied hostnames, confirm July’s patch is installed on every certificate authority and check certificate issuance logs for Domain Controller templates requested by non-machine accounts.
Malware watch: Golden Chickens resurfaces with four new modular malware families built to hijack Chrome sessions
Recorded Future’s Insikt Group reports that the threat actors behind the Golden Chickens malware-as-a-service ecosystem, tracked as TAG-195, have released four new malware families — TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator — despite years of public research into how the group’s tooling works. TinyEgg acts as a lightweight backdoor for initial access and host profiling, then hands off to ChonkyChicken, a more advanced implant that steals browser credentials and can take live control of an open browser session. The new families share common command-and-control infrastructure, persistence techniques, and string obfuscation, suggesting a coordinated architectural refresh rather than independent tools. Separately, TAG-127 has been observed delivering TinyEgg through ClickFix-style social engineering that tricks victims into manually pasting and running malicious commands themselves. The Hacker News · SC Media
ClickFix-style delivery works because it skips every technical control aimed at malicious attachments or links — the user runs the payload themselves, believing they’re fixing a problem. If your security awareness training doesn’t specifically cover “a website asks you to copy and paste a command into Run or a terminal,” this campaign is a reminder to add it, since that single step is now a common initial-access technique across unrelated threat actors.
Breach watch: Craneware confirms data theft in a breach touching thousands of US hospitals and pharmacies
Scotland-based Craneware, a billing and revenue-cycle software vendor used by more than 2,000 US hospitals and nearly 10,000 clinics and retail pharmacies, confirmed that attackers gained unauthorized access to part of its systems and exfiltrated a “significant” volume of data. The company said a percentage of employee data along with a subset of customer and partner records were accessed, but has not detailed exactly what was taken or named any affected customers, and says most of what was stolen is non-sensitive, already-public regulatory data. Craneware has not said whether patient information was involved — notably, the company’s 2021 acquisition of pharmacy software maker Sentry brought it access to 147 million patient records collected over two decades. Craneware says the incident is contained and hasn’t disrupted customer operations, and both US and UK authorities are investigating. Cybernews · The Record · TechCrunch
A vendor breach at this scale is a reminder that “we don’t process patient data ourselves” doesn’t end the question if a supplier holding it does — Craneware’s own disclosure leaves open whether the Sentry-era patient records were in scope. If your organization relies on a billing, pharmacy, or revenue-cycle vendor, this is a good moment to ask them directly what categories of data they hold on your behalf and whether any of it originated from a prior acquisition your contract never anticipated.
Final thought
Every story today involves an attacker reaching for a privilege boundary that’s supposed to be hard to cross — a forged authentication token that outlives a patch, a certificate that turns a regular user into a Domain Controller, a copy-pasted command that hands over a browser session, and a vendor breach that may reach further into patient data than the disclosure admits. None of these needed a novel technique so much as a gap between “this control exists on paper” and “this control actually holds under pressure.” If you want a second opinion on whether your SharePoint machine keys need rotating, whether your AD CS templates are safe from hostname spoofing, or whether your vendor risk questionnaire actually covers acquired data sets, see our zero trust architecture guide for Israeli SMBs or book a discovery call.