Critical

SharePoint Flaws Used to Hack Switzerland’s Federal IT Agency

Security Affairs

August 4, 2026 at 8:12 PM

Actively Exploited

Overview

The Swiss Federal IT Agency, known as FOITT, has reported a security incident where attackers exploited vulnerabilities in SharePoint to compromise around 200 user accounts. The agency has not publicly identified the attackers but is currently investigating the breach. As part of the response, FOITT is in the process of rebuilding its affected servers to restore functionality and secure the environment. This incident raises concerns about the security of on-premises software and the potential for sensitive information to be exposed. The situation underscores the need for organizations to regularly update and secure their software to prevent similar attacks in the future.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: SharePoint servers, Swiss Federal IT Agency
Action Required: Rebuilding affected servers, conducting investigations, implementing security updates.
Timeline: Disclosed on [date]

Original Article Summary

Swiss Federal IT Agency FOITT says attackers exploited SharePoint flaws to compromise about 200 accounts. Servers are being rebuilt as investigations continue. Switzerland’s Federal Office for Information Technology and Communications, known as BIT or FOITT, disclosed that unknown attackers had compromised approximately 200 accounts on its on-premises SharePoint servers. The FOITT said the unknown attackers […]

Impact

SharePoint servers, Swiss Federal IT Agency

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on [date]

Remediation

Rebuilding affected servers, conducting investigations, implementing security updates

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Update, Data Breach.

Read Original Article

Related Coverage

Silent Patches Don’t Stop Attackers—They Blind Defenders

SecurityWeek

The article discusses the issue of silent patches, which are updates made to software to fix vulnerabilities without publicly disclosing the details. While these patches can help secure systems, they also create a problem for defenders. Attackers can exploit these vulnerabilities without defenders knowing the full context of the risks they face. This lack of transparency can lead to misprioritization of security efforts, leaving organizations vulnerable. The piece emphasizes the need for better communication about vulnerabilities and updates to ensure that defenders have the information they need to protect against potential exploits.

Aug 25, 2026

ReliaQuest Rejects Compromise Claims After ShinyHunters Incident

Infosecurity Magazine

ReliaQuest has addressed a recent social engineering attack associated with the hacking group ShinyHunters. The company clarified that while there were attempts to compromise its systems, the attackers did not succeed in breaching their defenses. This incident serves as a reminder of the growing threat posed by social engineering tactics, where attackers manipulate individuals into divulging confidential information. Despite the denial of a successful compromise, the event raises concerns about the effectiveness of security measures and the importance of employee awareness training. Companies must remain vigilant against such tactics to protect sensitive data and maintain trust with their clients.

Aug 25, 2026

US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks

Infosecurity Magazine

The U.S. government has imposed sanctions on several individuals linked to the Mabna Institute, a hacking group based in Iran known for cyber-attacks. This group has been involved in various hacking activities, including stealing data from universities and businesses around the world. The sanctions target the group's members to disrupt their operations and deter similar actions in the future. By penalizing these individuals, the U.S. aims to hold them accountable for their cyber activities that threaten both national security and economic interests. This move also signals to other state-sponsored hacking groups that there are consequences for such cyber crimes.

Aug 25, 2026

U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a serious vulnerability in Oracle's HTTP Server and Weblogic Server Proxy Plug-in to its Known Exploited Vulnerabilities catalog. This flaw, identified as CVE-2026-21962, carries a maximum severity score of 10.0, indicating it is a critical risk for users. The vulnerability allows unauthenticated attackers to exploit the affected systems, which could potentially lead to unauthorized access and control. Organizations using these Oracle products should take immediate action to assess their systems and implement necessary security measures to mitigate this risk. The inclusion in CISA's catalog suggests that this vulnerability is being actively targeted by malicious actors, making swift remediation essential.

Aug 25, 2026

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

The Hacker News

Attackers are exploiting two serious vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing unauthorized users to log in as any WordPress user, including those with administrative privileges. These vulnerabilities, identified as CVE-2026-61979, have a CVSS score of 8.1, indicating a high severity level. This situation puts numerous WordPress sites at risk, as it could enable attackers to gain complete control over these sites without needing valid credentials. The vulnerabilities were disclosed by Patchstack, underscoring the need for site administrators to take immediate action. Promptly addressing these flaws is crucial to prevent unauthorized access and potential data breaches.

Aug 25, 2026

Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff

SecurityWeek

Taiwan has charged nine individuals, including staff from Nvidia and Super Micro, for illegally exporting AI servers to China. These exports involved advanced semiconductors that are primarily manufactured in Taiwan, which are crucial for AI infrastructure. The Taiwanese government is taking a strong stance against these actions, reflecting ongoing tensions between the U.S. and China over technology and trade. This case highlights the sensitive nature of semiconductor technology and its role in global competition. The individuals involved face serious legal repercussions, emphasizing the importance of compliance with export regulations in the tech industry.

Aug 25, 2026