One flaw, every server that runs the same software - the SharePoint wave that keeps widening

Cybersecurity 4 min 8 sources

A month-long wave of attacks on Microsoft SharePoint shows the internet's hidden fragility - when everyone runs the identical system, a single bug is a break-in everywhere at once.

Key takeaways

A month-long wave of attacks on Microsoft SharePoint has hit five separate flaws, all affecting every supported on-premises version - because everyone runs the same software, one bug is a weakness in thousands of systems at once.
The newest flaw lets attackers steal a server's secret keys, so patching alone is not enough - owners must also rotate those keys to shut the door.
The same pattern is everywhere this month, from SonicWall's edge appliances to cPanel's 40,000 compromised servers; the fix is to patch known-exploited flaws first and reduce what is exposed to the open internet.

The wave that keeps finding new doors

The US cyber-defence agency CISA updated its SharePoint warning again on July 28, and the pattern is the story [1]. Over the past month, attackers have exploited a run of separate flaws in Microsoft SharePoint Server - the software many companies and government offices run on their own machines to share documents [1][2].

CISA now lists five distinct vulnerabilities under active attack: CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522 [1]. (A CVE is just the public ID number a flaw gets when it is catalogued.) Two of them were added to CISA’s Known Exploited Vulnerabilities list in the past two weeks alone - CVE-2026-58644 on July 16 and CVE-2026-50522 on July 22 [1].

The flaws all do the same broad thing: they let an attacker run their own code on the server without a valid login [1]. That is called remote code execution - the worst class of bug, because it hands an outsider the controls.

Why one bug becomes a thousand break-ins

Here is the part worth sitting with. CISA says these flaws affect all supported on-premises SharePoint versions - Subscription Edition, 2019, and 2016 [1]. That is not a coincidence. It is the whole point.

When thousands of organisations run the same software, they do not each have their own private weakness. They share one. A flaw is not a break-in at a single company - it is a skeleton key for every company running that exact version. Attackers scan the whole internet, find every exposed copy, and hit them together [1][7].

The newest flaw in the wave, CVE-2026-50522, makes this worse [2]. Attackers use it to steal the server’s machine keys - the secret values the software uses to sign and trust its own data [1][2]. With those keys copied, an intruder can forge trusted access and walk back in even after the hole is patched [1]. The same theft technique works against every unpatched server, because they all guard their keys the same way.

The same shape, everywhere you look

SharePoint is not unusual. It is typical.

Also this month, the security firm SonicWall disclosed two flaws in its Secure Mobile Access appliances - the boxes that sit at a company’s network edge to let staff in remotely [5]. Chained together, they gave an attacker with no login full control at the deepest level [5]. A ransomware crew known as Inc was already exploiting them before most owners had patched [5]. One appliance model, one flaw chain, every box on the internet a target.

Earlier this year the same pattern hit cPanel - the control panel that a huge share of the world’s web-hosting runs on [6]. A single authentication-bypass flaw let attackers seize administrative control, and researchers tracked more than 40,000 servers compromised, each one carrying many websites and databases [6]. And automated botnets like RondoDox now industrialise the hunt, scanning for 174 known flaws at once and peaking at 15,000 exploitation attempts a day [7] - the search for identical, unpatched copies is fully mechanised.

The scale underneath

This is why a single vendor’s flaw count is a public-safety number. Microsoft’s July “Patch Tuesday” - its monthly batch of fixes - repaired a record 570 flaws, including two already being exploited [3][4]. Every one of those flaws sat in software that runs on a large fraction of the world’s computers at once [4].

The uniformity that makes technology cheap and interoperable is the same uniformity that makes it fragile. When we all run the same thing, we all fall to the same bug.

What defenders and ordinary readers can do

You cannot rewrite the internet’s sameness, but the response to a monoculture is well understood.

Patch fast, and patch the known-exploited ones first. CISA’s binding directive already requires federal agencies to fix cataloged, actively-exploited flaws on a deadline [8] - a good rule for anyone. The gap between a flaw going public and mass exploitation is now days, not months.
After a suspected SharePoint compromise, rotate the machine keys - do not just patch. Because CVE-2026-50522 steals those keys, patching alone leaves the forged-access door open [1][2]. CISA’s guidance walks server owners through it [1].
Shrink what is exposed. A SharePoint or edge appliance that does not need to face the open internet should not. Fewer identical copies reachable from outside means fewer that fall together.
For individuals: keep automatic updates on for your phone, browser, and computer. You benefit from the same principle in reverse - the faster the fix reaches every copy, the shorter the window attackers have.

