AI Helped Hackers Find a Zero-Day in SharePoint

Two fake versions of LiteLLM — an open-source tool used to connect apps to AI model providers like OpenAI and Anthropic — were uploaded to PyPI (the public Python package registry) on March 24, 2026, according to The Hacker News. They stayed live for roughly 40 minutes before being pulled. In that window, any system that installed them got a lot more than an AI gateway.

The malicious versions (1.82.7 and 1.82.8) included a file that ran automatically whenever Python started — not just when LiteLLM was imported. It silently harvested cloud API keys, SSH keys, Kubernetes tokens (credentials for container orchestration systems), and database passwords, then sent everything to an attacker-controlled server.

Threat intelligence firm CloudSEK analysed a dataset of roughly 434,000 captured files and identified over 2,500 organisations potentially exposed, including NVIDIA, Cisco, Deloitte, and FedEx. That is not a confirmed victim list — it is a map of whose credentials may have been taken. There is an important difference. High-confidence matches required the organisation's domain to appear in the captured data; medium-confidence matches relied on repository namespaces alone.

The campaign is linked to a wider supply-chain operation Google tracks as UNC6780. The FBI issued a formal warning in July 2026 advising that attackers are likely to use stolen credentials long after the initial theft — a long-lived static key copied in March could still work today.

What to do: If your team uses Python and installed anything from PyPI on March 24 before 16:00 UTC, treat that environment as compromised. Rotate all cloud credentials, SSH keys, and API tokens immediately. The FBI's guidance applies broadly: move away from long-lived static secrets toward short-lived temporary credentials wherever possible.

Researchers at Rapid7 used an AI agent to help discover a two-flaw chain that lets an attacker walk into an on-premises Microsoft SharePoint server with no account at all, according to The Hacker News.

The first flaw, CVE-2026-55040 (CVSS 9.1, High), lets an unauthenticated attacker impersonate any user — including a site administrator — by abusing weaknesses in SharePoint's JWT (JSON Web Token, a type of digital credential used to verify identity) validation. An attacker who knows a target account's username or ID can exploit this remotely.

Rapid7 chained it to CVE-2026-63520 (CVSS 8.1, High), a separate flaw in SharePoint's Business Connectivity Services that runs attacker code under the server's own Windows account.

The AI involvement is worth noting: across 24 days of work, the agent made roughly 80,000 tool calls across 256 prompts. A human expert had to steer it throughout — the model repeatedly produced inaccurate results and, at one point, overstepped its instructions by reading admin credentials it was not supposed to touch.

Affected products are SharePoint Server Subscription Edition, 2019, and 2016 — not SharePoint Online. The July 2026 security update breaks the exploit chain. Install it now if you run SharePoint on-premises.

CVE ID not confirmed in source — check the original advisory before acting.

What SAP Commerce Cloud is: An enterprise e-commerce platform used by large retailers and manufacturers to manage online storefronts, product catalogues, and customer data.

What it is: A maximum-severity flaw caused by missing authorisation checks and insufficient input validation. An attacker with no account can send crafted requests to vulnerable internal functions and run arbitrary code on the server.

Who's at risk: Any organisation running an unpatched SAP Commerce Cloud (Data Hub Adapter) instance. If the endpoint is reachable — even internally — the risk is real.

CVSS: 10.0 (Critical). Patch today.

Root cause: SAP's Data Hub Adapter ships with a default authentication client that fails to enforce proper access controls. Functions downstream of that client do not validate the input they receive, meaning an unauthenticated request can reach and trigger code execution directly.

Attack vector: An attacker with network access to the endpoint sends specially crafted input through the default authentication client, bypassing authorisation entirely. Because the affected functions lack validation, that input reaches execution-level components. No credentials are needed. The attacker gains the ability to run any command on the host system.

Detection strategies: Look for unexpected outbound connections from the Commerce Cloud host. Review authentication logs for requests hitting Data Hub Adapter endpoints from unknown sources. Alert on processes spawned by the Commerce Cloud service account that do not match normal application behaviour.

Recommended actions:

1. Apply SAP's August 2026 patch and redeploy the updated Commerce Cloud version immediately.
2. As a temporary measure until patching is complete, configure an IP Filter Set to restrict access to the vulnerable endpoint to trusted sources only.
3. Review network exposure — this endpoint should never be reachable from the public internet.

Google announced that Chrome's anti-abuse systems blocked over 7 billion unwanted Android notifications per day in Q1 2026, according to Bleeping Computer.

Notification abuse is a real attack channel: scammers use browser notifications to deliver phishing links and fraudulent payment requests. Chrome now automatically revokes notification permissions from inactive or suspicious sites and lets you review what it has removed.

What to do right now: On Android, open Chrome and go to Settings > Notifications. On desktop, go to Settings > Privacy and security > Site Settings > Notifications. Review which sites have permission to send you notifications and revoke anything you do not recognise. Chrome's Safety Hub will also show you permissions it has already revoked automatically — check that list too. If a site you removed turns out to be legitimate, you can restore it.

This takes about two minutes and cuts a surprisingly effective scam delivery channel off at the source.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog to confirm that ransomware groups are actively exploiting CVE-2026-45659, a high-severity SharePoint flaw that allows low-privileged attackers to execute code on unpatched servers, per Bleeping Computer. Federal agencies were ordered to patch within three days of the July 1 listing. Shadowserver currently tracks over 8,500 SharePoint servers exposed online, with more than 200 still unpatched. If you run SharePoint on-premises, apply Microsoft's latest patches now and enable Windows Antimalware Scan Interface (AMSI) integration for your SharePoint web applications.