watchTowr sees SharePoint attackers stealing keys that can outlast patches
watchTowr says its honeypots saw attacks within hours of public exploit code, matching founder Benjamin Harris's core security thesis.
By Ryan Merket · Published
Primary source: BleepingComputer
Why it matters
CVE-2026-50522 shows how stolen authentication material can preserve access after patching, while watchTowr's telemetry demonstrates how quickly public exploit research reaches real attacks.
Benjamin Harris's watchTowr says attackers began exploiting a critical Microsoft SharePoint vulnerability within hours of public proof-of-concept code appearing, using the access to steal cryptographic keys that may remain useful after administrators patch the affected server.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.