02 · Lesson · why it matters

Why running the same thing means falling together

When identical systems share one flaw, a single break-in becomes a break-in everywhere - the failures are not separate, but one failure repeated.

A field with one weakness

In the 1840s, most of Ireland’s poor grew one potato. Not one kind of crop - one variety, the Irish Lumper, planted field after field. It was cheap, it grew in bad soil, and it fed a family from a small plot. Then a water mould arrived that the Lumper could not resist.

Because every plant was the same plant, the blight did not damage the crop. It erased it. A more varied field would have lost the vulnerable plants and kept the rest. A field of identical plants had no “rest.” Around a million people died.

That is monoculture: when everything is the same, everything shares one fate.

The internet is a field of identical plants

This month, attackers have run through a set of separate flaws in Microsoft SharePoint - the software many companies and government offices use to share files. The detail that matters is small and easy to skip: the flaws affect every supported version.

That is the monoculture. Thousands of organisations do not each own a private weakness. They own the same one. A flaw in shared software is not a break-in at one company. It is a master template that fits every company running that software.

So an attacker does not pick a target and study it. They write one exploit, scan the whole internet for every copy, and set them off together. The same thing happened this year to cPanel, the control panel a huge share of web hosts run - one flaw, more than forty thousand servers.

The quiet mistake is assuming independence

When we plan for trouble, we tend to imagine it arriving one door at a time. One server falls; the others hold; you have time to react.

That picture assumes failures are independent - that one going down tells you nothing about the next. It is the right picture for a fire in one building. It is the wrong picture for a monoculture. When the systems are identical, their failures are not independent at all. They are perfectly correlated. One flaw is not a thousand small risks. It is one risk, wearing a thousand coats.

This is why the math of “surely not all of them at once” fails so badly. In a monoculture, all of them at once is the normal case, not the freak one.

We build monocultures on purpose

It would be easy to call this a mistake. It is not. Sameness is why technology is cheap and why it works together at all. A standard everyone shares - the same file format, the same login system, the same panel - is what makes things work together. It lets a document open on any machine and a team log in from anywhere.

The uniform field is uniform because uniform is productive. The Lumper fed millions before it failed them. Standard software connects the world before it exposes it. The very thing that concentrates the risk is the thing that delivered the value. That is not a villain’s choice. It is a real trade, made a thousand small times, mostly by people who never saw the whole field.

Diversity is the boring, expensive cure

Nature already solved this, and the solution is dull: do not put everything in one variety. A mixed field loses the plants that catch the blight and keeps the ones that do not. It grows a little less in a good year and survives the bad one.

The same hedge works against a software monoculture, and defenders reach for it in familiar forms. Patch fast, and patch the flaws already being attacked first - shorten the window when every copy is open at once. Do not leave identical systems facing the open internet when they do not need to; fewer exposed copies means fewer that fall together. And when attackers steal a shared secret - as the newest SharePoint flaw does with a server’s signing keys - changing that secret matters as much as fixing the hole. The same stolen key opens every unpatched copy. Keeping some genuine variety, and dividing a network so one break does not become every break, buy the same thing. It is a field where a single blight cannot take the whole harvest.

You are standing in the field

It is easy to read this as someone else’s problem - big companies, government servers, distant machines. It is not. You run the same phone system as hundreds of millions of people, the same browser, the same handful of apps. When one of them has a bad flaw, you are not exposed alone. You are exposed together, with everyone who made the same ordinary choice.

That is the humbling part. From your one seat you cannot see how many others share your exact weakness, or how correlated your safety really is with theirs. The convenience of everyone using the same thing is real, and so is the shared fate hiding inside it. Seeing that does not tell you what to do. It just makes the picture honest: your safety is not only yours, and neither is the risk.

03 · Lab · your turn

The Uniform Fleet

Rehearse how a single flaw takes down every identical system at once, and how diversity - not size - limits the blast.

04 · Hope · carry this

The same sameness that lets one flaw reach every server also carries the fix to all of them at once. And the people who track these waves, from the security press to the agencies, keep getting faster at closing the window before it widens.